c3f75d9a1b097d78354a09b704c7f1d6e1d16a6f74fa5bd5d0f51d1a78ae9883

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe
Size

80KB
MD5

3d584ade5d9e8c0dbe0984bddaa72e70
SHA1

ebb2f2916899a11103059d8f3340b08db82911db
SHA256

c3f75d9a1b097d78354a09b704c7f1d6e1d16a6f74fa5bd5d0f51d1a78ae9883
SHA512

aecd407473e5a10af335b9b700b3f7295db83edee63d23466a3813f45de49bd5228f2848aaf466d2398ba822ef1df00cc1f6a827e9a442910e6e0557a56016de
SSDEEP

1536:+E6Qi4jiQhb7Kf65i/iLX/Z2LUJ9VqDlzVxyh+CbxMa:eG2QhAei/iLaUJ9IDlRxyhTb7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qclmck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjnkcekm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjadje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebnfbcbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhanngbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjelc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgjjdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhdlao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmnln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebommi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gphphj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlmgopjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnhghcki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdnid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poaqemao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgjjdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqjbddpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhldbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plhnda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aodogdmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nclikl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcigeooj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jodjhkkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebommi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blielbfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloidijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afgacokc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcqjon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jklphekp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmlkhofd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjokd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkglja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoabad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hffcmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpomcp32.exe

Executes dropped EXE 64 IoCs

pid	Process
372	Bnbmefbg.exe
2064	Cmgjgcgo.exe
2296	Cfpnph32.exe
1140	Cmiflbel.exe
4876	Cjmgfgdf.exe
3484	Ceckcp32.exe
1440	Cfdhkhjj.exe
1396	Cdhhdlid.exe
4892	Cnnlaehj.exe
3104	Djdmffnn.exe
2784	Ddmaok32.exe
4628	Dfknkg32.exe
4484	Ddonekbl.exe
4104	Dkifae32.exe
4468	Deokon32.exe
1380	Dfpgffpm.exe
5096	Deagdn32.exe
1040	Dgbdlf32.exe
2340	Dahhio32.exe
2624	Egdqae32.exe
4700	Emoinpcd.exe
2836	Ekbihd32.exe
4264	Eehnem32.exe
436	Egijmegb.exe
1368	Eejjjl32.exe
3536	Eobocb32.exe
2648	Egnchd32.exe
1908	Fhmpagkp.exe
3700	Foghnabl.exe
1448	Fddqghpd.exe
2232	Fnmepn32.exe
2260	Fedmqk32.exe
1492	Folaiqng.exe
1540	Fnaokmco.exe
264	Fdkggg32.exe
4940	Foqkdp32.exe
3120	Gkglja32.exe
1940	Goedpofl.exe
4432	Ggqida32.exe
408	Gohaeo32.exe
4144	Ggcfja32.exe
2308	Gfdfgiid.exe
3432	Ggeboaob.exe
4836	Goljqnpd.exe
3596	Hffcmh32.exe
4476	Hghoeqmp.exe
1372	Hfipbh32.exe
4392	Hkehkocf.exe
4284	Hfklhhcl.exe
2216	Hhihdcbp.exe
448	Hdpiid32.exe
396	Hkjafn32.exe
4508	Hfpecg32.exe
1828	Hkmnln32.exe
2604	Ihqoeb32.exe
864	Iokgal32.exe
3712	Ibicnh32.exe
1060	Igfkfo32.exe
2448	Inpccihl.exe
4492	Idjlpc32.exe
1796	Ikcdlmgf.exe
3556	Ieliebnf.exe
2236	Ioambknl.exe
2992	Ifleoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qhkjegqi.dll	Pedlgbkh.exe
File opened for modification	C:\Windows\SysWOW64\Lqikmc32.exe	Kdbjhbbd.exe
File opened for modification	C:\Windows\SysWOW64\Binhnomg.exe	Bfolacnc.exe
File opened for modification	C:\Windows\SysWOW64\Foghnabl.exe	Fhmpagkp.exe
File created	C:\Windows\SysWOW64\Pcjifm32.dll	Jpkphjeb.exe
File created	C:\Windows\SysWOW64\Kflnfcgg.exe	Kelalp32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfheo32.exe	Jjopcb32.exe
File created	C:\Windows\SysWOW64\Pkogiikb.exe	Oafcqcea.exe
File created	C:\Windows\SysWOW64\Fbjena32.exe	Fbpchb32.exe
File created	C:\Windows\SysWOW64\Ojqcnhkl.exe	Ocgkan32.exe
File opened for modification	C:\Windows\SysWOW64\Fnjocf32.exe	Fklcgk32.exe
File opened for modification	C:\Windows\SysWOW64\Folaiqng.exe	Fedmqk32.exe
File created	C:\Windows\SysWOW64\Memicmfo.dll	Bggnof32.exe
File opened for modification	C:\Windows\SysWOW64\Kkcfid32.exe	Jnpfop32.exe
File created	C:\Windows\SysWOW64\Kbpkkn32.exe	Kjhcjq32.exe
File opened for modification	C:\Windows\SysWOW64\Dckdjomg.exe	Dkdliame.exe
File opened for modification	C:\Windows\SysWOW64\Jbileede.exe	Jpkphjeb.exe
File created	C:\Windows\SysWOW64\Ohnefj32.dll	Mbjnbqhp.exe
File opened for modification	C:\Windows\SysWOW64\Jgenbfoa.exe	Jnmijq32.exe
File created	C:\Windows\SysWOW64\Mlofpg32.dll	Jgnqgqan.exe
File created	C:\Windows\SysWOW64\Dagdgfkf.dll	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Okogahgo.dll	Aokcklid.exe
File created	C:\Windows\SysWOW64\Plejdkmm.exe	Pekbga32.exe
File opened for modification	C:\Windows\SysWOW64\Bcahmb32.exe	Blhpqhlh.exe
File opened for modification	C:\Windows\SysWOW64\Odhifjkg.exe	Njpdnedf.exe
File opened for modification	C:\Windows\SysWOW64\Lppbkgcj.exe	Lifjnm32.exe
File opened for modification	C:\Windows\SysWOW64\Ojdnid32.exe	Omqmop32.exe
File opened for modification	C:\Windows\SysWOW64\Chlflabp.exe	Ckeimm32.exe
File created	C:\Windows\SysWOW64\Ohofdmkm.dll	Ebnfbcbc.exe
File created	C:\Windows\SysWOW64\Jaonbc32.exe	Joqafgni.exe
File opened for modification	C:\Windows\SysWOW64\Apnndj32.exe	Ajaelc32.exe
File opened for modification	C:\Windows\SysWOW64\Flinkojm.exe	Ffmfchle.exe
File created	C:\Windows\SysWOW64\Oeokal32.exe	Ojigdcll.exe
File created	C:\Windows\SysWOW64\Mfbhmo32.dll	Bdpaeehj.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cponen32.exe
File opened for modification	C:\Windows\SysWOW64\Ppgomnai.exe	Pmhbqbae.exe
File created	C:\Windows\SysWOW64\Kodapf32.dll	Lqikmc32.exe
File opened for modification	C:\Windows\SysWOW64\Cdimqm32.exe	Cpmapodj.exe
File opened for modification	C:\Windows\SysWOW64\Jeapcq32.exe	Johggfha.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Qjlnnemp.exe	Pofjpl32.exe
File created	C:\Windows\SysWOW64\Fpjjac32.exe	Fmlneg32.exe
File opened for modification	C:\Windows\SysWOW64\Fbcfhibj.exe	Fdqfll32.exe
File created	C:\Windows\SysWOW64\Lhenai32.exe	Legben32.exe
File created	C:\Windows\SysWOW64\Pblkiipl.dll	Fedmqk32.exe
File created	C:\Windows\SysWOW64\Foqkdp32.exe	Fdkggg32.exe
File created	C:\Windows\SysWOW64\Poodpmca.exe	Plagcbdn.exe
File created	C:\Windows\SysWOW64\Jendmajn.dll	Qcclld32.exe
File opened for modification	C:\Windows\SysWOW64\Phigif32.exe	Pejkmk32.exe
File opened for modification	C:\Windows\SysWOW64\Iajdgcab.exe	Iolhkh32.exe
File created	C:\Windows\SysWOW64\Gaplji32.dll	Mjbogmdb.exe
File created	C:\Windows\SysWOW64\Cjecpkcg.exe	Bbnkonbd.exe
File created	C:\Windows\SysWOW64\Jhnhbn32.dll	Dlkbjqgm.exe
File opened for modification	C:\Windows\SysWOW64\Bochmn32.exe	Ahippdbe.exe
File created	C:\Windows\SysWOW64\Caojpaij.exe	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Ginnfgop.exe	Ghmbno32.exe
File created	C:\Windows\SysWOW64\Nhfjcpfb.dll	Fbpchb32.exe
File created	C:\Windows\SysWOW64\Bfmolc32.exe	Bdocph32.exe
File created	C:\Windows\SysWOW64\Kjmmepfj.exe	Kkjlic32.exe
File created	C:\Windows\SysWOW64\Lldopb32.exe	Lieccf32.exe
File created	C:\Windows\SysWOW64\Jihaej32.dll	Mmpdhboj.exe
File created	C:\Windows\SysWOW64\Pmcclm32.exe	Phfjcf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9172	6324	WerFault.exe	906

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccchof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmhidbhg.dll"	Akcjkfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faikapbo.dll"	Aanbhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbjeaofg.dll"	Bqilgmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jidinqpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnmepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdejk32.dll"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibcjqgnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blghiiea.dll"	Edihdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdfjld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhniccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pekbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnnlhc32.dll"	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iokgal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhbfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lilqdd32.dll"	Ophjiaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbepme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adjjeieh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcdbfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdokdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcphdpff.dll"	Icfekc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nheble32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfoqnae.dll"	Lndagg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Copdgb32.dll"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdieb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqiieebk.dll"	Kfcdfbqo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amodep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdmmbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgenbfoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kioodcbn.dll"	Phigif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amjillkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ledepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdkggg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgpjggdi.dll"	Foqkdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noiilpik.dll"	Bppfmigl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqnmlj32.dll"	Ijogmdqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecbeip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdijbplg.dll"	Hkjafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afelhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lijlof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dckdjomg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Empoiimf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkdhjknm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodfed32.dll"	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknbglob.dll"	Fhmpagkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Goedpofl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbglnn32.dll"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifaciolc.dll"	Enigke32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1684	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 372	2096	NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe	88
PID 2096 wrote to memory of 372	2096	NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe	88
PID 2096 wrote to memory of 372	2096	NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe	88
PID 372 wrote to memory of 2064	372	Bnbmefbg.exe	89
PID 372 wrote to memory of 2064	372	Bnbmefbg.exe	89
PID 372 wrote to memory of 2064	372	Bnbmefbg.exe	89
PID 2064 wrote to memory of 2296	2064	Cmgjgcgo.exe	90
PID 2064 wrote to memory of 2296	2064	Cmgjgcgo.exe	90
PID 2064 wrote to memory of 2296	2064	Cmgjgcgo.exe	90
PID 2296 wrote to memory of 1140	2296	Cfpnph32.exe	91
PID 2296 wrote to memory of 1140	2296	Cfpnph32.exe	91
PID 2296 wrote to memory of 1140	2296	Cfpnph32.exe	91
PID 1140 wrote to memory of 4876	1140	Cmiflbel.exe	92
PID 1140 wrote to memory of 4876	1140	Cmiflbel.exe	92
PID 1140 wrote to memory of 4876	1140	Cmiflbel.exe	92
PID 4876 wrote to memory of 3484	4876	Cjmgfgdf.exe	93
PID 4876 wrote to memory of 3484	4876	Cjmgfgdf.exe	93
PID 4876 wrote to memory of 3484	4876	Cjmgfgdf.exe	93
PID 3484 wrote to memory of 1440	3484	Ceckcp32.exe	94
PID 3484 wrote to memory of 1440	3484	Ceckcp32.exe	94
PID 3484 wrote to memory of 1440	3484	Ceckcp32.exe	94
PID 1440 wrote to memory of 1396	1440	Cfdhkhjj.exe	95
PID 1440 wrote to memory of 1396	1440	Cfdhkhjj.exe	95
PID 1440 wrote to memory of 1396	1440	Cfdhkhjj.exe	95
PID 1396 wrote to memory of 4892	1396	Cdhhdlid.exe	96
PID 1396 wrote to memory of 4892	1396	Cdhhdlid.exe	96
PID 1396 wrote to memory of 4892	1396	Cdhhdlid.exe	96
PID 4892 wrote to memory of 3104	4892	Cnnlaehj.exe	97
PID 4892 wrote to memory of 3104	4892	Cnnlaehj.exe	97
PID 4892 wrote to memory of 3104	4892	Cnnlaehj.exe	97
PID 3104 wrote to memory of 2784	3104	Djdmffnn.exe	98
PID 3104 wrote to memory of 2784	3104	Djdmffnn.exe	98
PID 3104 wrote to memory of 2784	3104	Djdmffnn.exe	98
PID 2784 wrote to memory of 4628	2784	Ddmaok32.exe	99
PID 2784 wrote to memory of 4628	2784	Ddmaok32.exe	99
PID 2784 wrote to memory of 4628	2784	Ddmaok32.exe	99
PID 4628 wrote to memory of 4484	4628	Dfknkg32.exe	100
PID 4628 wrote to memory of 4484	4628	Dfknkg32.exe	100
PID 4628 wrote to memory of 4484	4628	Dfknkg32.exe	100
PID 4484 wrote to memory of 4104	4484	Ddonekbl.exe	104
PID 4484 wrote to memory of 4104	4484	Ddonekbl.exe	104
PID 4484 wrote to memory of 4104	4484	Ddonekbl.exe	104
PID 4104 wrote to memory of 4468	4104	Dkifae32.exe	101
PID 4104 wrote to memory of 4468	4104	Dkifae32.exe	101
PID 4104 wrote to memory of 4468	4104	Dkifae32.exe	101
PID 4468 wrote to memory of 1380	4468	Deokon32.exe	102
PID 4468 wrote to memory of 1380	4468	Deokon32.exe	102
PID 4468 wrote to memory of 1380	4468	Deokon32.exe	102
PID 1380 wrote to memory of 5096	1380	Dfpgffpm.exe	103
PID 1380 wrote to memory of 5096	1380	Dfpgffpm.exe	103
PID 1380 wrote to memory of 5096	1380	Dfpgffpm.exe	103
PID 5096 wrote to memory of 1040	5096	Deagdn32.exe	105
PID 5096 wrote to memory of 1040	5096	Deagdn32.exe	105
PID 5096 wrote to memory of 1040	5096	Deagdn32.exe	105
PID 1040 wrote to memory of 2340	1040	Dgbdlf32.exe	106
PID 1040 wrote to memory of 2340	1040	Dgbdlf32.exe	106
PID 1040 wrote to memory of 2340	1040	Dgbdlf32.exe	106
PID 2340 wrote to memory of 2624	2340	Dahhio32.exe	107
PID 2340 wrote to memory of 2624	2340	Dahhio32.exe	107
PID 2340 wrote to memory of 2624	2340	Dahhio32.exe	107
PID 2624 wrote to memory of 4700	2624	Egdqae32.exe	108
PID 2624 wrote to memory of 4700	2624	Egdqae32.exe	108
PID 2624 wrote to memory of 4700	2624	Egdqae32.exe	108
PID 4700 wrote to memory of 2836	4700	Emoinpcd.exe	110

C:\Users\Admin\AppData\Local\Temp\NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3d584ade5d9e8c0dbe0984bddaa72e70_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\Bnbmefbg.exe
  C:\Windows\system32\Bnbmefbg.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\Cmgjgcgo.exe
    C:\Windows\system32\Cmgjgcgo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\Cfpnph32.exe
      C:\Windows\system32\Cfpnph32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4104

C:\Windows\SysWOW64\Deokon32.exe
C:\Windows\system32\Deokon32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\Dfpgffpm.exe
  C:\Windows\system32\Dfpgffpm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\Deagdn32.exe
    C:\Windows\system32\Deagdn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\Dgbdlf32.exe
      C:\Windows\system32\Dgbdlf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
      - C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        8⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        9⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        10⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        11⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        12⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        13⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        15⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        16⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        19⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        20⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:264
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        26⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        27⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        28⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        29⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        30⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        32⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        33⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        34⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        35⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        36⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        37⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        39⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        41⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:864
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        43⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        44⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        45⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        46⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        47⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        48⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        49⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        50⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        51⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2512
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        53⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        54⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        55⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        56⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        57⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        58⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        59⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        60⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        61⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        62⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        63⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        64⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        65⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        66⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        67⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        68⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        69⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        70⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        71⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        72⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        73⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        75⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        76⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        78⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        79⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        80⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        81⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        82⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        83⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        84⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        85⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        86⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        87⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        88⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        89⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        90⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        91⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        92⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        93⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        94⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        95⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        96⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        97⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        98⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        99⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        100⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        101⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        102⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        103⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        104⤵
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        105⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        106⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        107⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        108⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        109⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        110⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        111⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        112⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        113⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        114⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        115⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        116⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        117⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        118⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        119⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        120⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        121⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        122⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        123⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        124⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        125⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        126⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        127⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        128⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        129⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        130⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        132⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        133⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        134⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        135⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2832
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        137⤵
        Drops file in System32 directory
        
        PID:6220
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        138⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        139⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        140⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        141⤵
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        144⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        145⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        146⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        147⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        148⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        149⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        150⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        151⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        152⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        153⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        154⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        155⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        156⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        157⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        158⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        159⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        160⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        161⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        162⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        163⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        164⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        165⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        166⤵
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        168⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        169⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        171⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        172⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        173⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        174⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        175⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        176⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        177⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        178⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        179⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        180⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        181⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        182⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        183⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        184⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        185⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        186⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        187⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        188⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        189⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        190⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        191⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        192⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        193⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        194⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        195⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        196⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        197⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        198⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        199⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        201⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        202⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        203⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        204⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        205⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        206⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        207⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        208⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        209⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        210⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        211⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        212⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        213⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        214⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        215⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        216⤵
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        217⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        218⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        219⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        220⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        221⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        223⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        224⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        225⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        226⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        227⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        228⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        230⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        232⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        233⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        234⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        235⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        236⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        237⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        238⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        239⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        240⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        241⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        242⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        243⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        244⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        245⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        246⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        247⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        248⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        249⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        250⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        251⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        252⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        253⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        255⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        256⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        257⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        258⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        259⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        260⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        261⤵
        Drops file in System32 directory
        
        PID:8336
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        262⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        263⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        264⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        266⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        267⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        268⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        270⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        271⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        272⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        273⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        274⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        275⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        276⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        277⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        278⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        279⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        280⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        281⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        282⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        283⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        284⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        285⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        286⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        287⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        288⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        289⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        290⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        291⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        292⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        293⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        294⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        295⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        296⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        297⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        298⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        299⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        300⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        301⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        302⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        303⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        304⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        305⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        306⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        307⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        308⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9828
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        310⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        311⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        312⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        313⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        314⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        315⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        316⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        317⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        318⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        319⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        320⤵
        Drops file in System32 directory
        
        PID:9236
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        321⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        322⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        323⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        324⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        325⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        326⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        327⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        329⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        330⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        331⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        332⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        333⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        334⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        335⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        336⤵
        Drops file in System32 directory
        
        PID:3876
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        337⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        338⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2908
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        340⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        341⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        342⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        343⤵
        Modifies registry class
        
        PID:9500
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        344⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        345⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        347⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        348⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10164
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        350⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        352⤵
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        353⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        354⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        355⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        356⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        357⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        358⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        359⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        360⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        361⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        362⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        363⤵
        Drops file in System32 directory
        
        PID:9880
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        364⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        365⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        366⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4304
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        368⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        369⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        370⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        371⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        372⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        373⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10284
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        375⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10380
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        377⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        378⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        379⤵
        Drops file in System32 directory
        
        PID:10508
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        380⤵
        Modifies registry class
        
        PID:10552
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        381⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        382⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10680
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        384⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        386⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        387⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        388⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        389⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        390⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        391⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        392⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11120
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        394⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        395⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        396⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        397⤵
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        398⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        400⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        401⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        402⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        403⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10716
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        405⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        406⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        407⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        408⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11104
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        410⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        411⤵
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        412⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        413⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        414⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        415⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        416⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10880
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        418⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        419⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        420⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        421⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10592
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        423⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        424⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        425⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        426⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        427⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        428⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        429⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        430⤵
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        431⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        432⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        433⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        434⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        435⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        436⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        437⤵
        Modifies registry class
        
        PID:11408
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        438⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        439⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        440⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        441⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        442⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        443⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        444⤵
        Modifies registry class
        
        PID:11700
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        445⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11780
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        447⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        448⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        449⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        450⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        451⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        452⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        453⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        454⤵
        Drops file in System32 directory
        
        PID:12120
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        455⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        456⤵
        Modifies registry class
        
        PID:12204
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        457⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        458⤵
        Modifies registry class
        
        PID:12284
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        459⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        460⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        461⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        462⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        463⤵
        Drops file in System32 directory
        
        PID:11564
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11648
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        465⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        466⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        467⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        468⤵
        Modifies registry class
        
        PID:11932
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12000
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        470⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        471⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        472⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        473⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        474⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        475⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        476⤵
        Drops file in System32 directory
        
        PID:11560
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        477⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11772
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        479⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        480⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12096
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        482⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        483⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        484⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        485⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11848
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        487⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        488⤵
        Drops file in System32 directory
        
        PID:12232
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        489⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        490⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        491⤵
        Drops file in System32 directory
        
        PID:12024
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10916
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        493⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        494⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        495⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        496⤵
        Drops file in System32 directory
        
        PID:11444
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        497⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        498⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        499⤵
        Modifies registry class
        
        PID:12340
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12376
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        501⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        502⤵
        Modifies registry class
        
        PID:12448
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        503⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        504⤵
        Drops file in System32 directory
        
        PID:12520
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        505⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        506⤵
        Drops file in System32 directory
        
        PID:12616
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        507⤵
        Modifies registry class
        
        PID:12672
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        508⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        509⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        510⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        511⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        512⤵
        Modifies registry class
        
        PID:12872
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        513⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        514⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        515⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        516⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        517⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        518⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        519⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        520⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        521⤵
        Drops file in System32 directory
        
        PID:13232
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        522⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        523⤵
        Drops file in System32 directory
        
        PID:13304
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        524⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12400
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        526⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        527⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        528⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        529⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12708
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        531⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        532⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        533⤵
        Drops file in System32 directory
        
        PID:12948
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        534⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        535⤵
        
        PID:13100
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        536⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        537⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        538⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        539⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4052
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        541⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        542⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        543⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        544⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        545⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        546⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        547⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        548⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        549⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        550⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        551⤵
        Modifies registry class
        
        PID:12704
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        552⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        553⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        554⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        555⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        556⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        557⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        558⤵
        
        PID:4704

C:\Windows\SysWOW64\Eejeiocj.exe
C:\Windows\system32\Eejeiocj.exe
1⤵
PID:12516
- C:\Windows\SysWOW64\Ekdnei32.exe
  C:\Windows\system32\Ekdnei32.exe
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\Ebnfbcbc.exe
    C:\Windows\system32\Ebnfbcbc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:4484
  - - C:\Windows\SysWOW64\Fihnomjp.exe
      C:\Windows\system32\Fihnomjp.exe
      4⤵
      PID:4720
    - - C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        5⤵
        
        PID:1396
      - C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        6⤵
        Drops file in System32 directory
        
        PID:892
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        7⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        8⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        9⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4500
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        11⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        12⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        13⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        14⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        15⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        16⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        17⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        18⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        19⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        20⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        22⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        23⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        24⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        25⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        26⤵
        Drops file in System32 directory
        
        PID:3856
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        27⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        28⤵
        Drops file in System32 directory
        
        PID:3124
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        29⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        30⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        31⤵
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        32⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        33⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        34⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        36⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        37⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        38⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        39⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        40⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        41⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        42⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        43⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        44⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        45⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        46⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        47⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        48⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        49⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        50⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        51⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        52⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        53⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        54⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        55⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        56⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        58⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        59⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        60⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        61⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        62⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        63⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        64⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        65⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        66⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        67⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        68⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        69⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        70⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        71⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        72⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        73⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        74⤵
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        75⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        76⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        77⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        78⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        79⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        80⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        81⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        82⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        83⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        84⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        85⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        86⤵
        
        PID:4452

C:\Windows\SysWOW64\Ledepn32.exe
C:\Windows\system32\Ledepn32.exe
1⤵
- Modifies registry class
PID:1284
- C:\Windows\SysWOW64\Llnnmhfe.exe
  C:\Windows\system32\Llnnmhfe.exe
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\Lomjicei.exe
    C:\Windows\system32\Lomjicei.exe
    3⤵
    PID:13180
  - - C:\Windows\SysWOW64\Lakfeodm.exe
      C:\Windows\system32\Lakfeodm.exe
      4⤵
      PID:2820
    - - C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        5⤵
        Drops file in System32 directory
        
        PID:6588
      - C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        6⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        7⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        8⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        9⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        10⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        11⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        12⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        13⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        14⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        15⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        16⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        18⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        19⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        20⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        21⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        22⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        23⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        25⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        26⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        27⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        28⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2300
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        30⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        31⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        32⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        35⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        36⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        37⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7596
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        39⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        40⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        41⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        42⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        43⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        44⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        46⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        47⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        48⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        49⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        50⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        51⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        52⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        53⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        54⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        55⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        56⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        57⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        58⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        59⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        61⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        62⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        63⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        65⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        66⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        67⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        68⤵
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        70⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        71⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        72⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        73⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        74⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        76⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        77⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        79⤵
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        80⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        81⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        82⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        83⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7664
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        85⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        86⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        87⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        88⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        89⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        90⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        91⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        92⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3436
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        94⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        95⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        96⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        97⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        98⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        99⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        100⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        101⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        102⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        103⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        104⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        105⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        107⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        108⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        109⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        110⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        111⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        112⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        113⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        114⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        115⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        116⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        117⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        118⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        119⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        120⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        121⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        122⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        123⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        124⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        125⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        126⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        127⤵
        Modifies registry class
        
        PID:536

C:\Windows\SysWOW64\Ecikjoep.exe
C:\Windows\system32\Ecikjoep.exe
1⤵
PID:6164
- C:\Windows\SysWOW64\Ekqckmfb.exe
  C:\Windows\system32\Ekqckmfb.exe
  2⤵
  PID:9872
- - C:\Windows\SysWOW64\Eajlhg32.exe
    C:\Windows\system32\Eajlhg32.exe
    3⤵
    PID:6880
  - - C:\Windows\SysWOW64\Edihdb32.exe
      C:\Windows\system32\Edihdb32.exe
      4⤵
      Modifies registry class
      PID:9280
    - - C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        5⤵
        
        PID:3660
      - C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        6⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        7⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        8⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116

C:\Windows\SysWOW64\Fjjjgh32.exe
C:\Windows\system32\Fjjjgh32.exe
1⤵
PID:8548
- C:\Windows\SysWOW64\Fbaahf32.exe
  C:\Windows\system32\Fbaahf32.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\Fqdbdbna.exe
    C:\Windows\system32\Fqdbdbna.exe
    3⤵
    PID:12536
  - - C:\Windows\SysWOW64\Fcbnpnme.exe
      C:\Windows\system32\Fcbnpnme.exe
      4⤵
      PID:8612
    - - C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        5⤵
        
        PID:4968
      - C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        6⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        7⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        8⤵
        Drops file in System32 directory
        
        PID:9892
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        9⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        10⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        11⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 404
        12⤵
        Program crash
        
        PID:9172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6324 -ip 6324
1⤵
PID:7408

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:11428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
0b02249acf014659586944b628a5b5d7

SHA1
33690efc53fbd976c850760a5b70b963129acbc9

SHA256
e4373702e3c82ee76765e949b67c34733fd7e835eaaa31b592aaaf208dbd5854

SHA512
2ddf7d7f5b0c18f5524ff4307eac2fbeb060a54041791577ba3a4a9d7249b1bfca3fdb685acc1122b9733080276917c8a54caac96872cf8c3e446464ba0bb7e4

Download Submit
C:\Windows\SysWOW64\Akccap32.exe

Filesize
80KB

MD5
ea6fa8c0a6fae81536f60d36d2fecc54

SHA1
51479d0acb27d6a7eb8bb0d9adde1937735c3ebe

SHA256
64d7aff2dc2ad7dc2eae9ecf025225a8ae865555ee8847a4f2e6e282088a1f79

SHA512
bec4bdcd758879f6cffc2edf371f4dfd30359eed9189b73e0cc619c3dd42b983124dd2a7ad958f73d0a0f9f218ab3d4fa83af135bead93ed8162d90ffbc343e9

Download Submit
C:\Windows\SysWOW64\Anmfbl32.exe

Filesize
80KB

MD5
63036787ad83d7151d6f19b108dbfe16

SHA1
a83b7ad0f7a3005833f245cbdd5f84e8f87975fd

SHA256
42cc018238cee890d1a15bd522a57d956e3701c05a24ba88c417ab1021059059

SHA512
7dbcb62500d4acc051c90b5703b421a760fc90fd4d31ef3b03a21c3fc535a08f574998f529a94193587334b39965d5bc2f881cd3b37362a5d52f394fa8ee4481

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
80KB

MD5
f4162ba392383147a67a1590cdb53311

SHA1
ea36a970a71b388df45eb308481cc17c15251747

SHA256
4d0ca05c26c33d031422c93c441db042d0045a49644022c27179a2801801bc89

SHA512
69ec929fe6e2184a3a29a66f65ea23efdc0ca7721250e1be928ba36df03907ef39f00a91b31cc73cb5777d7c77c7b73f3ee1d9b145fb0a5f46ae58b3e061b265

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
80KB

MD5
f4162ba392383147a67a1590cdb53311

SHA1
ea36a970a71b388df45eb308481cc17c15251747

SHA256
4d0ca05c26c33d031422c93c441db042d0045a49644022c27179a2801801bc89

SHA512
69ec929fe6e2184a3a29a66f65ea23efdc0ca7721250e1be928ba36df03907ef39f00a91b31cc73cb5777d7c77c7b73f3ee1d9b145fb0a5f46ae58b3e061b265

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
80KB

MD5
d72e4364ee5dd54c11bc1f375eb73853

SHA1
2100012b5727e4beac668ae5de8e581dd2da5feb

SHA256
5240b2b8272a31a1099fa2c00bea6783e2a249093034a49bdb033b85958e36dd

SHA512
c410aa9a029c4e1e69b9c7b8273edfeb2d55021bcfb30d8bfa06098a1b3423fde488953b97c25f3fcab30394113dcc474ae0243bd4286f61756ac7e38f2aaec1

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
80KB

MD5
d72e4364ee5dd54c11bc1f375eb73853

SHA1
2100012b5727e4beac668ae5de8e581dd2da5feb

SHA256
5240b2b8272a31a1099fa2c00bea6783e2a249093034a49bdb033b85958e36dd

SHA512
c410aa9a029c4e1e69b9c7b8273edfeb2d55021bcfb30d8bfa06098a1b3423fde488953b97c25f3fcab30394113dcc474ae0243bd4286f61756ac7e38f2aaec1

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
80KB

MD5
7cff08e21f3f67a62706f0ef8592dd5e

SHA1
e50cd9ec1b52a7a4ec26e71a09748fc68aae918c

SHA256
51b7d055c174f51afc445778dd568d0654321b9b9fb580102697c2df53ed1cb2

SHA512
e60809a4906ceefe2d4ea797b00e1a0656145a85ccc59aa67e66aa50334c25799552f33c545fd83fe2e33b213941a9d80ac0a78cf50caea86a92b804375ac1d7

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
80KB

MD5
7cff08e21f3f67a62706f0ef8592dd5e

SHA1
e50cd9ec1b52a7a4ec26e71a09748fc68aae918c

SHA256
51b7d055c174f51afc445778dd568d0654321b9b9fb580102697c2df53ed1cb2

SHA512
e60809a4906ceefe2d4ea797b00e1a0656145a85ccc59aa67e66aa50334c25799552f33c545fd83fe2e33b213941a9d80ac0a78cf50caea86a92b804375ac1d7

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
80KB

MD5
3d2b65414dda0f115883b7835ef51ecb

SHA1
88c640786d88cc0a7cb784f1d1a5ba2031c3af2d

SHA256
ca21a1c317126da91f563a45f7ee01b8613b84e7d53e7825ceaf0ecc1918470f

SHA512
2cb918154ab5c987738fe04f837af351ab5c8646ce0df922a06b70ca85bb776b114031e0fcd81421e4589244dfa34452b23e8f888d9e74c5d10309e7eb7d16b9

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
80KB

MD5
3d2b65414dda0f115883b7835ef51ecb

SHA1
88c640786d88cc0a7cb784f1d1a5ba2031c3af2d

SHA256
ca21a1c317126da91f563a45f7ee01b8613b84e7d53e7825ceaf0ecc1918470f

SHA512
2cb918154ab5c987738fe04f837af351ab5c8646ce0df922a06b70ca85bb776b114031e0fcd81421e4589244dfa34452b23e8f888d9e74c5d10309e7eb7d16b9

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
80KB

MD5
3d14fc5ec24c9aef6defd7bf399dbdda

SHA1
a818f852ca7765c89d68d46c229ef16f78ecbc0f

SHA256
32da5796bc81e5eae5447614754caeecd69b004ccb760de7eb67838c2abdbdb3

SHA512
a7d747b6f84731bc7017c1764d276915ded666c0d76ec0b733b8fe18dfb9cbcba9110121e86af4ac081f5f03f07d064c1a4e211da2f5f1388fc748ef990e61d2

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
80KB

MD5
3d14fc5ec24c9aef6defd7bf399dbdda

SHA1
a818f852ca7765c89d68d46c229ef16f78ecbc0f

SHA256
32da5796bc81e5eae5447614754caeecd69b004ccb760de7eb67838c2abdbdb3

SHA512
a7d747b6f84731bc7017c1764d276915ded666c0d76ec0b733b8fe18dfb9cbcba9110121e86af4ac081f5f03f07d064c1a4e211da2f5f1388fc748ef990e61d2

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
80KB

MD5
7bc815ca0aebdaebf050926cfdca383a

SHA1
9e395cdcbc5a713291d420b2ac03c5f0c6b668d2

SHA256
144d55d6961daa5024125c2f51a4961d8514f673f6c81b6770941e6876b35326

SHA512
3a79f14aa091e556df241901337a4affa78fdf685a233044bd02e712ca9799337f3943324fada838c8fb4ced0e7ca441e5f1b12e8094e45273baf31cc8f70475

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
80KB

MD5
7bc815ca0aebdaebf050926cfdca383a

SHA1
9e395cdcbc5a713291d420b2ac03c5f0c6b668d2

SHA256
144d55d6961daa5024125c2f51a4961d8514f673f6c81b6770941e6876b35326

SHA512
3a79f14aa091e556df241901337a4affa78fdf685a233044bd02e712ca9799337f3943324fada838c8fb4ced0e7ca441e5f1b12e8094e45273baf31cc8f70475

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
80KB

MD5
e0bf31c4271c34b3c9bd2bd11a5a0f01

SHA1
1b81a6222467c7f7a04724c34f431c48337d1ce6

SHA256
585cb0259407037829d42bce72f8f5678b17f2ac3e8dda8048a0bb48dd7ee7e5

SHA512
659a35258b161a3e717c31bdc2fcc5f92b64af787ea898983bc650832b5de9fe4e15651db4c94362e313de7ff6770aeb0812ba609b7b77eefd8f5961c26f729c

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
80KB

MD5
e0bf31c4271c34b3c9bd2bd11a5a0f01

SHA1
1b81a6222467c7f7a04724c34f431c48337d1ce6

SHA256
585cb0259407037829d42bce72f8f5678b17f2ac3e8dda8048a0bb48dd7ee7e5

SHA512
659a35258b161a3e717c31bdc2fcc5f92b64af787ea898983bc650832b5de9fe4e15651db4c94362e313de7ff6770aeb0812ba609b7b77eefd8f5961c26f729c

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
80KB

MD5
f01cdfbf35f6152a03e967b2225ee608

SHA1
fb5aee7dbe7c1121c5602245ee78931398b4ce9f

SHA256
b7cddc85dee9abfc572a1b3ab626d54e34d4761310034829e11a079cbc2152b0

SHA512
e0e042ef1fbd234887de57196c95fa245057a386f9444b1836c4217375d17c273bf7b7d6f220b70af8425f9fbd8b698e15341507737db72d0698482627b3f2d3

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
80KB

MD5
f01cdfbf35f6152a03e967b2225ee608

SHA1
fb5aee7dbe7c1121c5602245ee78931398b4ce9f

SHA256
b7cddc85dee9abfc572a1b3ab626d54e34d4761310034829e11a079cbc2152b0

SHA512
e0e042ef1fbd234887de57196c95fa245057a386f9444b1836c4217375d17c273bf7b7d6f220b70af8425f9fbd8b698e15341507737db72d0698482627b3f2d3

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
80KB

MD5
14964bb25b9c76089a07ca4509b4ef24

SHA1
e8739d03fd4d2a038630de96759d95e2e777aed0

SHA256
3dd83897bdba87d94a2768c18ed7c5275ce0b31b795040c29392d72a038e25b0

SHA512
8b7fe620f3add1fd51a359555777c14555bf6de602a265436b3d4c55f1686bc35f148a3438851e3662ed77d735d2ddb8dfea3f0e387b0a4d9d4297f7d839fe9c

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
80KB

MD5
14964bb25b9c76089a07ca4509b4ef24

SHA1
e8739d03fd4d2a038630de96759d95e2e777aed0

SHA256
3dd83897bdba87d94a2768c18ed7c5275ce0b31b795040c29392d72a038e25b0

SHA512
8b7fe620f3add1fd51a359555777c14555bf6de602a265436b3d4c55f1686bc35f148a3438851e3662ed77d735d2ddb8dfea3f0e387b0a4d9d4297f7d839fe9c

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
80KB

MD5
58b4182723e06b70c40335566426ff51

SHA1
a13910e5a2b6e2ca876fdf4a67b54bfc88e13f08

SHA256
8115b6947dad5ca25eaef3c789200ca3f95ef63eac5914961032a672a134ec79

SHA512
dd4c6603be5114c558feaa7126a42d6db4e42ac88ba0432d8d2701913c7ea049c6f97c96efccac710a3d6a0390c90e41be447f2039d5a0938ee6925e9dbaa6db

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
80KB

MD5
58b4182723e06b70c40335566426ff51

SHA1
a13910e5a2b6e2ca876fdf4a67b54bfc88e13f08

SHA256
8115b6947dad5ca25eaef3c789200ca3f95ef63eac5914961032a672a134ec79

SHA512
dd4c6603be5114c558feaa7126a42d6db4e42ac88ba0432d8d2701913c7ea049c6f97c96efccac710a3d6a0390c90e41be447f2039d5a0938ee6925e9dbaa6db

Download Submit
C:\Windows\SysWOW64\Dbpjaeoc.exe

Filesize
80KB

MD5
740bdf2ad86e3c8a9c6c297f9481464a

SHA1
7dc9884f04f914d4eeeef6748791fb16f63d6d41

SHA256
733ea3cdc7caeb32e9aca102cd690310fbb97552dcee27eeea5c51fbc555eed6

SHA512
8d94bfe5ad5bb4c8ab3cf45057587c288d76590d170e02dcdce101891d0ccad1020100da671956b5742e94158b5cb3a7bc779bc7fe5080e5085f940c00afa44d

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
80KB

MD5
9666ae6cbc5f7322ef86a2b1c85c5aa7

SHA1
4fda41c363a26a3c34ebd2c03433df2fb848fcc9

SHA256
65302356b966db22c2a1e218d520dc627b77c71c22afa4f46555755f3a6514c9

SHA512
ef233884a4691a4c6ea1c49109346fd263d99f7a322d1a87ded310545067dba47ceb8ccc80448cf3fd4e7bc1e4fd156a13515aa6ccab995217a2a677ffac4787

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
80KB

MD5
9666ae6cbc5f7322ef86a2b1c85c5aa7

SHA1
4fda41c363a26a3c34ebd2c03433df2fb848fcc9

SHA256
65302356b966db22c2a1e218d520dc627b77c71c22afa4f46555755f3a6514c9

SHA512
ef233884a4691a4c6ea1c49109346fd263d99f7a322d1a87ded310545067dba47ceb8ccc80448cf3fd4e7bc1e4fd156a13515aa6ccab995217a2a677ffac4787

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
80KB

MD5
a6d12af4f8cb9df51fc76d70bc81c7cb

SHA1
e69a666cda2ed8338f224719949dc2f2225d8fb1

SHA256
feca5c6a2599c707b91ece570a72a09db387a91a7c610159c8e163a9b2817ef2

SHA512
1fcfbc3c66165c069777142f5cb9a75e754e8c3202a1d8bc616ed87ede3a9708e7e4dcab3483f926317e4fdba0606fa5d744ff76488ed5e7e8cd64c741d4cf18

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
80KB

MD5
a6d12af4f8cb9df51fc76d70bc81c7cb

SHA1
e69a666cda2ed8338f224719949dc2f2225d8fb1

SHA256
feca5c6a2599c707b91ece570a72a09db387a91a7c610159c8e163a9b2817ef2

SHA512
1fcfbc3c66165c069777142f5cb9a75e754e8c3202a1d8bc616ed87ede3a9708e7e4dcab3483f926317e4fdba0606fa5d744ff76488ed5e7e8cd64c741d4cf18

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
80KB

MD5
e338424ee945913e5a9cb7fdea8c4c9b

SHA1
2f1906ac9ab35f0a68957b5c89f3e500fa948764

SHA256
3aa5b8a5cce7d2bf313482383a8170899b9d41ce6b1838a33b3816c240a114db

SHA512
60f910925750c652e86a2b0468dd5e8f5f338c14cb71dd2a5e7c2d7c3b9fe6ae6762a2909e36d2c322a504576f480689ca408b46529f828ee938d786a8037ba8

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
80KB

MD5
e338424ee945913e5a9cb7fdea8c4c9b

SHA1
2f1906ac9ab35f0a68957b5c89f3e500fa948764

SHA256
3aa5b8a5cce7d2bf313482383a8170899b9d41ce6b1838a33b3816c240a114db

SHA512
60f910925750c652e86a2b0468dd5e8f5f338c14cb71dd2a5e7c2d7c3b9fe6ae6762a2909e36d2c322a504576f480689ca408b46529f828ee938d786a8037ba8

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
80KB

MD5
5385057e04e3a0c1dbe3fd9f2384e569

SHA1
1a6c97feeeed268c95f7d233922e275c72cb672e

SHA256
33cca91013ecf555a33c8d1d5baf82da7cfa80abae8e84e23b7bb60d3a2166b8

SHA512
018b6d9e19a21f1c334edcb2b38e9dc41ac2d30f22e2c01930b3997c27141f2bb078bc5eb28359f688b5a4b919b6f37f654d436aa6ae32c8399937eca969b6fa

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
80KB

MD5
5385057e04e3a0c1dbe3fd9f2384e569

SHA1
1a6c97feeeed268c95f7d233922e275c72cb672e

SHA256
33cca91013ecf555a33c8d1d5baf82da7cfa80abae8e84e23b7bb60d3a2166b8

SHA512
018b6d9e19a21f1c334edcb2b38e9dc41ac2d30f22e2c01930b3997c27141f2bb078bc5eb28359f688b5a4b919b6f37f654d436aa6ae32c8399937eca969b6fa

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
80KB

MD5
2f47e04bdc305f064be3c114a5aa398e

SHA1
ba4ef465a4069044860e55ddd6ebe00be1d08bba

SHA256
028d11fdf84ba5cb8317febae1aa638a7fe9757fc992a42513bf8869072d946b

SHA512
456a90faf8747a36ca4283e647f9a5e98914a73f8d4b45294d8f064d7c0e663844f3ee220510e5bfde69bf1332f43ae01227cef252a1a652bc5f1dd1132a406d

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
80KB

MD5
2f47e04bdc305f064be3c114a5aa398e

SHA1
ba4ef465a4069044860e55ddd6ebe00be1d08bba

SHA256
028d11fdf84ba5cb8317febae1aa638a7fe9757fc992a42513bf8869072d946b

SHA512
456a90faf8747a36ca4283e647f9a5e98914a73f8d4b45294d8f064d7c0e663844f3ee220510e5bfde69bf1332f43ae01227cef252a1a652bc5f1dd1132a406d

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
80KB

MD5
0ac9375bed07c9214877ebe059877e44

SHA1
d1b4a3f8ec8f00cc7e891e2c21f8d3f765f65229

SHA256
03a133e7a208af485267843390b84054746f5338c53d9e4d311ea5d5232ed906

SHA512
8fcb2391a8330c0cb0dbd2dddc03f4e163194f3bececa2f70aa852c1f0133a0dce45442ee241900634c4ebb94e64bb6488997890fe4f257445a8142de2b98e55

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
80KB

MD5
0ac9375bed07c9214877ebe059877e44

SHA1
d1b4a3f8ec8f00cc7e891e2c21f8d3f765f65229

SHA256
03a133e7a208af485267843390b84054746f5338c53d9e4d311ea5d5232ed906

SHA512
8fcb2391a8330c0cb0dbd2dddc03f4e163194f3bececa2f70aa852c1f0133a0dce45442ee241900634c4ebb94e64bb6488997890fe4f257445a8142de2b98e55

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
80KB

MD5
ea3a5e8e683ebd37d03fa15f2f0fbc44

SHA1
5fe9eb7ed5f4bb781cdbbe66cd37a0e4efc927d9

SHA256
c170599f0c49451a29d0c5c73428844cd81179da77064a08d1a0d4742cffaf05

SHA512
e65440c728e926e13f8796a676856390b13b3160f410b3294e4015e163061a3c68e398c976a6954e8663dbf6500b8cfa35ffe649e1c77393172afd0f8969f8c1

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
80KB

MD5
ea3a5e8e683ebd37d03fa15f2f0fbc44

SHA1
5fe9eb7ed5f4bb781cdbbe66cd37a0e4efc927d9

SHA256
c170599f0c49451a29d0c5c73428844cd81179da77064a08d1a0d4742cffaf05

SHA512
e65440c728e926e13f8796a676856390b13b3160f410b3294e4015e163061a3c68e398c976a6954e8663dbf6500b8cfa35ffe649e1c77393172afd0f8969f8c1

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
80KB

MD5
27cf5ca34fd1228c3e9e18394f398928

SHA1
f34b7a3b63604fbeeb7be0417350633f0315fd67

SHA256
511c6c871b26471a54708bcaf11c5a706e4e4af546697193fef660a3626f1a6d

SHA512
25b1894f8d47469642fcd7a894cf5eee2530b236d51eefcc0d612e8ced6765634fea14e2abcb6bafee955b50b2ce752466257df427864e2625752c6e7af73dff

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
80KB

MD5
27cf5ca34fd1228c3e9e18394f398928

SHA1
f34b7a3b63604fbeeb7be0417350633f0315fd67

SHA256
511c6c871b26471a54708bcaf11c5a706e4e4af546697193fef660a3626f1a6d

SHA512
25b1894f8d47469642fcd7a894cf5eee2530b236d51eefcc0d612e8ced6765634fea14e2abcb6bafee955b50b2ce752466257df427864e2625752c6e7af73dff

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
80KB

MD5
1264c3e328e6c6740f27f725fb94f031

SHA1
63dfbc8b77681abcd295b909d52a4b3c1041bb12

SHA256
ac406c2c2e8d36701ee9806522099f2648e137aa54c9c3adab31cc1781fb7d37

SHA512
553f6cbe699252608dc5ae793bb2bcf05f0e4c80931e51f7446668a9f57476ad67b5e64680dabe7bdebd7476d59c7bada6052ff8a30373fe867455478608595b

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
80KB

MD5
1264c3e328e6c6740f27f725fb94f031

SHA1
63dfbc8b77681abcd295b909d52a4b3c1041bb12

SHA256
ac406c2c2e8d36701ee9806522099f2648e137aa54c9c3adab31cc1781fb7d37

SHA512
553f6cbe699252608dc5ae793bb2bcf05f0e4c80931e51f7446668a9f57476ad67b5e64680dabe7bdebd7476d59c7bada6052ff8a30373fe867455478608595b

Download Submit
C:\Windows\SysWOW64\Eehnem32.exe

Filesize
80KB

MD5
b628204a1f83ecd6f8fbab0325e0a4df

SHA1
56104e9116e1b4d6263eb1233e8515cc504617ab

SHA256
fc96658a8d0a97e106af1184d5994a433cf4b427eff1c8d828db519bbe81ebea

SHA512
2a4bf6363e2f166880e9849c9f293faae81fa52f0321bfa3d109df6ce50fcf79ab88567d468ac9e641a1c7ae4f1cb231e260d34dae56b4855dd5154008001326

Download Submit
C:\Windows\SysWOW64\Eehnem32.exe

Filesize
80KB

MD5
b628204a1f83ecd6f8fbab0325e0a4df

SHA1
56104e9116e1b4d6263eb1233e8515cc504617ab

SHA256
fc96658a8d0a97e106af1184d5994a433cf4b427eff1c8d828db519bbe81ebea

SHA512
2a4bf6363e2f166880e9849c9f293faae81fa52f0321bfa3d109df6ce50fcf79ab88567d468ac9e641a1c7ae4f1cb231e260d34dae56b4855dd5154008001326

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
80KB

MD5
4020fb0a799c53c02f04abd062183278

SHA1
dce1fee4431b3ebbebb8175204ce21036c7aead9

SHA256
96211f0704b5cdba413cf48e0ef0207647a7275b74c75f5456c813ebe5647c99

SHA512
a705f46a26cb3e8e654039de48d40cfdf4633e333cc4381a1ebc6a1e4a1d89578de69039d38abc8df2ec9a166f49605d9db9fd3dbad70013eafd26b59a81e36c

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
80KB

MD5
4020fb0a799c53c02f04abd062183278

SHA1
dce1fee4431b3ebbebb8175204ce21036c7aead9

SHA256
96211f0704b5cdba413cf48e0ef0207647a7275b74c75f5456c813ebe5647c99

SHA512
a705f46a26cb3e8e654039de48d40cfdf4633e333cc4381a1ebc6a1e4a1d89578de69039d38abc8df2ec9a166f49605d9db9fd3dbad70013eafd26b59a81e36c

Download Submit
C:\Windows\SysWOW64\Egdqae32.exe

Filesize
80KB

MD5
3491fca4eaa20370f0e6462020151b5f

SHA1
8da300a4a494dd5e072c6fd5f5859b4c57fea883

SHA256
fa33c3ee3b3d5b5815836d48aee5f9b417b5c228beefc56c8f591defcd081f99

SHA512
32e14a815dd3933f061c9d9424400735f104e9143366aba11cde1a3caa0273233f56ce348d3cf50e7f021e5802574a57c10276664ffe560f0f481b8e025d32f7

Download Submit
C:\Windows\SysWOW64\Egdqae32.exe

Filesize
80KB

MD5
3491fca4eaa20370f0e6462020151b5f

SHA1
8da300a4a494dd5e072c6fd5f5859b4c57fea883

SHA256
fa33c3ee3b3d5b5815836d48aee5f9b417b5c228beefc56c8f591defcd081f99

SHA512
32e14a815dd3933f061c9d9424400735f104e9143366aba11cde1a3caa0273233f56ce348d3cf50e7f021e5802574a57c10276664ffe560f0f481b8e025d32f7

Download Submit
C:\Windows\SysWOW64\Egijmegb.exe

Filesize
80KB

MD5
febc0f3734f4ebf63697d8f6972f2d99

SHA1
1fe61db7196d1764e39ef03a3ca5e1cbfc9372f9

SHA256
df14b3896460a6eb3585525d06835167d20909ab67ae34d1eaf9afdd84f3c3c7

SHA512
5c3fd1784f6993be3a25e4ac68099935df56c2d675247696932fe0a9f6600c14aaf30ff10e08cba6ac8fbebcf0f0acadfc525e17bb6e4222d4a74de6e024dd95

Download Submit
C:\Windows\SysWOW64\Egijmegb.exe

Filesize
80KB

MD5
febc0f3734f4ebf63697d8f6972f2d99

SHA1
1fe61db7196d1764e39ef03a3ca5e1cbfc9372f9

SHA256
df14b3896460a6eb3585525d06835167d20909ab67ae34d1eaf9afdd84f3c3c7

SHA512
5c3fd1784f6993be3a25e4ac68099935df56c2d675247696932fe0a9f6600c14aaf30ff10e08cba6ac8fbebcf0f0acadfc525e17bb6e4222d4a74de6e024dd95

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
80KB

MD5
01e142f735aa52e1a50018d618bbb56d

SHA1
558dd266190dd64a3abd59daba1cb9f0c782178e

SHA256
ca181582fb5b18be7993ab635811eaeaa23cb2a0f62575c0229db971cbb868ba

SHA512
6850143d807e3b4b22c985f421ef2eb2fa124229d5d54aefd06ea6b6d55900f9f04ab03d98dd08d9d474b7ba9731b411c12eba52ada712809ff37fa99bfef70b

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
80KB

MD5
01e142f735aa52e1a50018d618bbb56d

SHA1
558dd266190dd64a3abd59daba1cb9f0c782178e

SHA256
ca181582fb5b18be7993ab635811eaeaa23cb2a0f62575c0229db971cbb868ba

SHA512
6850143d807e3b4b22c985f421ef2eb2fa124229d5d54aefd06ea6b6d55900f9f04ab03d98dd08d9d474b7ba9731b411c12eba52ada712809ff37fa99bfef70b

Download Submit
C:\Windows\SysWOW64\Ekbihd32.exe

Filesize
80KB

MD5
43bcc5fbbd10f3b6c4c243c47d455de0

SHA1
6d044d1fc2c669ac5161f1bbdf133d3c66144046

SHA256
40429e2b45413711ffe64b62415a65177eda392f59c1c181821b046438a584d2

SHA512
56be009eb35ab9e722657ace3621dd9634f46948ff8dddb8bc1adb6d3fd1f6344156476eea373a145ed447ca595b6523fde93d6b560faa365304edef254f060e

Download Submit
C:\Windows\SysWOW64\Ekbihd32.exe

Filesize
80KB

MD5
43bcc5fbbd10f3b6c4c243c47d455de0

SHA1
6d044d1fc2c669ac5161f1bbdf133d3c66144046

SHA256
40429e2b45413711ffe64b62415a65177eda392f59c1c181821b046438a584d2

SHA512
56be009eb35ab9e722657ace3621dd9634f46948ff8dddb8bc1adb6d3fd1f6344156476eea373a145ed447ca595b6523fde93d6b560faa365304edef254f060e

Download Submit
C:\Windows\SysWOW64\Emoinpcd.exe

Filesize
80KB

MD5
ec380f5195b498dcc1e48e9d38a8c41b

SHA1
0de6688c77b639456646b0e96f8072a514f325d8

SHA256
17183bd7ea94d29b62bb0c6791053f26149be84ec2d72078e021b08328172792

SHA512
184978f5a929c1f002b56743d21aecf220dd88ae0cb333f759393048b5754d3782d0ff77f6ec891584e89258117ba196b37099aff16d3446ea49e409d3ff57af

Download Submit
C:\Windows\SysWOW64\Emoinpcd.exe

Filesize
80KB

MD5
ec380f5195b498dcc1e48e9d38a8c41b

SHA1
0de6688c77b639456646b0e96f8072a514f325d8

SHA256
17183bd7ea94d29b62bb0c6791053f26149be84ec2d72078e021b08328172792

SHA512
184978f5a929c1f002b56743d21aecf220dd88ae0cb333f759393048b5754d3782d0ff77f6ec891584e89258117ba196b37099aff16d3446ea49e409d3ff57af

Download Submit
C:\Windows\SysWOW64\Empoiimf.exe

Filesize
80KB

MD5
637544bdcf9ac2c6071138083c3e3510

SHA1
dc33a84e054a84f2ce651ce3d10a8b762edca76a

SHA256
d66eea296a5b929ae2ebe0d3c46a33de6cde8fdf202ef58c467b9635997f6ca2

SHA512
9025ea606232fb3a5a087a82945a34c0c2561068ee5d133de792044f87faacd1cb2a5c083786957a8e8e652393eb283884e969ca3b75fd65350a34bb85f19b67

Download Submit
C:\Windows\SysWOW64\Eobocb32.exe

Filesize
80KB

MD5
2be0edd26d8b54ac3db2ee79047c2519

SHA1
ead4af39c0c1c32035f010b56dacb0cc5d130f37

SHA256
b75645d4528ce41a0e27d29ccade9a8d1153225e4a80c86928cb81cde46c0e4c

SHA512
caa60e8c91b14d0f5907617d8da135b6082f83a215622a4b668ae4190b3550c81aad5fc4d29f69ca44d2e045ddaab8bd6febb65701da13ec1d20dbd220e4a560

Download Submit
C:\Windows\SysWOW64\Eobocb32.exe

Filesize
80KB

MD5
2be0edd26d8b54ac3db2ee79047c2519

SHA1
ead4af39c0c1c32035f010b56dacb0cc5d130f37

SHA256
b75645d4528ce41a0e27d29ccade9a8d1153225e4a80c86928cb81cde46c0e4c

SHA512
caa60e8c91b14d0f5907617d8da135b6082f83a215622a4b668ae4190b3550c81aad5fc4d29f69ca44d2e045ddaab8bd6febb65701da13ec1d20dbd220e4a560

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
80KB

MD5
b517b992e0872c16233a6c6bea1c1cc7

SHA1
8f9f394c664685ac0f8acf962a46cb787f97ff31

SHA256
c84e4ca799a867159b2211e2c2c602c19bd68d83fc31cdc65fd633c4eb73ee35

SHA512
bf1b85ca88d51f4bdd820cf9747f89bebd33b8008aa8de08c5f1ee0760913d1c9fd299f0d039e535593505880e3432b95d18ea8409c533b8865beba41ef6c375

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
80KB

MD5
b517b992e0872c16233a6c6bea1c1cc7

SHA1
8f9f394c664685ac0f8acf962a46cb787f97ff31

SHA256
c84e4ca799a867159b2211e2c2c602c19bd68d83fc31cdc65fd633c4eb73ee35

SHA512
bf1b85ca88d51f4bdd820cf9747f89bebd33b8008aa8de08c5f1ee0760913d1c9fd299f0d039e535593505880e3432b95d18ea8409c533b8865beba41ef6c375

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
80KB

MD5
820f2b451029545bf9839722fcc68a2c

SHA1
055f87fb2ef10b72ef18aad34113e127403a1666

SHA256
8ad8524930494bc5dcfa1661f05f993da0bd305f2e0f68808410f207be01a9a8

SHA512
85e6c143258e40eadc65a0d892459d067b798b5c5d80d829b2fc46b49ccf444ef051b935abdaffba6e14ab0c717fb583e9aab54f74a5c5b0363b945f78e82465

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
80KB

MD5
820f2b451029545bf9839722fcc68a2c

SHA1
055f87fb2ef10b72ef18aad34113e127403a1666

SHA256
8ad8524930494bc5dcfa1661f05f993da0bd305f2e0f68808410f207be01a9a8

SHA512
85e6c143258e40eadc65a0d892459d067b798b5c5d80d829b2fc46b49ccf444ef051b935abdaffba6e14ab0c717fb583e9aab54f74a5c5b0363b945f78e82465

Download Submit
C:\Windows\SysWOW64\Fggocmhf.exe

Filesize
80KB

MD5
2dbc6a3bf78141639f32953fef6eedf2

SHA1
8a74554486fac0e68888a5707184e90aeb338a6c

SHA256
ab4f5957d3928123cd0a3a8782c711d7590f89d0c3719132725c0435d4c5df16

SHA512
9cbf99f8939505c71bc4498e7db1aff55772e725e7919c7b1b188e6cb4be9b5beb0bc7ff2d1cb1d325bddef633bd7d3e5338462afefa4b135993613c7f0cc2cd

Download Submit
C:\Windows\SysWOW64\Fhmpagkp.exe

Filesize
80KB

MD5
535ff4489bd15350e97130bb6283cf8b

SHA1
558ecbb992aa3eca3bcb2f28b13044badac743a2

SHA256
fb7af8d00b4f84aabab1f4235f2d9cb6de4071e77e214a04eb4e028d1c757931

SHA512
99ce0dbfd1910b799733c7185d1d26a014d283a45a4f3d17c3067b1e423994a30cd24ecc87316cb44d7b659399d13e6127a00c76c770a46432cac2e1e9048d51

Download Submit
C:\Windows\SysWOW64\Fhmpagkp.exe

Filesize
80KB

MD5
535ff4489bd15350e97130bb6283cf8b

SHA1
558ecbb992aa3eca3bcb2f28b13044badac743a2

SHA256
fb7af8d00b4f84aabab1f4235f2d9cb6de4071e77e214a04eb4e028d1c757931

SHA512
99ce0dbfd1910b799733c7185d1d26a014d283a45a4f3d17c3067b1e423994a30cd24ecc87316cb44d7b659399d13e6127a00c76c770a46432cac2e1e9048d51

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
80KB

MD5
dae233eda5423359046ee9634d32b193

SHA1
7948b3731d7768592b605bbb70c9be1ccbfdd8d0

SHA256
1acd858be9a11fe4ad97458974777fcd2119f89276c92150741adfe82cd3f681

SHA512
cdf7765b89c5886e0054826997f08bbd3796a346d9e1e3fd8445c4af9e731398cb1aa96f7d67d51904140c4fdbac4f44abb82533eb110d9babdf2ac8b72eb2d6

Download Submit
C:\Windows\SysWOW64\Fnmepn32.exe

Filesize
80KB

MD5
aa8c5ce014c06c28fa0d461067de2051

SHA1
18ab49f133ce3e0e263e9d2211ec8cb34ce8eff0

SHA256
f3f8ad6750cc44b72b23f5d4904995f61b7b57e0db1ce5a2d628f4f39e2e1a55

SHA512
97947bddc67842f51692e30f59b0c454c19c12c1ede6359b3a1023b20b41e86660427b34ccc0dbae9a87711882daa1de0dde3f2bd8b19cee85cdf3103574327f

Download Submit
C:\Windows\SysWOW64\Fnmepn32.exe

Filesize
80KB

MD5
aa8c5ce014c06c28fa0d461067de2051

SHA1
18ab49f133ce3e0e263e9d2211ec8cb34ce8eff0

SHA256
f3f8ad6750cc44b72b23f5d4904995f61b7b57e0db1ce5a2d628f4f39e2e1a55

SHA512
97947bddc67842f51692e30f59b0c454c19c12c1ede6359b3a1023b20b41e86660427b34ccc0dbae9a87711882daa1de0dde3f2bd8b19cee85cdf3103574327f

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
80KB

MD5
d900d68dfd3909635a08d93292631b19

SHA1
888563c53bb7e9a46667071f689c99960823d3fd

SHA256
15a0ddf42fc2b871650dc787b47bfa0ac0aa1a16538d55e48031059aeb8f4004

SHA512
b11e1cb55901f8ae7170d75d5b5378b5efc7b95d5a7e8cdd2019211a87c130f504c9e67d433d81927e419483ee5152f7f14ce484215df4b86a38f1e9ec2fea6c

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
80KB

MD5
d900d68dfd3909635a08d93292631b19

SHA1
888563c53bb7e9a46667071f689c99960823d3fd

SHA256
15a0ddf42fc2b871650dc787b47bfa0ac0aa1a16538d55e48031059aeb8f4004

SHA512
b11e1cb55901f8ae7170d75d5b5378b5efc7b95d5a7e8cdd2019211a87c130f504c9e67d433d81927e419483ee5152f7f14ce484215df4b86a38f1e9ec2fea6c

Download Submit
C:\Windows\SysWOW64\Ggcfja32.exe

Filesize
80KB

MD5
78da443f7ebc08f74df81c1f550ea50b

SHA1
271948dbb5f93fe89aaedce7b9c3517b6f2e158d

SHA256
042773c36382c27397a557c9fc03ed71670a2b2f4b6d7bc57f9628a5ebd80e95

SHA512
959457e79af59d8bdb4f452d3e1583532516fbe54faa3bd2ce7da96315bebfd9f243684ee7aaaeb9911e5e7db8c2c3f676065c4aee5c4392d27a264a98aaf839

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
80KB

MD5
7331b2fffa31046812cb5df74da52a14

SHA1
7d87491401a4450856d587b88dcf3bc35cde400d

SHA256
2fdf43be9306cd35851e7e6129dbe2695dbc8b6549018c8beffbce33310c04a8

SHA512
b7e0c187ed74690a620b3da1cb8a98eb31df1a4b89b5c2a117c3ec41b5bfad5b637146ea1d304b2c2ca1fd427efe80c08ed5d04eab6f569f71b5469a20a164da

Download Submit
C:\Windows\SysWOW64\Hfklhhcl.exe

Filesize
80KB

MD5
e75aeda27fa09bddb48e0cc26303508f

SHA1
51a6e095a47288bd64aec8db3f00dd976fe7dadf

SHA256
62c57b32fc8e05709fd8be592d38d06d4819a492ee846dd085e012667d9d58a0

SHA512
9e1e18b0aab8b7db590cbdb75affcfd2313d5b104f5f2003f84c049164b746dce94255c51ba0045c8ece73b33a91d6deb3ab6329051bf0a2b208fdeb72c3312e

Download Submit
C:\Windows\SysWOW64\Ihqoeb32.exe

Filesize
80KB

MD5
5596160f7efc28c4af4e0f90ab993330

SHA1
697973b458235d95271bd60a86cb02f7532dee46

SHA256
0fcf9deafafb7733b97831d87b5c87c8aba82f15749df108692d09982a077556

SHA512
483e14a18b17b3659eaa4ee75e63a272450335f8fe43c3bb8a8478e30d8c7d24696d245564fc31cfc4b2cc47dfd8cae051a63162aff953a1a56d507a4fc9cb1e

Download Submit
C:\Windows\SysWOW64\Ikkpgafg.exe

Filesize
80KB

MD5
357931cc625d07d8c269a97657facc72

SHA1
b5b5a1acb7a0b8c35d69bef3c8aba8e4a7ed1c4d

SHA256
06e1f1ceff1b466a8da0d9ba2922c01e387d3192991d854f57753fc974d1b06a

SHA512
1e9f7284c9bdf694a1b94390b9fb8e45e4252a58ce84750f1866c14b63af6d4ae9ec3834104d9c3f459103502ddc1ca2d85ba7b06c6499be66adda0d34a742b9

Download Submit
C:\Windows\SysWOW64\Iloidijb.exe

Filesize
80KB

MD5
d4577e3ccf275e7a6a2d5d35be56d842

SHA1
f51062e9790250373b840328115fb33bfaf585dc

SHA256
61eb689461e56556514924c8a69da3356fd8550c0671c4b755518e1772c2ba3f

SHA512
78ced24cd03caec136821d0799606980a63efe4608e968f478df8edc569d1a8442484ab5de1dfc32f27a9fe3cd276090fa81b834d82347b4074a93d53893239d

Download Submit
C:\Windows\SysWOW64\Jdfjld32.exe

Filesize
80KB

MD5
d29b983d32521c2d37f402ca2a0484b6

SHA1
ce905683854494ce7febde4bf59f7bb571c87399

SHA256
e7df667778e3b61779f6134ef62183b0b933c877365a732d7648c13871fe8e76

SHA512
a19d11bf800fce80d615b11046e44b84a17e3c4f48ac55e5da2cd894f0319da5f92c0d0e09c707085b79f3cc85147468c7d0344e4946cd5685b91e4a95b93044

Download Submit
C:\Windows\SysWOW64\Jgenbfoa.exe

Filesize
80KB

MD5
5bcdab37978975472484ab86ff416338

SHA1
bf81980fb95871663a1d2e840e171a5bd8577c4d

SHA256
0d7eed4a3519819549c19f5aa66307026cfe7e2cedf981391fa42a39e7a301c9

SHA512
d60ee00b387a6c6995797e60c4ae9d33e238b457188e29bbf94f312b9d4b31469bd48c5226bea8ea58329c3d71b7015f09b690685286d048e9a46a546abe60d9

Download Submit
C:\Windows\SysWOW64\Kbpkkn32.exe

Filesize
80KB

MD5
8934a720fbfc1e079f281d31f3063ed1

SHA1
745f264f7a73046fb1553143d3d0d693673c7c03

SHA256
8ccbc72341cb1aa693b94079949d613db8a4065fac3a8daa780aa3ca51fed5aa

SHA512
c1b1c425f7b4b905c68d456829e24241fdff7caf7c695218c9652f69fda69d5fbabe06dcf541c4a93c978d70cedaa8648e0756b1ce7d396b501b9908a6c523d9

Download Submit
C:\Windows\SysWOW64\Kdbjhbbd.exe

Filesize
80KB

MD5
2edc476287f96b31340c1fbe19258d81

SHA1
3a6a7a2e631be8bc650067162a60112cd70002ec

SHA256
c2573e70222d513cb47cbf50107cdf29d9ec40beae9b82459fb5da7c3e82ede7

SHA512
cd743547bdfd03bd963fe35d157133f28d87d24e2690938b761978d100f953b5158b4be8db8df8513ade29ec31af26abdd6bb43c123a7f9f2fd45f5bd87bbffb

Download Submit
C:\Windows\SysWOW64\Lpekef32.exe

Filesize
80KB

MD5
21e3db400b613bceafba4806ae0c9274

SHA1
bced8d89ec766fbeff4e8de54c51f62271cf8cce

SHA256
8ebe0a07e48110ca4b7d4dde1937f15f5b8d735018676a3797b131246f20a476

SHA512
2e6a4695c7dc97464bd8080b6a2f04116817e43f305f02a90da5b9a8034d90e755e7ddc547a43d62301f7b1e2770d5e2869f591952f92b379ed6c8e7df35e664

Download Submit
C:\Windows\SysWOW64\Mjneln32.exe

Filesize
80KB

MD5
0c4d7b16885a154453fc0f0060d12b1f

SHA1
955898386d297341b38754ccbd7253a60472fc6a

SHA256
75fc9cd1ce9fd2f1f882334404a9ffdbd228b427503dc515f3867cf248331ee5

SHA512
12ff5ed2bc94bd9227400b75a83f69c0d2dcd1a6a36c9bd72ab902b7b9f27f2eb382b791bb3bbf03c11f6fc5947fe34f2d54ef752de13ee58268db36a3f8fd50

Download Submit
C:\Windows\SysWOW64\Pedlgbkh.exe

Filesize
80KB

MD5
fe32c62940c608c0a19ef45df83c8576

SHA1
cd814d8a90baaac98e81ec8ea31eddc044d0ecb2

SHA256
e2eb4e878f9d4f4e92850beec3410b59f4c27b84f7cb7242833ebb6b87f07856

SHA512
a2ef24ca3563f7af5bc7a067196accb399007f8df33bd9c746e28a9b50a7395e58e7498d2f3f848112a55382b06ce228e9df1d835847e2f7e61cde6971b20e17

Download Submit
memory/264-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/372-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/408-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/436-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/448-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/864-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1040-150-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1140-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1368-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1372-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1380-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1396-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1440-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1448-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1492-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1540-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1684-5351-0x0000014F67850000-0x0000014F67851000-memory.dmp

Filesize
4KB

Download
memory/1684-5349-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5342-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5372-0x0000014F67980000-0x0000014F67981000-memory.dmp

Filesize
4KB

Download
memory/1684-5375-0x0000014F67990000-0x0000014F67991000-memory.dmp

Filesize
4KB

Download
memory/1684-5308-0x0000014F5F540000-0x0000014F5F550000-memory.dmp

Filesize
64KB

Download
memory/1684-5343-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5324-0x0000014F5F640000-0x0000014F5F650000-memory.dmp

Filesize
64KB

Download
memory/1684-5360-0x0000014F67780000-0x0000014F67781000-memory.dmp

Filesize
4KB

Download
memory/1684-5357-0x0000014F67840000-0x0000014F67841000-memory.dmp

Filesize
4KB

Download
memory/1684-5354-0x0000014F67850000-0x0000014F67851000-memory.dmp

Filesize
4KB

Download
memory/1684-5352-0x0000014F67840000-0x0000014F67841000-memory.dmp

Filesize
4KB

Download
memory/1684-5341-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5350-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5376-0x0000014F67AA0000-0x0000014F67AA1000-memory.dmp

Filesize
4KB

Download
memory/1684-5374-0x0000014F67990000-0x0000014F67991000-memory.dmp

Filesize
4KB

Download
memory/1684-5340-0x0000014F67C00000-0x0000014F67C01000-memory.dmp

Filesize
4KB

Download
memory/1684-5348-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5347-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5346-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5344-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1684-5345-0x0000014F67C30000-0x0000014F67C31000-memory.dmp

Filesize
4KB

Download
memory/1796-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1828-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1908-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1940-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2064-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2096-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2096-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2096-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2216-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2232-250-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2260-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2296-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2340-154-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-162-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2648-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2784-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2836-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3104-86-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3120-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3432-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3536-211-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3596-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3700-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3712-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4104-118-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4144-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4264-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4392-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4468-126-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4476-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4484-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4508-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4628-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4700-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4892-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads