9f299fc345c5b9de31ad9a9fcd6f30251a8146ee1594a8e66160368c5cdd0240

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe
Size

56KB
MD5

a384fcc0c522a24b1e4c3486adedc2a0
SHA1

0f0884813e0960ce86ecfdbd199d22f1001d22e0
SHA256

9f299fc345c5b9de31ad9a9fcd6f30251a8146ee1594a8e66160368c5cdd0240
SHA512

9b75b63bf37c57905a482304077aec87218faa3637b63e981d3468879b9905fb38834982187f1afa41ce0ff48ba9092285b8e18508fa01a7ae2e898869d783df
SSDEEP

1536:+CJBgidqQ+9f6I3QFVDpdQaqob3G61/BJdA1vle:OidqQSKtpvKvle

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iinqbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eppqqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gldglf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdiakp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkknogn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinqbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbkbpoog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abbkcpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmimai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knnhjcog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeicejia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emnbdioi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epcdqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdciiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fncibg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knflpoqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hejqldci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnngpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Licfngjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Felbnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnhpoamf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmdjapgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbccge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhldpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhamkipi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afghneoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibeoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lggejg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbbpmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbibfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblijebc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nojanpej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbghfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbgjbkfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqcjepfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okedcjcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmlddqem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljgpkonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohpkmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aodogdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oampjeml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkihnmhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjhcjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opogbbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggkiol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeokal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkaclqkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccdihbgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbdjchgn.exe

Executes dropped EXE 64 IoCs

pid	Process
2056	Pmannhhj.exe
1572	Pfjcgn32.exe
4060	Pqpgdfnp.exe
1012	Pgioqq32.exe
2072	Pmfhig32.exe
836	Pcppfaka.exe
2064	Pjjhbl32.exe
3340	Pdpmpdbd.exe
1040	Qnhahj32.exe
1268	Qdbiedpa.exe
948	Qfcfml32.exe
2524	Qddfkd32.exe
3728	Qffbbldm.exe
5100	Adgbpc32.exe
2172	Ajckij32.exe
2844	Agglboim.exe
2508	Agjhgngj.exe
3752	Acqimo32.exe
3328	Ajkaii32.exe
3216	Aadifclh.exe
2008	Agoabn32.exe
224	Bebblb32.exe
3032	Bfdodjhm.exe
1696	Bmngqdpj.exe
1016	Bchomn32.exe
4332	Bjagjhnc.exe
3812	Bfhhoi32.exe
2984	Bclhhnca.exe
544	Bnbmefbg.exe
4888	Cndikf32.exe
1796	Cjkjpgfi.exe
4800	Ceqnmpfo.exe
4176	Cmlcbbcj.exe
4756	Cdfkolkf.exe
3640	Cfdhkhjj.exe
5064	Cajlhqjp.exe
4168	Cmqmma32.exe
2248	Ddjejl32.exe
1928	Djdmffnn.exe
1860	Dmcibama.exe
1768	Djgjlelk.exe
4492	Ddakjkqi.exe
4988	Dogogcpo.exe
3244	Daekdooc.exe
3588	Dknpmdfc.exe
4604	Edfdej32.exe
1932	Eolhbc32.exe
1968	Eefaomcg.exe
2360	Ehdmlhcj.exe
2396	Emaedo32.exe
1248	Eopbnbhd.exe
3604	Gepmlimi.exe
3616	Ghniielm.exe
4924	Gohaeo32.exe
4456	Gddinf32.exe
3508	Gkobjpin.exe
556	Gfdfgiid.exe
2976	Gkaopp32.exe
4340	Hdicienl.exe
1148	Hbmcbime.exe
4780	Hdlpneli.exe
3520	Hnddgjbj.exe
3336	Hfklhhcl.exe
4964	Hglipp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jlolpq32.exe	Jphkkpbp.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Eopbnbhd.exe	Emaedo32.exe
File created	C:\Windows\SysWOW64\Pcmeke32.exe	Pkenjh32.exe
File created	C:\Windows\SysWOW64\Mapppn32.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Bboffejp.exe	Bmbnnn32.exe
File created	C:\Windows\SysWOW64\Cpfmlghd.exe	Cacmpj32.exe
File created	C:\Windows\SysWOW64\Cclnpmna.dll	Kjhcjq32.exe
File opened for modification	C:\Windows\SysWOW64\Oldamm32.exe	Oifeab32.exe
File created	C:\Windows\SysWOW64\Gfdfgiid.exe	Gkobjpin.exe
File created	C:\Windows\SysWOW64\Lejomj32.dll	Gpqjglii.exe
File created	C:\Windows\SysWOW64\Dbicpfdk.exe	Cdecgbfa.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Gdobnj32.exe	Gmdjapgb.exe
File created	C:\Windows\SysWOW64\Aokcklid.exe	Qqhcpo32.exe
File opened for modification	C:\Windows\SysWOW64\Gmcdffmq.exe	Gkdhjknm.exe
File opened for modification	C:\Windows\SysWOW64\Paelfmaf.exe	Oogpjbbb.exe
File created	C:\Windows\SysWOW64\Iamamcop.exe	Ilphdlqh.exe
File created	C:\Windows\SysWOW64\Cgieglah.dll	Pifnhpmi.exe
File created	C:\Windows\SysWOW64\Aobbbd32.dll	Igpdfb32.exe
File opened for modification	C:\Windows\SysWOW64\Oifeab32.exe	Okedcjcm.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Npepkf32.exe	Nmfcok32.exe
File opened for modification	C:\Windows\SysWOW64\Ncchae32.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Igafkb32.dll	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Enhifi32.exe	Ecbeip32.exe
File created	C:\Windows\SysWOW64\Alncgf32.dll	Lpekef32.exe
File created	C:\Windows\SysWOW64\Ldqmlddk.dll	Miomdk32.exe
File opened for modification	C:\Windows\SysWOW64\Dkekjdck.exe	Dqpfmlce.exe
File created	C:\Windows\SysWOW64\Fdkdibjp.exe	Fqphic32.exe
File created	C:\Windows\SysWOW64\Pbmmao32.dll	Gkkgpc32.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Chnlgjlb.exe
File opened for modification	C:\Windows\SysWOW64\Hnodaecc.exe	Hkpheidp.exe
File created	C:\Windows\SysWOW64\Jdedak32.exe	Jdbhkk32.exe
File created	C:\Windows\SysWOW64\Ebdlangb.exe	Eoepebho.exe
File opened for modification	C:\Windows\SysWOW64\Nhegig32.exe	Momcpa32.exe
File created	C:\Windows\SysWOW64\Gfameb32.dll	Mifcejnj.exe
File opened for modification	C:\Windows\SysWOW64\Gnjjfegi.exe	Ginnfgop.exe
File created	C:\Windows\SysWOW64\Cgcmjd32.exe	Cpleig32.exe
File opened for modification	C:\Windows\SysWOW64\Elbhjp32.exe	Eiaoid32.exe
File created	C:\Windows\SysWOW64\Hdlpneli.exe	Hbmcbime.exe
File created	C:\Windows\SysWOW64\Hnddgjbj.exe	Hdlpneli.exe
File opened for modification	C:\Windows\SysWOW64\Ickglm32.exe	Ilqoobdd.exe
File created	C:\Windows\SysWOW64\Bdlgcp32.dll	Opeiadfg.exe
File created	C:\Windows\SysWOW64\Biiobo32.exe	Bboffejp.exe
File created	C:\Windows\SysWOW64\Oigllh32.exe	Ooagno32.exe
File created	C:\Windows\SysWOW64\Fibojhim.exe	Fagjfflb.exe
File created	C:\Windows\SysWOW64\Ghoqak32.dll	Oodcdb32.exe
File created	C:\Windows\SysWOW64\Ogcnmc32.exe	Ncchae32.exe
File created	C:\Windows\SysWOW64\Cklgfgfg.dll	Bpkdjofm.exe
File opened for modification	C:\Windows\SysWOW64\Ccdihbgg.exe	Cpfmlghd.exe
File created	C:\Windows\SysWOW64\Ohnefj32.dll	Mehjol32.exe
File created	C:\Windows\SysWOW64\Neqhhf32.dll	Dbqqkkbo.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Edionhpn.exe
File opened for modification	C:\Windows\SysWOW64\Glkmmefl.exe	Gmimai32.exe
File opened for modification	C:\Windows\SysWOW64\Igdgglfl.exe	Iomoenej.exe
File opened for modification	C:\Windows\SysWOW64\Efblbbqd.exe	Eiokinbk.exe
File created	C:\Windows\SysWOW64\Jjnmkgom.dll	Ddklbd32.exe
File created	C:\Windows\SysWOW64\Faaigehd.dll	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Gdencf32.dll	Meiioonj.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Kelkaj32.exe	Kbmoen32.exe
File created	C:\Windows\SysWOW64\Plopnh32.dll	Oeokal32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9520	12972	WerFault.exe	976

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikfabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcbknkol.dll"	Lhncdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fijgdejm.dll"	Oampjeml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqfkck32.dll"	Fmqgpgoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eppqqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjicdmmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klfaapbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikaqhj32.dll"	Mhppji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dinmhkke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijeeipc.dll"	Kgamnded.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Felbnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bboffejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkcigjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmeliho.dll"	Bjodjb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iafonaao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cioilg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pilehehn.dll"	Mimpolee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcqedkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljbfpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecbeip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehdmlhcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfningai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbghfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbighjdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkicaahi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhmedh32.dll"	Ajpqnneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkkple32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpmomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bboffejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogclbn32.dll"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emaedo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmmde32.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daollh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgjjlakk.dll"	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbkbpoog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnoknihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omhebonp.dll"	Qqhcpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cippgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kqdaadln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poigcbng.dll"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eolhbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahhgi32.dll"	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghghj32.dll"	Lklbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kopapk32.dll"	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miepkipc.dll"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhblk32.dll"	Plkpcfal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2056	5080	NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe	88
PID 5080 wrote to memory of 2056	5080	NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe	88
PID 5080 wrote to memory of 2056	5080	NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe	88
PID 2056 wrote to memory of 1572	2056	Pmannhhj.exe	89
PID 2056 wrote to memory of 1572	2056	Pmannhhj.exe	89
PID 2056 wrote to memory of 1572	2056	Pmannhhj.exe	89
PID 1572 wrote to memory of 4060	1572	Pfjcgn32.exe	90
PID 1572 wrote to memory of 4060	1572	Pfjcgn32.exe	90
PID 1572 wrote to memory of 4060	1572	Pfjcgn32.exe	90
PID 4060 wrote to memory of 1012	4060	Pqpgdfnp.exe	91
PID 4060 wrote to memory of 1012	4060	Pqpgdfnp.exe	91
PID 4060 wrote to memory of 1012	4060	Pqpgdfnp.exe	91
PID 1012 wrote to memory of 2072	1012	Pgioqq32.exe	92
PID 1012 wrote to memory of 2072	1012	Pgioqq32.exe	92
PID 1012 wrote to memory of 2072	1012	Pgioqq32.exe	92
PID 2072 wrote to memory of 836	2072	Pmfhig32.exe	93
PID 2072 wrote to memory of 836	2072	Pmfhig32.exe	93
PID 2072 wrote to memory of 836	2072	Pmfhig32.exe	93
PID 836 wrote to memory of 2064	836	Pcppfaka.exe	94
PID 836 wrote to memory of 2064	836	Pcppfaka.exe	94
PID 836 wrote to memory of 2064	836	Pcppfaka.exe	94
PID 2064 wrote to memory of 3340	2064	Pjjhbl32.exe	95
PID 2064 wrote to memory of 3340	2064	Pjjhbl32.exe	95
PID 2064 wrote to memory of 3340	2064	Pjjhbl32.exe	95
PID 3340 wrote to memory of 1040	3340	Pdpmpdbd.exe	96
PID 3340 wrote to memory of 1040	3340	Pdpmpdbd.exe	96
PID 3340 wrote to memory of 1040	3340	Pdpmpdbd.exe	96
PID 1040 wrote to memory of 1268	1040	Qnhahj32.exe	97
PID 1040 wrote to memory of 1268	1040	Qnhahj32.exe	97
PID 1040 wrote to memory of 1268	1040	Qnhahj32.exe	97
PID 1268 wrote to memory of 948	1268	Qdbiedpa.exe	98
PID 1268 wrote to memory of 948	1268	Qdbiedpa.exe	98
PID 1268 wrote to memory of 948	1268	Qdbiedpa.exe	98
PID 948 wrote to memory of 2524	948	Qfcfml32.exe	99
PID 948 wrote to memory of 2524	948	Qfcfml32.exe	99
PID 948 wrote to memory of 2524	948	Qfcfml32.exe	99
PID 2524 wrote to memory of 3728	2524	Qddfkd32.exe	101
PID 2524 wrote to memory of 3728	2524	Qddfkd32.exe	101
PID 2524 wrote to memory of 3728	2524	Qddfkd32.exe	101
PID 3728 wrote to memory of 5100	3728	Qffbbldm.exe	102
PID 3728 wrote to memory of 5100	3728	Qffbbldm.exe	102
PID 3728 wrote to memory of 5100	3728	Qffbbldm.exe	102
PID 5100 wrote to memory of 2172	5100	Adgbpc32.exe	103
PID 5100 wrote to memory of 2172	5100	Adgbpc32.exe	103
PID 5100 wrote to memory of 2172	5100	Adgbpc32.exe	103
PID 2172 wrote to memory of 2844	2172	Ajckij32.exe	104
PID 2172 wrote to memory of 2844	2172	Ajckij32.exe	104
PID 2172 wrote to memory of 2844	2172	Ajckij32.exe	104
PID 2844 wrote to memory of 2508	2844	Agglboim.exe	105
PID 2844 wrote to memory of 2508	2844	Agglboim.exe	105
PID 2844 wrote to memory of 2508	2844	Agglboim.exe	105
PID 2508 wrote to memory of 3752	2508	Agjhgngj.exe	107
PID 2508 wrote to memory of 3752	2508	Agjhgngj.exe	107
PID 2508 wrote to memory of 3752	2508	Agjhgngj.exe	107
PID 3752 wrote to memory of 3328	3752	Acqimo32.exe	108
PID 3752 wrote to memory of 3328	3752	Acqimo32.exe	108
PID 3752 wrote to memory of 3328	3752	Acqimo32.exe	108
PID 3328 wrote to memory of 3216	3328	Ajkaii32.exe	109
PID 3328 wrote to memory of 3216	3328	Ajkaii32.exe	109
PID 3328 wrote to memory of 3216	3328	Ajkaii32.exe	109
PID 3216 wrote to memory of 2008	3216	Aadifclh.exe	110
PID 3216 wrote to memory of 2008	3216	Aadifclh.exe	110
PID 3216 wrote to memory of 2008	3216	Aadifclh.exe	110
PID 2008 wrote to memory of 224	2008	Agoabn32.exe	111

C:\Users\Admin\AppData\Local\Temp\NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a384fcc0c522a24b1e4c3486adedc2a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\Pmannhhj.exe
  C:\Windows\system32\Pmannhhj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\Pfjcgn32.exe
    C:\Windows\system32\Pfjcgn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\SysWOW64\Pqpgdfnp.exe
      C:\Windows\system32\Pqpgdfnp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1012
      - C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        23⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        24⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        25⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        26⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        27⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        30⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        31⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        32⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        33⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        34⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        35⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        36⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        37⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        38⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        39⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        40⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        41⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        43⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        44⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        47⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        49⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        52⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        53⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        54⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        55⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        56⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        58⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        59⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        60⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        63⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        64⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        65⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        66⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        67⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        69⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        70⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        71⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        72⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        73⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        74⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        75⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        76⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        77⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        78⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        79⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        80⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        81⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        82⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        83⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        84⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        85⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        86⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        87⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        88⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        89⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        91⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        92⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        93⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        94⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        95⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        96⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        97⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        99⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        100⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        101⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        102⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        103⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        104⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        105⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        106⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        107⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        108⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        109⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        110⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        111⤵
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        112⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        113⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        114⤵
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        115⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        116⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        117⤵
        Drops file in System32 directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        118⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        119⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Moobbb32.exe
        
        C:\Windows\system32\Moobbb32.exe
        120⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        121⤵
        Drops file in System32 directory
        
        PID:964
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        122⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        123⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        124⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        125⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        126⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        127⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        128⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        129⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        130⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        131⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        132⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        133⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        135⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        136⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        137⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        138⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        142⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        143⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        144⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        145⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        146⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        147⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        148⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        149⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        150⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        151⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        152⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        153⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        155⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        156⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        157⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        158⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        159⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        160⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        161⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        162⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        163⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        164⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        165⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        167⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        168⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        169⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        170⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        171⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        172⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        173⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        174⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        175⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        176⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        177⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        178⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        179⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        180⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        181⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        182⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        183⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        184⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        185⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        186⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        187⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        188⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        189⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        190⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        191⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        192⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        193⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        194⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        195⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        196⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        197⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        198⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        199⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        200⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        201⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        203⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        204⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        205⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        206⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        207⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        208⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        209⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        210⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        211⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        212⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        213⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        214⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        215⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        216⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        217⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        219⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        220⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        221⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        222⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        223⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        224⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        225⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        226⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        228⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        230⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        231⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        232⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        233⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        234⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        235⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        236⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        237⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        238⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        239⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        240⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        241⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3632
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        243⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        244⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        245⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        246⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        247⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        248⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        249⤵
        Drops file in System32 directory
        
        PID:1080
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        250⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        251⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        252⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        253⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        254⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        255⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        256⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        257⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        258⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        259⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        260⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        261⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        262⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        263⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        264⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        265⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        266⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        267⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        268⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        269⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        270⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        271⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        272⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        273⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        274⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        275⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        276⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        277⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        278⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        279⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        281⤵
        Drops file in System32 directory
        
        PID:9052
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        282⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        283⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        284⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        286⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        288⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        289⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        292⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        293⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        294⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        295⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        296⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        297⤵
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        298⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        300⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        301⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        302⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        303⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8424
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        305⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        306⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        307⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        308⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        309⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        310⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        311⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        312⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        314⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        315⤵
        Modifies registry class
        
        PID:8568
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        316⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        317⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        318⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        319⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        320⤵
        Drops file in System32 directory
        
        PID:8368
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        321⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        322⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        323⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        324⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        325⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        326⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        327⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        328⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        329⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        330⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        331⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9324
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        333⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9400
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9456
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        336⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        337⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        338⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        339⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        340⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        341⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        342⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        344⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        345⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        346⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        347⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        348⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        349⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        350⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        351⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        352⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        353⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9304
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        355⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        356⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        357⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        358⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        359⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        360⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        361⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        362⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        363⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        364⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        365⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        366⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        367⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        368⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        369⤵
        Modifies registry class
        
        PID:9424
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        370⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        371⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        372⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        373⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        374⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        375⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        376⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        378⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        379⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9784
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        382⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        384⤵
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        385⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        386⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        387⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        388⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        389⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        390⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        391⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        393⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        394⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        395⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        396⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        397⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        398⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        399⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        400⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        401⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        402⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        403⤵
        Modifies registry class
        
        PID:10720
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        404⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        405⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        406⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        407⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        408⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        409⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        410⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        411⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        412⤵
        Drops file in System32 directory
        
        PID:11108
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        413⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        414⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        415⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        416⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        417⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        418⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        419⤵
        Drops file in System32 directory
        
        PID:10444
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        420⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        421⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        422⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10708
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        424⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        425⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        426⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        427⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        428⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        429⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        430⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        432⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        433⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        434⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        435⤵
        Drops file in System32 directory
        
        PID:10636
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        436⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        437⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10972
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        439⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        440⤵
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10260
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        442⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        443⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        444⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        445⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        446⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        447⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        448⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        449⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        450⤵
        Drops file in System32 directory
        
        PID:11012
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11252
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        452⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        453⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        454⤵
        Modifies registry class
        
        PID:10688
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        455⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        456⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        457⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        458⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        459⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        460⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        461⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        462⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        463⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        464⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        465⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        466⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        467⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        468⤵
        Modifies registry class
        
        PID:11736
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        469⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        470⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        471⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        472⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        473⤵
        Modifies registry class
        
        PID:11948
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        474⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        475⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        476⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        477⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        478⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        479⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        480⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        481⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        482⤵
        Modifies registry class
        
        PID:11328
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        483⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        484⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        485⤵
        Drops file in System32 directory
        
        PID:11544
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        486⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        487⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        488⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11880
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        490⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        491⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        492⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        493⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        494⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        495⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11400
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        497⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        498⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        499⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        500⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        501⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        502⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        503⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        504⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        505⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        506⤵
        Drops file in System32 directory
        
        PID:11684
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11896
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        508⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        509⤵
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        510⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        511⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        512⤵
        Modifies registry class
        
        PID:12048
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        513⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11812
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        515⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        516⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        517⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        518⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        519⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2180
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        521⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        522⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        523⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        524⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        525⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        526⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        527⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        528⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        529⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        530⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        531⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        532⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        533⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        534⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        535⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        536⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        537⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        538⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        539⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        540⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        541⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        542⤵
        Modifies registry class
        
        PID:12612
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12672
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        544⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        545⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        546⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        547⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        548⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        549⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        550⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        551⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        552⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        553⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        554⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        555⤵
        Drops file in System32 directory
        
        PID:13220
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        556⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        557⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        558⤵
        Modifies registry class
        
        PID:12344
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        559⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        560⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        253⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        254⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        255⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        256⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        257⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        258⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        260⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        261⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        141⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        142⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        143⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        144⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        145⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        146⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        147⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        148⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        149⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        106⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        107⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        108⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        109⤵
        Drops file in System32 directory
        
        PID:5136

C:\Windows\SysWOW64\Dnbakghm.exe
C:\Windows\system32\Dnbakghm.exe
1⤵
PID:12480
- C:\Windows\SysWOW64\Dbnmke32.exe
  C:\Windows\system32\Dbnmke32.exe
  2⤵
  PID:12512
- - C:\Windows\SysWOW64\Dkfadkgf.exe
    C:\Windows\system32\Dkfadkgf.exe
    3⤵
    PID:4696
  - - C:\Windows\SysWOW64\Dndnpf32.exe
      C:\Windows\system32\Dndnpf32.exe
      4⤵
      PID:12600
    - - C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        5⤵
        
        PID:12680
      - C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        6⤵
        Modifies registry class
        
        PID:12692
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        7⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        8⤵
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        9⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        10⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        11⤵
        
        PID:12932

C:\Windows\SysWOW64\Eehicoel.exe
C:\Windows\system32\Eehicoel.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:13016
- C:\Windows\SysWOW64\Eejeiocj.exe
  C:\Windows\system32\Eejeiocj.exe
  2⤵
  PID:13064
- - C:\Windows\SysWOW64\Felbnn32.exe
    C:\Windows\system32\Felbnn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:13132

C:\Windows\SysWOW64\Fpbflg32.exe
C:\Windows\system32\Fpbflg32.exe
1⤵
PID:13168
- C:\Windows\SysWOW64\Fijkdmhn.exe
  C:\Windows\system32\Fijkdmhn.exe
  2⤵
  PID:13236
- - C:\Windows\SysWOW64\Fbbpmb32.exe
    C:\Windows\system32\Fbbpmb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:13308
  - - C:\Windows\SysWOW64\Flkdfh32.exe
      C:\Windows\system32\Flkdfh32.exe
      4⤵
      PID:12320
    - - C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        5⤵
        
        PID:12384
      - C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        6⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        7⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        8⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        9⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        10⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        11⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        12⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        13⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        14⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        15⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        16⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        17⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        18⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4984
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        20⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        21⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        22⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        23⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        24⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        25⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        26⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        27⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        28⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        29⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        30⤵
        Drops file in System32 directory
        
        PID:12656
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        31⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12796
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        33⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        34⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        35⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        36⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        37⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        38⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        39⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        40⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        41⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        42⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        43⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        44⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        45⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        46⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        47⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        48⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        49⤵
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        50⤵
        
        PID:12432

C:\Windows\SysWOW64\Ilqoobdd.exe
C:\Windows\system32\Ilqoobdd.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:12504
- C:\Windows\SysWOW64\Ickglm32.exe
  C:\Windows\system32\Ickglm32.exe
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\Impliekg.exe
    C:\Windows\system32\Impliekg.exe
    3⤵
    - Modifies registry class
    PID:4608
  - - C:\Windows\SysWOW64\Jmbhoeid.exe
      C:\Windows\system32\Jmbhoeid.exe
      4⤵
      PID:5336
    - - C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        5⤵
        
        PID:228
      - C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        6⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        7⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        8⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        9⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        10⤵
        Drops file in System32 directory
        
        PID:2408
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        11⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        12⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        13⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        14⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2440
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:636
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        17⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        18⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        19⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        20⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        21⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        22⤵
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        23⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        24⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        25⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        26⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        27⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        28⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        30⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        31⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3520
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        33⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        34⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        35⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        36⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        37⤵
        
        PID:5440

C:\Windows\SysWOW64\Mjjkaabc.exe
C:\Windows\system32\Mjjkaabc.exe
1⤵
PID:5908
- C:\Windows\SysWOW64\Mqdcnl32.exe
  C:\Windows\system32\Mqdcnl32.exe
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\Mcelpggq.exe
    C:\Windows\system32\Mcelpggq.exe
    3⤵
    PID:6004
  - - C:\Windows\SysWOW64\Mfchlbfd.exe
      C:\Windows\system32\Mfchlbfd.exe
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        5⤵
        
        PID:3780
      - C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        6⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        7⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        8⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        9⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        10⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        11⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        12⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        13⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        14⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        15⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        16⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        17⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        18⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        19⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        20⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        21⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        22⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        23⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        24⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        25⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        26⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        27⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        28⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        29⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        30⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        31⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        32⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        33⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        34⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        35⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        36⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        37⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        38⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        39⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        40⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        41⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        42⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        43⤵
        
        PID:6488

C:\Windows\SysWOW64\Boenhgdd.exe
C:\Windows\system32\Boenhgdd.exe
1⤵
PID:5744
- C:\Windows\SysWOW64\Bogkmgba.exe
  C:\Windows\system32\Bogkmgba.exe
  2⤵
  PID:548
- - C:\Windows\SysWOW64\Bddcenpi.exe
    C:\Windows\system32\Bddcenpi.exe
    3⤵
    PID:3352
  - - C:\Windows\SysWOW64\Boihcf32.exe
      C:\Windows\system32\Boihcf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:6208
    - - C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        5⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6300
      - C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        6⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        7⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        8⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        9⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        10⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        11⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        12⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        13⤵
        Drops file in System32 directory
        
        PID:5132

C:\Windows\SysWOW64\Dkekjdck.exe
C:\Windows\system32\Dkekjdck.exe
1⤵
PID:6524
- C:\Windows\SysWOW64\Doccpcja.exe
  C:\Windows\system32\Doccpcja.exe
  2⤵
  PID:1060
- - C:\Windows\SysWOW64\Egohdegl.exe
    C:\Windows\system32\Egohdegl.exe
    3⤵
    PID:3080
  - - C:\Windows\SysWOW64\Eoepebho.exe
      C:\Windows\system32\Eoepebho.exe
      4⤵
      Drops file in System32 directory
      PID:6744
    - - C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        5⤵
        
        PID:6212
      - C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        6⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        7⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        8⤵
        
        PID:6428

C:\Windows\SysWOW64\Fajbjh32.exe
C:\Windows\system32\Fajbjh32.exe
1⤵
PID:7040
- C:\Windows\SysWOW64\Gokbgpeg.exe
  C:\Windows\system32\Gokbgpeg.exe
  2⤵
  PID:6556
- - C:\Windows\SysWOW64\Gnnccl32.exe
    C:\Windows\system32\Gnnccl32.exe
    3⤵
    PID:6240
  - - C:\Windows\SysWOW64\Galoohke.exe
      C:\Windows\system32\Galoohke.exe
      4⤵
      PID:7212
    - - C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        5⤵
        
        PID:7260
      - C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        7⤵
        Modifies registry class
        
        PID:7916
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        8⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        9⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        10⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        11⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        12⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        13⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        14⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        15⤵
        
        PID:6192

C:\Windows\SysWOW64\Hejqldci.exe
C:\Windows\system32\Hejqldci.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7988
- C:\Windows\SysWOW64\Inebjihf.exe
  C:\Windows\system32\Inebjihf.exe
  2⤵
  PID:6740
- - C:\Windows\SysWOW64\Iacngdgj.exe
    C:\Windows\system32\Iacngdgj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:7324
  - - C:\Windows\SysWOW64\Ieojgc32.exe
      C:\Windows\system32\Ieojgc32.exe
      4⤵
      PID:3356
    - - C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        5⤵
        
        PID:6784
      - C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        6⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        7⤵
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        8⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        9⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        10⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        11⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        12⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        13⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        14⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        15⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        16⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        17⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        18⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        19⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        20⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        21⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        23⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        24⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        25⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        28⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        29⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        30⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        31⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        32⤵
        
        PID:7228

C:\Windows\SysWOW64\Lpjjmg32.exe
C:\Windows\system32\Lpjjmg32.exe
1⤵
PID:5992
- C:\Windows\SysWOW64\Lchfib32.exe
  C:\Windows\system32\Lchfib32.exe
  2⤵
  PID:7452
- - C:\Windows\SysWOW64\Lakfeodm.exe
    C:\Windows\system32\Lakfeodm.exe
    3⤵
    PID:8812
  - - C:\Windows\SysWOW64\Llcghg32.exe
      C:\Windows\system32\Llcghg32.exe
      4⤵
      Drops file in System32 directory
      PID:3540
    - - C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        5⤵
        
        PID:7804
      - C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        6⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        7⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        8⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        9⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        11⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        12⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        13⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        14⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        15⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5056
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        17⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        18⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        19⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        20⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        21⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        22⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        23⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        24⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        25⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        26⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        27⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        28⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        29⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        30⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        31⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        32⤵
        
        PID:8892

C:\Windows\SysWOW64\Ckpamabg.exe
C:\Windows\system32\Ckpamabg.exe
1⤵
PID:7876
- C:\Windows\SysWOW64\Cigkdmel.exe
  C:\Windows\system32\Cigkdmel.exe
  2⤵
  PID:8004
- - C:\Windows\SysWOW64\Cmedjl32.exe
    C:\Windows\system32\Cmedjl32.exe
    3⤵
    PID:7836
  - - C:\Windows\SysWOW64\Cildom32.exe
      C:\Windows\system32\Cildom32.exe
      4⤵
      PID:4704
    - - C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        5⤵
        Drops file in System32 directory
        
        PID:1184
      - C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        6⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        8⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        9⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        10⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        11⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        12⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        13⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        14⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8652
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        16⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        17⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        18⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        19⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        20⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        21⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        22⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        23⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        24⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        25⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        26⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        28⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        29⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        30⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        31⤵
        Modifies registry class
        
        PID:9320
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        32⤵
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        33⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        34⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        35⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        37⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        38⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        39⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        40⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        41⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        42⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        43⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        44⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        45⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        46⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        47⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        49⤵
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        50⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12972 -s 400
        51⤵
        Program crash
        
        PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 12972 -ip 12972
1⤵
PID:9072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
56KB

MD5
024251749a942c3a27b78e06447e368d

SHA1
67dadd5c1576a074af0ce236dc5bd603e2d7ea46

SHA256
980528e69c237b72174dca188f7e6c653bc2abc1a63c4e32cf48a4b7b2f559f7

SHA512
62cff2c1d2ed4ff0d24282baab51d802af792247a12e892694d0a30b1ccc2e4328e4d89839d789941e23fc2b04227475bac5f6b19ca6b9abf9a6adfb834de458

Download Submit
C:\Windows\SysWOW64\Aadifclh.exe

Filesize
56KB

MD5
024251749a942c3a27b78e06447e368d

SHA1
67dadd5c1576a074af0ce236dc5bd603e2d7ea46

SHA256
980528e69c237b72174dca188f7e6c653bc2abc1a63c4e32cf48a4b7b2f559f7

SHA512
62cff2c1d2ed4ff0d24282baab51d802af792247a12e892694d0a30b1ccc2e4328e4d89839d789941e23fc2b04227475bac5f6b19ca6b9abf9a6adfb834de458

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
56KB

MD5
802ba4201b4a73d90e000d15c97814f3

SHA1
dec6fd8a445053096129abde67b17ae840de57f7

SHA256
0b6592cfc27d6108e6367accbe19b6ac1cb64988e6f156579df4724c7bbdae48

SHA512
47ecf545ceb7e742e4c31ad04a2d84c564e5b28d6618446cf3b9cbf9d59c438400a9b26ae2a185b1d4c40115d6bf7d08e8cb671d7719cfe0aeeafef09779b597

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
56KB

MD5
802ba4201b4a73d90e000d15c97814f3

SHA1
dec6fd8a445053096129abde67b17ae840de57f7

SHA256
0b6592cfc27d6108e6367accbe19b6ac1cb64988e6f156579df4724c7bbdae48

SHA512
47ecf545ceb7e742e4c31ad04a2d84c564e5b28d6618446cf3b9cbf9d59c438400a9b26ae2a185b1d4c40115d6bf7d08e8cb671d7719cfe0aeeafef09779b597

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
56KB

MD5
5449bd53e4f96731b6da93b1cb569bab

SHA1
209ab3ab6bf58768e86dc8961f5f078ef6132ed0

SHA256
5148576df9fbb412d60b3fbf903cb3bc4e7fa244483ac85598400537bb596a78

SHA512
4f519dc0e2f14b3668865f2139d61a2afadd1e82267288e5f3eb1dac46b28ed894368ff00cd3956b32d7066b79f9b4a475d8e2c45b69170d1ac71eebc7f1ef10

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
56KB

MD5
5449bd53e4f96731b6da93b1cb569bab

SHA1
209ab3ab6bf58768e86dc8961f5f078ef6132ed0

SHA256
5148576df9fbb412d60b3fbf903cb3bc4e7fa244483ac85598400537bb596a78

SHA512
4f519dc0e2f14b3668865f2139d61a2afadd1e82267288e5f3eb1dac46b28ed894368ff00cd3956b32d7066b79f9b4a475d8e2c45b69170d1ac71eebc7f1ef10

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
56KB

MD5
922dc08a9311dbc4089f7cc0b09eeee1

SHA1
c782437d6af8f5b1dfac86c0b1a0a2d7118f045c

SHA256
d4911608a55b4cf651eb84ffa47662a84d00a2527fa7e321d7844be86668ebea

SHA512
88ffb96092e1682c1569bd2cda8de68ec7cbfb2b81cdf2a6bb163b4c267ca3de11bdff24bf7df286e3ec7fe60251fd7000e3d9b5de4a6bea2179d1893839acab

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
56KB

MD5
922dc08a9311dbc4089f7cc0b09eeee1

SHA1
c782437d6af8f5b1dfac86c0b1a0a2d7118f045c

SHA256
d4911608a55b4cf651eb84ffa47662a84d00a2527fa7e321d7844be86668ebea

SHA512
88ffb96092e1682c1569bd2cda8de68ec7cbfb2b81cdf2a6bb163b4c267ca3de11bdff24bf7df286e3ec7fe60251fd7000e3d9b5de4a6bea2179d1893839acab

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
56KB

MD5
9c9b223c9b79c13efd1c8b56a669904f

SHA1
3686db362222e98fee5bc2e392b2571b5510feaa

SHA256
ec5e82afe81b0a636468c64fca736607786475c1d1acf5d1171a7c2e6939cad5

SHA512
9aab4cf6b3b3513e1084928e3005b39952ed7ecac60e82f5eb2938474c556c3b703fc9657bbb60e32d3ad778104e64bf76443cbdf1c062e98dcc4d6e352f13be

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
56KB

MD5
9c9b223c9b79c13efd1c8b56a669904f

SHA1
3686db362222e98fee5bc2e392b2571b5510feaa

SHA256
ec5e82afe81b0a636468c64fca736607786475c1d1acf5d1171a7c2e6939cad5

SHA512
9aab4cf6b3b3513e1084928e3005b39952ed7ecac60e82f5eb2938474c556c3b703fc9657bbb60e32d3ad778104e64bf76443cbdf1c062e98dcc4d6e352f13be

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
56KB

MD5
aa5104be7f98328fac7a434cf3924fe3

SHA1
8d587bd5399ce413daa24137bae4cb660afce75a

SHA256
b82a3046f3931906270283e821b0d8c6285b0a3abe596599a6be967e087177c3

SHA512
fc37bd008b4ac565d40b44bd4459b5bd273f4bfebc2a808784857351a28c94dfdae974b541e181c22e52bd15d9210f1013a32e9c482b60ef17e7b0968d281993

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
56KB

MD5
aa5104be7f98328fac7a434cf3924fe3

SHA1
8d587bd5399ce413daa24137bae4cb660afce75a

SHA256
b82a3046f3931906270283e821b0d8c6285b0a3abe596599a6be967e087177c3

SHA512
fc37bd008b4ac565d40b44bd4459b5bd273f4bfebc2a808784857351a28c94dfdae974b541e181c22e52bd15d9210f1013a32e9c482b60ef17e7b0968d281993

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
56KB

MD5
1d4a10ccf074e06f2665773be9d1c3bb

SHA1
2f2dafb21c18bf6deb9549f7b0c6d039224f8298

SHA256
0ce6e33419cff7123eea4e16243ad13f1133c0a9cb54ad651184513f986db3b7

SHA512
d6ad4cd2b4bd6f9002a606dcb913298534d49604b661592b7e09bdabbc2b091cc6cfbfbc8f0e45447e363f21bd195377cbc335a4caf5dbfd02ac89a23ca590e1

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
56KB

MD5
1d4a10ccf074e06f2665773be9d1c3bb

SHA1
2f2dafb21c18bf6deb9549f7b0c6d039224f8298

SHA256
0ce6e33419cff7123eea4e16243ad13f1133c0a9cb54ad651184513f986db3b7

SHA512
d6ad4cd2b4bd6f9002a606dcb913298534d49604b661592b7e09bdabbc2b091cc6cfbfbc8f0e45447e363f21bd195377cbc335a4caf5dbfd02ac89a23ca590e1

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
56KB

MD5
35364d337f15508aec81384271f79930

SHA1
14dca4ad074200413b24c0d817c64756b303f177

SHA256
26c26e2ab99c41f7338dff2afc916c39b7b7cfe4de734016bd0ab73d84ae8fe9

SHA512
fd95d3950fbbf7458178cb4a816f9491a508d5f72fd17af293cdbe2ea083f8ec8fccba64ba35850a26ab6b239438bf377cb124a0cc3fd6de743aa057668e0436

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
56KB

MD5
35364d337f15508aec81384271f79930

SHA1
14dca4ad074200413b24c0d817c64756b303f177

SHA256
26c26e2ab99c41f7338dff2afc916c39b7b7cfe4de734016bd0ab73d84ae8fe9

SHA512
fd95d3950fbbf7458178cb4a816f9491a508d5f72fd17af293cdbe2ea083f8ec8fccba64ba35850a26ab6b239438bf377cb124a0cc3fd6de743aa057668e0436

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
56KB

MD5
1e1324bd871479c885002bdf9f76b0fa

SHA1
40eec981dd077fcd0530bf5ed489f58f96212280

SHA256
df60e4764b420084f4d5539cbc511d4361ac1b65089674b46013ff73a6048102

SHA512
8fb4b294725fb28f10a9fe10d2cda97d376cfce56222f29c5dc65c30385de67c8acee191dcc2e659037c233d8087c8f2d84b0f879e07dc9915bd9a47985334ea

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
56KB

MD5
1e1324bd871479c885002bdf9f76b0fa

SHA1
40eec981dd077fcd0530bf5ed489f58f96212280

SHA256
df60e4764b420084f4d5539cbc511d4361ac1b65089674b46013ff73a6048102

SHA512
8fb4b294725fb28f10a9fe10d2cda97d376cfce56222f29c5dc65c30385de67c8acee191dcc2e659037c233d8087c8f2d84b0f879e07dc9915bd9a47985334ea

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
56KB

MD5
fab484d2f22f7eecaa5deeb29f424cdc

SHA1
0b477973a90fc0547c0c5bce898812ec5bd85370

SHA256
9b732aa0efbae90439103f4b434949d19cc5f41853d78f6b419ab7956086061f

SHA512
55ca5aa175d919b61a5deaa8bd7c193d642f8e017f118452a384e0661a6c2fb8ee250bb64fe500763afd9e27f7b69bd697c9916b4ddedc2b2a478bce7b1c239b

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
56KB

MD5
fab484d2f22f7eecaa5deeb29f424cdc

SHA1
0b477973a90fc0547c0c5bce898812ec5bd85370

SHA256
9b732aa0efbae90439103f4b434949d19cc5f41853d78f6b419ab7956086061f

SHA512
55ca5aa175d919b61a5deaa8bd7c193d642f8e017f118452a384e0661a6c2fb8ee250bb64fe500763afd9e27f7b69bd697c9916b4ddedc2b2a478bce7b1c239b

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
56KB

MD5
9035a2e6c926330a26c9551bb548825f

SHA1
e96a1ba2973b0b1adba59002bca8d4ee1443795a

SHA256
80727a8a10993635aa059e91a4dd04dc9c81ff0c50a0e949b604f4c9139c1f39

SHA512
4300382fdd3c1433b983ad4dcaf6ae2018692f0df089239b2910e894e1907fee52d6ef40dde74b08ec176c08f9d67ef6d82859a0ed426a567ab3f6042f36335e

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
56KB

MD5
9035a2e6c926330a26c9551bb548825f

SHA1
e96a1ba2973b0b1adba59002bca8d4ee1443795a

SHA256
80727a8a10993635aa059e91a4dd04dc9c81ff0c50a0e949b604f4c9139c1f39

SHA512
4300382fdd3c1433b983ad4dcaf6ae2018692f0df089239b2910e894e1907fee52d6ef40dde74b08ec176c08f9d67ef6d82859a0ed426a567ab3f6042f36335e

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
56KB

MD5
d323270fac071313d06688a729409d7f

SHA1
a8c1f9bc5deb6d3abc974c80bc18b506f1c92577

SHA256
8067786bfaba5541dfd9970677ff03e66dfa599260c9d6a441518881870a5f3b

SHA512
9c0287e86a340a24e12c4ea235240e3d40c5fc9bfa7634954c72019827cdbb698e67be50c676fa1a3038ba7c13ef7ec1dd90c442918bc9589c62a404e2df26f2

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
56KB

MD5
d323270fac071313d06688a729409d7f

SHA1
a8c1f9bc5deb6d3abc974c80bc18b506f1c92577

SHA256
8067786bfaba5541dfd9970677ff03e66dfa599260c9d6a441518881870a5f3b

SHA512
9c0287e86a340a24e12c4ea235240e3d40c5fc9bfa7634954c72019827cdbb698e67be50c676fa1a3038ba7c13ef7ec1dd90c442918bc9589c62a404e2df26f2

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
56KB

MD5
385d26028dea637d626e29b03ae574f8

SHA1
9f9dbd1686dec5390fd73684411057b6827d747a

SHA256
780bbaf6b47ab14dfc7fa9ac679a0d001360389bf315d30305415a5f79fb86a0

SHA512
93743f3cef527adda28e15432492ffae8ab6c574255eab096d3d30c60e99d2c7254d031d615974a6e2220a62ccd8db69e4c3753e8fe3863ce646e55d399af18b

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
56KB

MD5
385d26028dea637d626e29b03ae574f8

SHA1
9f9dbd1686dec5390fd73684411057b6827d747a

SHA256
780bbaf6b47ab14dfc7fa9ac679a0d001360389bf315d30305415a5f79fb86a0

SHA512
93743f3cef527adda28e15432492ffae8ab6c574255eab096d3d30c60e99d2c7254d031d615974a6e2220a62ccd8db69e4c3753e8fe3863ce646e55d399af18b

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
56KB

MD5
8ae14b729c1b96aeb4a9f045cdad1016

SHA1
506a67b7a2d1e8a180b20486e15bc91eb3a3d72d

SHA256
41c030049a53da9b6198194d0c883cd785867d07fdac68792fdc0bbcdea5a977

SHA512
2f4e8c312ce41e57c5307861f304477d89a434ba62ec0ea0a344315c29cd621b5540526fb8f8b360c3a4bf328a11684246566582f87456fb350ab33cb2973054

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
56KB

MD5
8ae14b729c1b96aeb4a9f045cdad1016

SHA1
506a67b7a2d1e8a180b20486e15bc91eb3a3d72d

SHA256
41c030049a53da9b6198194d0c883cd785867d07fdac68792fdc0bbcdea5a977

SHA512
2f4e8c312ce41e57c5307861f304477d89a434ba62ec0ea0a344315c29cd621b5540526fb8f8b360c3a4bf328a11684246566582f87456fb350ab33cb2973054

Download Submit
C:\Windows\SysWOW64\Bjodjb32.exe

Filesize
56KB

MD5
b6c427918841daf691addb0ca0d7456e

SHA1
fc5a5e59c12c68d17119859d73951d650cdc7d54

SHA256
e8a664cad0efa7ad33526dd94ebc26e8d863b57d210e2bf0ef82eab5c8e2c21b

SHA512
91b8d95a88b27f96afe534c72a23ae6008544ce6d51e95339682b17801dc35f23188e44a24e4a0bbba34ef68fe7769c5481bf47e824fd5a135f0fa49e9205bd6

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
56KB

MD5
be7be99264398bbcbc2725ba4cd0a613

SHA1
fbbf20a2ac5aff82cf4fa7e63814ff4787d7b0df

SHA256
f57a0acde95a2d6df220ec7bcbe3d7468c769d699eff41bc12579afeddf07841

SHA512
ac9a040a4e72cea939b88821e48fe276bb3d98e2fe15ba66081318b6c300b2f0e49c43e5fa741dea6bdce7c097e50bca2f60ed9bcc85ab9cf3e5866691016943

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
56KB

MD5
be7be99264398bbcbc2725ba4cd0a613

SHA1
fbbf20a2ac5aff82cf4fa7e63814ff4787d7b0df

SHA256
f57a0acde95a2d6df220ec7bcbe3d7468c769d699eff41bc12579afeddf07841

SHA512
ac9a040a4e72cea939b88821e48fe276bb3d98e2fe15ba66081318b6c300b2f0e49c43e5fa741dea6bdce7c097e50bca2f60ed9bcc85ab9cf3e5866691016943

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
56KB

MD5
83787e72175a47245a5516be91bb1f40

SHA1
11947cec45510fa715099bc1d1472ca154de71e7

SHA256
413661474afdd0ab6c0fc8e9a9e0c68cab018454cd11296461e21a0c927cb1fe

SHA512
a9ddf943858d55a8eeb51cbeadb9f6193b8c7a91285a726fbcccb8cc97bcf783805466366fae50c9b03a5dac892b78b51bc92efda998d37d9f707d5206c13374

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
56KB

MD5
83787e72175a47245a5516be91bb1f40

SHA1
11947cec45510fa715099bc1d1472ca154de71e7

SHA256
413661474afdd0ab6c0fc8e9a9e0c68cab018454cd11296461e21a0c927cb1fe

SHA512
a9ddf943858d55a8eeb51cbeadb9f6193b8c7a91285a726fbcccb8cc97bcf783805466366fae50c9b03a5dac892b78b51bc92efda998d37d9f707d5206c13374

Download Submit
C:\Windows\SysWOW64\Ccmgiaig.exe

Filesize
56KB

MD5
70ac3068a5f98930027a62eff28b82a6

SHA1
a610a331aa5d2f40c6207aed30977d46af12db3c

SHA256
1daac8ce612182ae5b1286fb9a09989f0b260fcd041d9748169de17103aafd05

SHA512
4cd69386960a5983668d6338c3ee8be371fd73c158d6a4e501ddcd7c7a948d1ebf43b81b241fce9b5be12c2ebaf906d55c1af5966764f6f65d70a78ae1b3a024

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
56KB

MD5
957a9ec1f36132ad41a7a364611128d9

SHA1
62faced63c6e3637a6d8e41a535d19c1b2168b86

SHA256
fd1d75a46779b94b700da04ebdceb37b39304b9f592110c9e312da69e6c869e5

SHA512
ea6f95d0e8f03ee9c1534ecf2f7bc1b31b2549b77680f4181257acca4f469aeb8b5e458695efc32a8521f5050568571d2d2100d2d70b245e6c0f88b7c4a8f61b

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
56KB

MD5
957a9ec1f36132ad41a7a364611128d9

SHA1
62faced63c6e3637a6d8e41a535d19c1b2168b86

SHA256
fd1d75a46779b94b700da04ebdceb37b39304b9f592110c9e312da69e6c869e5

SHA512
ea6f95d0e8f03ee9c1534ecf2f7bc1b31b2549b77680f4181257acca4f469aeb8b5e458695efc32a8521f5050568571d2d2100d2d70b245e6c0f88b7c4a8f61b

Download Submit
C:\Windows\SysWOW64\Cgqqdeod.exe

Filesize
56KB

MD5
a968629ae76305f3511f216f5bf2ee86

SHA1
9e060f2e19b447006d375276fb1665cec4c34d1a

SHA256
6bcc3799195069441125cab5729c3ca47393e21e1a645882b975353d33f20b21

SHA512
4077765ce0313ec136c05db559823c29a6942324b426c40d4d796bbebb433876bae31a68c778074e89ee6975f4c5a802fb873b5bd45a7523ef2eb693b2788335

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
56KB

MD5
86c7b53bf9327b8320364d7876b5afc3

SHA1
9bc0ca77c8727166f9add6f5fcba0d602135ade5

SHA256
969f4d2eeeff594afcf7912755dc96505a6e0d5a9ffd49946611e801857d6653

SHA512
6c9666e8ae938206b900913e6b7b3904b523bfa84dde8b597e900e09998152922ac54ce706d477070a5bd7626192cf150fd1e1094e41ea529941b923ebcaaba5

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
56KB

MD5
86c7b53bf9327b8320364d7876b5afc3

SHA1
9bc0ca77c8727166f9add6f5fcba0d602135ade5

SHA256
969f4d2eeeff594afcf7912755dc96505a6e0d5a9ffd49946611e801857d6653

SHA512
6c9666e8ae938206b900913e6b7b3904b523bfa84dde8b597e900e09998152922ac54ce706d477070a5bd7626192cf150fd1e1094e41ea529941b923ebcaaba5

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
56KB

MD5
339962985e9231b2ed0cffc2a2a1a0b2

SHA1
12fc309ab019ba8f756092d75d60b3585a0119c7

SHA256
693d731a487554e605970f8cb59225c75c7a3772beed52bcec6056fb1683f49e

SHA512
95bc9c78a2558fe577bac6b6077421110f620f749f1ad697aeb3f30004d7e3170c4262d7fbc0472d0193c006b609a82493dd16cfbf558e553d02888a027fb897

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
56KB

MD5
6f4e483b1a3d8c43e9056825534bd7f8

SHA1
ddf4f3e20d83adf10fbc5416f2e20e418c5d4e0c

SHA256
27b20421b966c774ddf7c64029af31bfd126872b4222e83cab388a04ea723921

SHA512
1f0927a85401435c61fcf810ccc4d0fb667cb28aa4b85d5a31901c23359b4b748e342d909f41a49ee440aeddebba6db8690f79b71433e6ba8f08e869ada7b383

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
56KB

MD5
6f4e483b1a3d8c43e9056825534bd7f8

SHA1
ddf4f3e20d83adf10fbc5416f2e20e418c5d4e0c

SHA256
27b20421b966c774ddf7c64029af31bfd126872b4222e83cab388a04ea723921

SHA512
1f0927a85401435c61fcf810ccc4d0fb667cb28aa4b85d5a31901c23359b4b748e342d909f41a49ee440aeddebba6db8690f79b71433e6ba8f08e869ada7b383

Download Submit
C:\Windows\SysWOW64\Emnbdioi.exe

Filesize
56KB

MD5
c10df0a80bf3915b5796f73803a1ce10

SHA1
981b4f0e113badb1458731c340e74f834ba914cb

SHA256
4271e156fe38bb271527355c05587c4133f7cf50e0d059859fd299813c0140d3

SHA512
15ff25b8f5b83e7cf748bf20b451e04e04dccbd147d59cd08bd3757a2382a3a85d4a17f57425a7e592afca5acf05701648c034ef9850d22f3145eb9a9ba89a05

Download Submit
C:\Windows\SysWOW64\Eopbnbhd.exe

Filesize
56KB

MD5
801a96dde4bcd5ccc8937eb11ba7b252

SHA1
0f7601a585ea4706ffe436c71294915ce6822b66

SHA256
5dc49e3cfa9d1bf4f596b7553546b32b40f6261fdfa1e6693ea07cc1d92df0c2

SHA512
4909dab674a0ab490236dbf097644d94a9be45a35932afd22597e2cc7c3cdee00677e785670779f9aba5555b43d59c38e897005b95cc68ce80e18724d314caa1

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
56KB

MD5
32b4e274d3b9e858568e5d2c2aec0675

SHA1
5f5e218870c8aef2e2b68eb713455772e14b2695

SHA256
9c5fc313e5e217788d056514f70402e56df05a051e32a39ffc2b117341fd5d89

SHA512
b00c7c1a9a0b696d9350bf2a7d13179c79349cbdba895e9bd70e09bae6e0bd118d975ecef0860410419bb7c696e1ebf699d9c91ad2f7f148f0edbbaa0acd8b74

Download Submit
C:\Windows\SysWOW64\Fmqgpgoc.exe

Filesize
56KB

MD5
443171f31275bafc3d225473a89fc503

SHA1
6a668d3ab4d0b4b20423c7ecb5ff92a1c6785f16

SHA256
fabc1fb5d5e220754cb1fc0c46349b5d1414575d9625cac0836473ff2b199c00

SHA512
f54f52e424301552f88abe494fc1fea3e0f9c4b939742db06018834e415fcbf704d7a809d526f989edffecf2f78cfcaca2699edaa777bb0364434c6e7c768eb6

Download Submit
C:\Windows\SysWOW64\Gikkfqmf.exe

Filesize
56KB

MD5
3c6298024d44d003849ef1dd2a4290bf

SHA1
92c6018e64b6733a64cee7906c63fcdb85b85477

SHA256
c604259f11fd1352f4d2e96b127089025a102e88f8bbd3ed2a39918594e63c67

SHA512
a3f1a509a415411d587d66d1394f5e61ba9469c988928ac3a511a5e9906f323229f4b038206a5737c2f99f7b8078d404da5f724b1b334924746523711714b9fc

Download Submit
C:\Windows\SysWOW64\Ibffhhek.exe

Filesize
56KB

MD5
ba56f818e446a961fe771bf4beb23fa8

SHA1
7e5f2112b9fe9150c31a765d9e4a1df733c62d67

SHA256
a38dd391f015307d8c0acca9dffef2b23487d2ce57501bf1d973718faf0cb2a2

SHA512
b4c6c34341af801a736c4027b369fa83042b1850edb36446db1d74d2c6a7b6866788cceda3677f880501ad9dc5da6b7c54e21e5f776c478f3e18e1c45feb4204

Download Submit
C:\Windows\SysWOW64\Ikokan32.exe

Filesize
56KB

MD5
5613fc8e44e756890f9c4b4124e34e32

SHA1
905806ebac1c93ef1d12baca77146c2e47282108

SHA256
bc8d4a918b00daa758766ed3792993ac5bfe0b35822c2f91c9aeedddbbbbe308

SHA512
06ab0d5517c9c7d02930daf9db916e0cc5fcb336cc8f216adf9d9a2394085bdc99fc9dc17fa13553c2a85f8c7feefb6558f9531b6f5e637ef3b29e6bb4963adf

Download Submit
C:\Windows\SysWOW64\Jgfdmlcm.exe

Filesize
56KB

MD5
91b0e50cc44a726e1841d70d5bceebc7

SHA1
22d389fc4a761375ea415ff69a3a72c5e4e60f22

SHA256
e20b4bc659355a6b8df3590e0ef6d72336abc2fa75a36c198aef64b02bfe0858

SHA512
e20c71781ebf8c50f68c8e8a45cf13f2a61b08a842c6234735fd9c74772c54259a6cc9e9e5a0efd6cb3e46f9394493f4e08020cb5a7abde01615327c892deb58

Download Submit
C:\Windows\SysWOW64\Jieagojp.exe

Filesize
56KB

MD5
ab3ab70b3ecd0afc3d3d628aa863209b

SHA1
682577d1a8aefb281547468324d9f2429f0fa867

SHA256
f0a3bf62d4a3dba484916f41968dd88b8f8d7ed2b6f69638b33ce4e171015f3f

SHA512
0dd8bf332a5b92a07a1d7684fd14832fd3aecd03ad5705f9f0804f29d9c6a39521ff1889b6641632b8f4a5ef7f6e53cd165386f86a20b89f39ff3de39dd79255

Download Submit
C:\Windows\SysWOW64\Kjhcjq32.exe

Filesize
56KB

MD5
8ba80b6eb305e0d9d28226ac38931193

SHA1
75b54d9c5ba76c3d4644c30fffa402e718be7560

SHA256
f639a918f8b7f02413dfbbe17b00f3ca41f6cf6b95d231dc9be75ab5bdff3ee6

SHA512
f7809f16fc952bb4f5da66d74474c0eefadd7782ae1e27dabc6284d634f9773b683c39884cb2fc3f832031e39f7812a82542d2beeb32860356a8d62bf242d7ad

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
56KB

MD5
e8bbdfa48f0223cd72396210a55e3842

SHA1
e4e306664e589b5ae17ce199a4558272540a6e20

SHA256
c71abf2a2315c039a404b5f0a417cfa4c248f6c61f110a182e05d047b8629789

SHA512
de1aa3b241dea5ac9866d549812f411ab8f0b9ac0579fd161d02aa0d216dac87b52bb388a6b70fe9f416781d3be19376c86fbbb8eadad54e7281159aaaf99e46

Download Submit
C:\Windows\SysWOW64\Lfodbqfa.exe

Filesize
56KB

MD5
78a680d06f5855af836b19d357a04c7d

SHA1
04f14dc7c5118b90ca1800ca3fb279fc84f4549d

SHA256
d1fb081350da3921fbec4287a853113fbec72d5428e4e38aec9a8d6f43b2ad90

SHA512
ece78c3e3a53e23951cc99b98af1b0718271cfb036268e3d30a7dcdf506f9d285e4044dedcd9762fd829bd8b2c0ec167ba4563894b4c2351f9a17fbfcbc007e0

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
56KB

MD5
5bf9df1bb9df337cafd1dba0da6e8315

SHA1
d2776dfcaa1656821ea3de148ca85876c6dc0618

SHA256
2e98453fa8e72a12f4304e0c66abe2cafa4844eb7b12b5a9f3421233991bc8c3

SHA512
e03a69424cc8e58c678df76e9a6c1ffeee93501b2d41444ddac54222056f50df914d12df39d0a34c11bb5c1b699e49782214e09db0affdd862de82a4e65df58b

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
56KB

MD5
6a5556345fbae81cd23f92bae29c766e

SHA1
a42e344fc30608feb1a7f30fdcdebe8b52d148ed

SHA256
a14aa4d44ec525d9b84761a3b2e682279083b0e20ad7cfe9067e56959e9e0fd4

SHA512
5cce79851b825444c1e4e49cc9a2f0a2736a3581f90d52eb1dc8178fb06ccad745c1b36bb919425511479fc4524776ded9e310c2d5862c4c7abb012c04290911

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
56KB

MD5
f1b1b1e4d407f44432a7991bfaefad23

SHA1
6522bcb3170e77a4ec4f109c0c162f2b12d36f60

SHA256
0baf3f25283a93b610bad2874ad982e57fb65b50c9f87f1f933314b120dea023

SHA512
a1cbac07678ba03dcd767811ea519833d447934cccff579ff45d40020a020106feb3281f8e2f1753944cd177e435565615e6906b0b25ba541081258108a6d2d1

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
56KB

MD5
e6b42ecb9b28bb2561c00025a8838b22

SHA1
99f2e626658eb298dd00a9fbd7dd415f81db8a3f

SHA256
9140bf4e3e9932c266b1f29c054f060ae611d2cee8efe0f1debe773c85cd95c0

SHA512
62564b64ee9aa05902ffe496e623e872856f83b4e54219cd05ebf182cfb338c60d9366c8910ad6112348d0cc7cf5a021326a1f2a5ba340df6ab7ff2400d25022

Download Submit
C:\Windows\SysWOW64\Ohkkhhmh.exe

Filesize
56KB

MD5
790e87ff70ac2e1a98d8e748491cce24

SHA1
181a36dd5e14a4b86c55bf37916a2d1be48ea394

SHA256
89d1d2ffce92f9beb12dc53ab11968e761ff2f67d9147f3f8abfef5e080a9db3

SHA512
9b5e8bfcdedbe6706dfab945f0a2564029c9d3ff95aa622d559a5deb1d9384887e446d0ba91b3550b643d391ab72cf4ada3fae5c565c64d79c50a0d618b59130

Download Submit
C:\Windows\SysWOW64\Ojdnid32.exe

Filesize
56KB

MD5
5e227809922de6604e2cfcc3dd423e64

SHA1
10cb4bedcfbe7467694b6857f30bfc946a4405ab

SHA256
c3b24bf00ba252e3e3ec60b0882517abcbf09f3b6463ddf66c0ffb4df2f2dee2

SHA512
3d0d09ddf7c3f97a2c60c21e0d6532193bd1984cbd3a475a9689516957396faf5a79d0a2e446e4c39ec94d6f98c7ee8d1c7aa463bbcf6ae8408936d69f1307b3

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
56KB

MD5
8fdb6859720326aa3d44f808e68b2a5d

SHA1
a3b3d237ed99ad51ba071463a184bf720dcbe9b6

SHA256
ac034cf35f69b3d6428c3d84b589aa91352c5402abdeeed81b7797e79ceb3d47

SHA512
9f62ae54f426e46b42ef6f80c4be345f69380005488fc7f35856f4bc07d968822549a8965a70eff83ff65fdde30655fe3650a5691cdc1dd9cc30af5c371d9946

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
56KB

MD5
8fdb6859720326aa3d44f808e68b2a5d

SHA1
a3b3d237ed99ad51ba071463a184bf720dcbe9b6

SHA256
ac034cf35f69b3d6428c3d84b589aa91352c5402abdeeed81b7797e79ceb3d47

SHA512
9f62ae54f426e46b42ef6f80c4be345f69380005488fc7f35856f4bc07d968822549a8965a70eff83ff65fdde30655fe3650a5691cdc1dd9cc30af5c371d9946

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
56KB

MD5
da154dc4c197ba5ba4f8fb302d03bfd2

SHA1
bedfae997f7a366c11649c9c64dc0f587d154caf

SHA256
4b3735e1136df5ffa975e8841decb33f5e5aa3fda53bcc77de774a8a44d9329c

SHA512
8c9af59da40fa536dc216f2c67ef54d9598f786d4d3f7a8e159fa94185c7571136ad337bada10e22840018de961a45558abc71bd052b90aaf37d7723b5fc8f7f

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
56KB

MD5
da154dc4c197ba5ba4f8fb302d03bfd2

SHA1
bedfae997f7a366c11649c9c64dc0f587d154caf

SHA256
4b3735e1136df5ffa975e8841decb33f5e5aa3fda53bcc77de774a8a44d9329c

SHA512
8c9af59da40fa536dc216f2c67ef54d9598f786d4d3f7a8e159fa94185c7571136ad337bada10e22840018de961a45558abc71bd052b90aaf37d7723b5fc8f7f

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
56KB

MD5
fb1c144fa3729d41b4f43be4eaf2514b

SHA1
bf98ba64d438c13964443d56a55487b511e48c4e

SHA256
456a6a376f5666b5fcfcebc5ebe22abe22400d90ae1029933da991ba67bb6b3e

SHA512
acf547114615b9a6d52d74b8a899df54dcd7b81b049bb5d47c67386885da53ac0f9dabfbd421630ad1dd3c89348912575bbc13deac2323bf4f824a863b1af07f

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
56KB

MD5
fb1c144fa3729d41b4f43be4eaf2514b

SHA1
bf98ba64d438c13964443d56a55487b511e48c4e

SHA256
456a6a376f5666b5fcfcebc5ebe22abe22400d90ae1029933da991ba67bb6b3e

SHA512
acf547114615b9a6d52d74b8a899df54dcd7b81b049bb5d47c67386885da53ac0f9dabfbd421630ad1dd3c89348912575bbc13deac2323bf4f824a863b1af07f

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
56KB

MD5
a9dbd5bcc75ea31e3057866a8ef41b06

SHA1
9abe650f2e2fdeb4ed160db229d25a8bf660fdeb

SHA256
03d6e41eb8de2278a7390fa04a480a7ee17ed877ee62cd1a5de6cf191d1f9321

SHA512
a53180c8fbaafef5d337e8459dfaebb341d2d17a9a879fee5e83f601d19876c0ecdd88f1c6c6d64046a0094521841c48f1ae86c04baf08cb003c10d15f9a7799

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
56KB

MD5
a9dbd5bcc75ea31e3057866a8ef41b06

SHA1
9abe650f2e2fdeb4ed160db229d25a8bf660fdeb

SHA256
03d6e41eb8de2278a7390fa04a480a7ee17ed877ee62cd1a5de6cf191d1f9321

SHA512
a53180c8fbaafef5d337e8459dfaebb341d2d17a9a879fee5e83f601d19876c0ecdd88f1c6c6d64046a0094521841c48f1ae86c04baf08cb003c10d15f9a7799

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
56KB

MD5
cb51b0fc9b67f4e4e8fa5bf634468463

SHA1
5e1323239d7c7b109027b48bee8fdb40c274181e

SHA256
24d468890fdf4d4db724559c15a3438cdde286ba3bfc4160f04ccaaa1d95fe76

SHA512
9ca97eca2c1719e53d3ce21a2891e737d25fc6c310549a0e04bda55338efe49939e6896aa6fc07ec2b39483f9ffab32ca1725b406166280f798b3becceb7a747

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
56KB

MD5
cb51b0fc9b67f4e4e8fa5bf634468463

SHA1
5e1323239d7c7b109027b48bee8fdb40c274181e

SHA256
24d468890fdf4d4db724559c15a3438cdde286ba3bfc4160f04ccaaa1d95fe76

SHA512
9ca97eca2c1719e53d3ce21a2891e737d25fc6c310549a0e04bda55338efe49939e6896aa6fc07ec2b39483f9ffab32ca1725b406166280f798b3becceb7a747

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
56KB

MD5
0b2be477012d6236bea4466f818c176e

SHA1
31b4bdf61814eaaf6b00328f849255b0f750b5e2

SHA256
5672aaeddbfd94e81949056fabdbf378090237b41c4f5d462f03d8754d5d1ea9

SHA512
2b74ad031f15003a4a86fcf4ea37282d9549d68d52d4111514e38ed9f91d7dc1e08cc32bf4f07fb654b99c346f5126c80c46a7b153540e0e8d9b562c36ed4f07

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
56KB

MD5
0b2be477012d6236bea4466f818c176e

SHA1
31b4bdf61814eaaf6b00328f849255b0f750b5e2

SHA256
5672aaeddbfd94e81949056fabdbf378090237b41c4f5d462f03d8754d5d1ea9

SHA512
2b74ad031f15003a4a86fcf4ea37282d9549d68d52d4111514e38ed9f91d7dc1e08cc32bf4f07fb654b99c346f5126c80c46a7b153540e0e8d9b562c36ed4f07

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
56KB

MD5
da5863ff2d0155e29ce9189c84b31e35

SHA1
237f1498241fa20f871f9641a4425d5d5a88d02f

SHA256
7477690ae05168c95a61943afaf2d2413d5a17666a0a0505b6b64ba2c6e97314

SHA512
03283439d091004f2c7b931c27736dcd0862662852fda472a108df9436a57633461ef01afcae199f7d0495c8b51ffad851e0ab9976c3a0ef5b3cb8f70065113a

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
56KB

MD5
da5863ff2d0155e29ce9189c84b31e35

SHA1
237f1498241fa20f871f9641a4425d5d5a88d02f

SHA256
7477690ae05168c95a61943afaf2d2413d5a17666a0a0505b6b64ba2c6e97314

SHA512
03283439d091004f2c7b931c27736dcd0862662852fda472a108df9436a57633461ef01afcae199f7d0495c8b51ffad851e0ab9976c3a0ef5b3cb8f70065113a

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
56KB

MD5
8644b07bccb89da965aee4bba094740e

SHA1
56e922e1ecfb83a555b1978bc16e11f50acc624e

SHA256
02964b5153dccb2e85ab38ef21ff46be36a6cae61e46fa385c7846003e9b3946

SHA512
b7387c054ef11e57d467c53276e08aff2a82bd2c75244c9d4cf629b4cf0ea14e6d49895db1cd3edd2dc478ed81508eded6ad54e6d4ca543fec64cfd4cfb19009

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
56KB

MD5
8644b07bccb89da965aee4bba094740e

SHA1
56e922e1ecfb83a555b1978bc16e11f50acc624e

SHA256
02964b5153dccb2e85ab38ef21ff46be36a6cae61e46fa385c7846003e9b3946

SHA512
b7387c054ef11e57d467c53276e08aff2a82bd2c75244c9d4cf629b4cf0ea14e6d49895db1cd3edd2dc478ed81508eded6ad54e6d4ca543fec64cfd4cfb19009

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
56KB

MD5
20d2c7d0882bcfad0bc90e27c68b9e6e

SHA1
98c3f6d1966a9368628163c536a03b481f990575

SHA256
847095795bc906cbc1dba959295e98cd6fc48742373bc2c8e735b41bb34bb226

SHA512
9ad34abae7a58124d8984a8b10f7bdad37d3c28e9a89ccc8aa53331f5802ad5ac4f02cf3f1856e96cbce51e9cfa08dfe6c4f03569ff3f7eaf9393281ff67bc4a

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
56KB

MD5
20d2c7d0882bcfad0bc90e27c68b9e6e

SHA1
98c3f6d1966a9368628163c536a03b481f990575

SHA256
847095795bc906cbc1dba959295e98cd6fc48742373bc2c8e735b41bb34bb226

SHA512
9ad34abae7a58124d8984a8b10f7bdad37d3c28e9a89ccc8aa53331f5802ad5ac4f02cf3f1856e96cbce51e9cfa08dfe6c4f03569ff3f7eaf9393281ff67bc4a

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
56KB

MD5
89562e885150f3b9c89807b6877d8c94

SHA1
ecd70fc2efc3b6076317cf0ce5cf9584db75c82d

SHA256
525c428c702c727dbb08f63508e26cb2546d0e0b327bf0d367718690c9bf1f7c

SHA512
25fe9392187f3e9d2f121e26559fc09f5718ef31a1535ed6cbab1a4d324c42107324a51243fe191648cea8a744d2c65a167ef041b9cc4614d2c74be8b69f0f82

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
56KB

MD5
89562e885150f3b9c89807b6877d8c94

SHA1
ecd70fc2efc3b6076317cf0ce5cf9584db75c82d

SHA256
525c428c702c727dbb08f63508e26cb2546d0e0b327bf0d367718690c9bf1f7c

SHA512
25fe9392187f3e9d2f121e26559fc09f5718ef31a1535ed6cbab1a4d324c42107324a51243fe191648cea8a744d2c65a167ef041b9cc4614d2c74be8b69f0f82

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
56KB

MD5
6634e62371b216a241f6edb271921744

SHA1
09fac9c95a28cebc1bea0074552cdfc1152b47fb

SHA256
bde41a74e2338a7ed56d05daf65fa91de1414874ac22fc178779c57386066800

SHA512
d330bcf5abb0f8e7cded662ffc076b1a6c3a37464ecf8d369bc80ab3e51b8e6da330df71b0fca32428cc3bd1a64e8cf368edf73d866cb7cd0289c7dbb2d5c3c9

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
56KB

MD5
6634e62371b216a241f6edb271921744

SHA1
09fac9c95a28cebc1bea0074552cdfc1152b47fb

SHA256
bde41a74e2338a7ed56d05daf65fa91de1414874ac22fc178779c57386066800

SHA512
d330bcf5abb0f8e7cded662ffc076b1a6c3a37464ecf8d369bc80ab3e51b8e6da330df71b0fca32428cc3bd1a64e8cf368edf73d866cb7cd0289c7dbb2d5c3c9

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
56KB

MD5
dc8f00c616f307efd732ceef3513c123

SHA1
f2ada887a5ea048324c9ff3be1db633b8dde44da

SHA256
05bec4875a0d6fcf4c2c2595f79a5cea7b085276d80f5e7690728c529b4e5e81

SHA512
12cbd6b2ffb23ecfd74457421936072cfa68a17354461eb7fe16edcc8a4d3f5152563a7a14890bfcae5254f0f7a0bb42ccc5ed7eba3022b9c768624f554b705a

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
56KB

MD5
dc8f00c616f307efd732ceef3513c123

SHA1
f2ada887a5ea048324c9ff3be1db633b8dde44da

SHA256
05bec4875a0d6fcf4c2c2595f79a5cea7b085276d80f5e7690728c529b4e5e81

SHA512
12cbd6b2ffb23ecfd74457421936072cfa68a17354461eb7fe16edcc8a4d3f5152563a7a14890bfcae5254f0f7a0bb42ccc5ed7eba3022b9c768624f554b705a

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
56KB

MD5
66256356b8fe132e7118259c00d725fb

SHA1
3aaa4b40196e0e208c178d5dd5ebab2eea7fec8c

SHA256
126101a168b9a71a0b21ced7754f3f913f77db1481ee60e2aadca193d2bade05

SHA512
6032e0161ea92e0ad9a1d255cf652ecfae6741b352981502809a9bbbae7a0aace9d447318dbacb8e468253f3a0b0ef9a361b81227607bf13de6d1d3e30a0ca11

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
56KB

MD5
66256356b8fe132e7118259c00d725fb

SHA1
3aaa4b40196e0e208c178d5dd5ebab2eea7fec8c

SHA256
126101a168b9a71a0b21ced7754f3f913f77db1481ee60e2aadca193d2bade05

SHA512
6032e0161ea92e0ad9a1d255cf652ecfae6741b352981502809a9bbbae7a0aace9d447318dbacb8e468253f3a0b0ef9a361b81227607bf13de6d1d3e30a0ca11

Download Submit
memory/224-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/544-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/556-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/948-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1012-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1040-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1148-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1796-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2360-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2396-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2976-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2984-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3244-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3328-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3340-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3588-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3728-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3812-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4168-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4780-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads