be7b5211c513c191481eda3c5054fecd2020fca8fc2a64d36e6c047738b3d4d6

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe
Size

120KB
MD5

6dfbbafb1da56c54cb225c894c70c4c0
SHA1

0cbbacaff2dcca03110c65ffc3b716aeff0beb02
SHA256

be7b5211c513c191481eda3c5054fecd2020fca8fc2a64d36e6c047738b3d4d6
SHA512

089b8271ce7ae918e6b1c758ae0e7eafe9d785fc4f48c782cc08e6c3bb7fbcf10726e356477e929cdfde51f111677534c239152d10f4aecf90c8484d33446c29
SSDEEP

1536:k4Se+aZGYSm3meoXfgL4iv6n82Lq9TAjKw4lIt8AgH2v9jw2LhU:k4SezZG7e4Z+6n1q9UKw4lIGH4dW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fajnfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lldfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojbacd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffcpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajdbac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpqkad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fefedmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghppm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbgcih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feenjgfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhldbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplafeil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injcmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neqopnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfaajnfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Locbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eibfck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foqkdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflibgil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kijchhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opadhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhabbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgmgqc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjillkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbnkonbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Galoohke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpmlnjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfjcnold.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmdonkgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idieem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpochfji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bifmqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akamff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmflbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekonpckp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddifgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fedmqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acpbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfpdin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aopmfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mejpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plejdkmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alelqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lldopb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpkibf32.exe

Executes dropped EXE 64 IoCs

pid	Process
4028	Cnicfe32.exe
2784	Ceehho32.exe
3404	Cjbpaf32.exe
4988	Cegdnopg.exe
712	Emcbio32.exe
1232	Edmjfifl.exe
4764	Eemgplno.exe
3764	Eoekia32.exe
2524	Fnjhjn32.exe
1748	Fojedapj.exe
3560	Fedmqk32.exe
4624	Fajnfl32.exe
3296	Fhdfbfdh.exe
3900	Fnaokmco.exe
4248	Fdkggg32.exe
1812	Foqkdp32.exe
1992	Gkglja32.exe
5116	Gdppbfff.exe
864	Goedpofl.exe
3836	Gepmlimi.exe
4616	Gohaeo32.exe
4276	Gfbibikg.exe
3716	Gfdfgiid.exe
4108	Ghbbcd32.exe
4900	Goljqnpd.exe
740	Hheoid32.exe
3416	Hbmcbime.exe
112	Hhgloc32.exe
3208	Hbpphi32.exe
3904	Hhihdcbp.exe
1380	Hkjafn32.exe
4908	Hdbfodfa.exe
3300	Ihqoeb32.exe
2664	Iokgal32.exe
1272	Idgojc32.exe
4316	Ikaggmii.exe
4424	Ifgldfio.exe
4920	Ioopml32.exe
3876	Indmnh32.exe
3264	Ienekbld.exe
5096	Jodjhkkj.exe
1028	Jgonlm32.exe
2712	Joffnk32.exe
4204	Jiokfpph.exe
1132	Jnkcogno.exe
4788	Jfehed32.exe
2720	Jpmlnjco.exe
3788	Jghabl32.exe
1712	Kppici32.exe
1588	Kelalp32.exe
4448	Kpbfii32.exe
3068	Kflnfcgg.exe
4680	Klifnj32.exe
2268	Kbbokdlk.exe
4492	Kimghn32.exe
1904	Kfqgab32.exe
3356	Kpiljh32.exe
1616	Kfcdfbqo.exe
4688	Llpmoiof.exe
2192	Lbjelc32.exe
5068	Llbidimc.exe
4464	Lblaabdp.exe
4132	Lldfjh32.exe
3152	Locbfd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ndlapjeg.dll	Jgadgf32.exe
File opened for modification	C:\Windows\SysWOW64\Nbgcih32.exe	Nlnkmnah.exe
File opened for modification	C:\Windows\SysWOW64\Dooaoj32.exe	Ddjmba32.exe
File opened for modification	C:\Windows\SysWOW64\Pjdpelnc.exe	Pfiddm32.exe
File created	C:\Windows\SysWOW64\Ajdbac32.exe	Adgmoigj.exe
File created	C:\Windows\SysWOW64\Mjellmbp.exe	Micoed32.exe
File created	C:\Windows\SysWOW64\Bfgjjm32.exe	Bblnindg.exe
File created	C:\Windows\SysWOW64\Jjmcnbdm.exe	Jdpkflfe.exe
File created	C:\Windows\SysWOW64\Faikapbo.dll	Alqjpi32.exe
File created	C:\Windows\SysWOW64\Pmphblgf.dll	Ddjmba32.exe
File opened for modification	C:\Windows\SysWOW64\Lgibpf32.exe	Lnangaoa.exe
File created	C:\Windows\SysWOW64\Hcdikecn.dll	Oigllh32.exe
File opened for modification	C:\Windows\SysWOW64\Knflpoqf.exe	Kkhpdcab.exe
File created	C:\Windows\SysWOW64\Ajlgckkf.dll	Oeaoab32.exe
File created	C:\Windows\SysWOW64\Kmhjapnj.dll	Hlpfhe32.exe
File created	C:\Windows\SysWOW64\Kkgiimng.exe	Kcpahpmd.exe
File created	C:\Windows\SysWOW64\Ifaciolc.dll	Efpomccg.exe
File created	C:\Windows\SysWOW64\Ibcllpfj.dll	Jgonlm32.exe
File opened for modification	C:\Windows\SysWOW64\Pcicklnn.exe	Pjpobg32.exe
File created	C:\Windows\SysWOW64\Jdbbeh32.dll	Bogcgj32.exe
File opened for modification	C:\Windows\SysWOW64\Hdpbon32.exe	Hnfjbdmk.exe
File created	C:\Windows\SysWOW64\Qlejfm32.dll	Difpmfna.exe
File created	C:\Windows\SysWOW64\Jcphdpff.dll	Igbalblk.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe
File created	C:\Windows\SysWOW64\Ppipkl32.dll	Gbabigfj.exe
File opened for modification	C:\Windows\SysWOW64\Pkbjjbda.exe	Pdhbmh32.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Pnmopk32.exe
File created	C:\Windows\SysWOW64\Ajbfciej.dll	Amikgpcc.exe
File created	C:\Windows\SysWOW64\Bdeiqgkj.exe	Bpjmph32.exe
File created	C:\Windows\SysWOW64\Hkpqkcpd.exe	Hbhijepa.exe
File created	C:\Windows\SysWOW64\Fmplqd32.dll	Lqhdbm32.exe
File opened for modification	C:\Windows\SysWOW64\Mledmg32.exe	Mfkkqmiq.exe
File opened for modification	C:\Windows\SysWOW64\Njljch32.exe	Nmcpoedn.exe
File opened for modification	C:\Windows\SysWOW64\Gehbjm32.exe	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Jhnojl32.exe	Jhkbdmbg.exe
File opened for modification	C:\Windows\SysWOW64\Ppmcdq32.exe	Pfgogh32.exe
File created	C:\Windows\SysWOW64\Dcoobn32.dll	Ooejohhq.exe
File created	C:\Windows\SysWOW64\Jofbdcmb.dll	Pkadoiip.exe
File created	C:\Windows\SysWOW64\Lnnlhc32.dll	Gmdjapgb.exe
File created	C:\Windows\SysWOW64\Hlhccj32.exe	Hcmbee32.exe
File opened for modification	C:\Windows\SysWOW64\Mnmdme32.exe	Mkmkkjko.exe
File opened for modification	C:\Windows\SysWOW64\Ioopml32.exe	Ifgldfio.exe
File opened for modification	C:\Windows\SysWOW64\Ncjginjn.exe	Nplkmckj.exe
File opened for modification	C:\Windows\SysWOW64\Fefedmil.exe	Ffceip32.exe
File created	C:\Windows\SysWOW64\Ibqnkh32.exe	Hihibbjo.exe
File opened for modification	C:\Windows\SysWOW64\Ffmfchle.exe	Fcniglmb.exe
File created	C:\Windows\SysWOW64\Nhahaiec.exe	Nagpeo32.exe
File opened for modification	C:\Windows\SysWOW64\Poliea32.exe	Plkpcfal.exe
File created	C:\Windows\SysWOW64\Iahici32.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Nlfelogp.exe	Nhkikq32.exe
File created	C:\Windows\SysWOW64\Ilafiihp.exe	Ijcjmmil.exe
File opened for modification	C:\Windows\SysWOW64\Egened32.exe	Ekonpckp.exe
File created	C:\Windows\SysWOW64\Fbbicl32.exe	Fgmdec32.exe
File created	C:\Windows\SysWOW64\Oipoad32.dll	Bmmpfn32.exe
File opened for modification	C:\Windows\SysWOW64\Njfkmphe.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Gijekg32.exe	Ggkiol32.exe
File opened for modification	C:\Windows\SysWOW64\Gdafnpqh.exe	Ggnedlao.exe
File created	C:\Windows\SysWOW64\Mmbheilp.dll	Lgffic32.exe
File opened for modification	C:\Windows\SysWOW64\Iamamcop.exe	Iialhaad.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Ikaggmii.exe	Idgojc32.exe
File opened for modification	C:\Windows\SysWOW64\Mplafeil.exe	Mhdjehhj.exe
File opened for modification	C:\Windows\SysWOW64\Afkknogn.exe	Acmobchj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8760	7332	WerFault.exe	891

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdinljnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkenjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhifomdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmnoab32.dll"	Kelkaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bogcgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhnojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaeaha32.dll"	Lkofdbkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njfkbf32.dll"	Lnbklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Malhfo32.dll"	Qlggjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogakfe32.dll"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbanq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kppici32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecegjob.dll"	Klifnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffeifdjo.dll"	Feenjgfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkdpbpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plgkkjnn.dll"	Hkgnfhnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gehbjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gepmlimi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpobg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqfoamfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Indfca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bombmcec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loighj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfehed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kppici32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hammhcij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efafgifc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhihhecc.dll"	Bohbhmfm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enfqikef.dll"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nimbkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iikmbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cadlbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jppadk32.dll"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbhijepa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmepam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahfmjddg.dll"	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemgplno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phmgghbe.dll"	Hgnoki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihnkel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plkcijka.dll"	Pefhlaie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qlggjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdencf32.dll"	Nmenca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcoobn32.dll"	Ooejohhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pigqjdgo.dll"	Akoqpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqknpl32.dll"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djklmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdbqla32.dll"	Emehdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhbhlgio.dll"	Gaefgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcmeke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeddnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeapfm32.dll"	Aihaoqlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haedpe32.dll"	Hnhghcki.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4028	1016	NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe	86
PID 1016 wrote to memory of 4028	1016	NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe	86
PID 1016 wrote to memory of 4028	1016	NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe	86
PID 4028 wrote to memory of 2784	4028	Cnicfe32.exe	87
PID 4028 wrote to memory of 2784	4028	Cnicfe32.exe	87
PID 4028 wrote to memory of 2784	4028	Cnicfe32.exe	87
PID 2784 wrote to memory of 3404	2784	Ceehho32.exe	88
PID 2784 wrote to memory of 3404	2784	Ceehho32.exe	88
PID 2784 wrote to memory of 3404	2784	Ceehho32.exe	88
PID 3404 wrote to memory of 4988	3404	Cjbpaf32.exe	89
PID 3404 wrote to memory of 4988	3404	Cjbpaf32.exe	89
PID 3404 wrote to memory of 4988	3404	Cjbpaf32.exe	89
PID 4988 wrote to memory of 712	4988	Cegdnopg.exe	90
PID 4988 wrote to memory of 712	4988	Cegdnopg.exe	90
PID 4988 wrote to memory of 712	4988	Cegdnopg.exe	90
PID 712 wrote to memory of 1232	712	Emcbio32.exe	91
PID 712 wrote to memory of 1232	712	Emcbio32.exe	91
PID 712 wrote to memory of 1232	712	Emcbio32.exe	91
PID 1232 wrote to memory of 4764	1232	Edmjfifl.exe	92
PID 1232 wrote to memory of 4764	1232	Edmjfifl.exe	92
PID 1232 wrote to memory of 4764	1232	Edmjfifl.exe	92
PID 4764 wrote to memory of 3764	4764	Eemgplno.exe	93
PID 4764 wrote to memory of 3764	4764	Eemgplno.exe	93
PID 4764 wrote to memory of 3764	4764	Eemgplno.exe	93
PID 3764 wrote to memory of 2524	3764	Eoekia32.exe	94
PID 3764 wrote to memory of 2524	3764	Eoekia32.exe	94
PID 3764 wrote to memory of 2524	3764	Eoekia32.exe	94
PID 2524 wrote to memory of 1748	2524	Fnjhjn32.exe	95
PID 2524 wrote to memory of 1748	2524	Fnjhjn32.exe	95
PID 2524 wrote to memory of 1748	2524	Fnjhjn32.exe	95
PID 1748 wrote to memory of 3560	1748	Fojedapj.exe	96
PID 1748 wrote to memory of 3560	1748	Fojedapj.exe	96
PID 1748 wrote to memory of 3560	1748	Fojedapj.exe	96
PID 3560 wrote to memory of 4624	3560	Fedmqk32.exe	97
PID 3560 wrote to memory of 4624	3560	Fedmqk32.exe	97
PID 3560 wrote to memory of 4624	3560	Fedmqk32.exe	97
PID 4624 wrote to memory of 3296	4624	Fajnfl32.exe	98
PID 4624 wrote to memory of 3296	4624	Fajnfl32.exe	98
PID 4624 wrote to memory of 3296	4624	Fajnfl32.exe	98
PID 3296 wrote to memory of 3900	3296	Fhdfbfdh.exe	99
PID 3296 wrote to memory of 3900	3296	Fhdfbfdh.exe	99
PID 3296 wrote to memory of 3900	3296	Fhdfbfdh.exe	99
PID 3900 wrote to memory of 4248	3900	Fnaokmco.exe	100
PID 3900 wrote to memory of 4248	3900	Fnaokmco.exe	100
PID 3900 wrote to memory of 4248	3900	Fnaokmco.exe	100
PID 4248 wrote to memory of 1812	4248	Fdkggg32.exe	101
PID 4248 wrote to memory of 1812	4248	Fdkggg32.exe	101
PID 4248 wrote to memory of 1812	4248	Fdkggg32.exe	101
PID 1812 wrote to memory of 1992	1812	Foqkdp32.exe	102
PID 1812 wrote to memory of 1992	1812	Foqkdp32.exe	102
PID 1812 wrote to memory of 1992	1812	Foqkdp32.exe	102
PID 1992 wrote to memory of 5116	1992	Gkglja32.exe	103
PID 1992 wrote to memory of 5116	1992	Gkglja32.exe	103
PID 1992 wrote to memory of 5116	1992	Gkglja32.exe	103
PID 5116 wrote to memory of 864	5116	Gdppbfff.exe	104
PID 5116 wrote to memory of 864	5116	Gdppbfff.exe	104
PID 5116 wrote to memory of 864	5116	Gdppbfff.exe	104
PID 864 wrote to memory of 3836	864	Goedpofl.exe	105
PID 864 wrote to memory of 3836	864	Goedpofl.exe	105
PID 864 wrote to memory of 3836	864	Goedpofl.exe	105
PID 3836 wrote to memory of 4616	3836	Gepmlimi.exe	106
PID 3836 wrote to memory of 4616	3836	Gepmlimi.exe	106
PID 3836 wrote to memory of 4616	3836	Gepmlimi.exe	106
PID 4616 wrote to memory of 4276	4616	Gohaeo32.exe	107

C:\Users\Admin\AppData\Local\Temp\NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6dfbbafb1da56c54cb225c894c70c4c0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\Cnicfe32.exe
  C:\Windows\system32\Cnicfe32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\Ceehho32.exe
    C:\Windows\system32\Ceehho32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\SysWOW64\Cjbpaf32.exe
      C:\Windows\system32\Cjbpaf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        23⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        24⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        25⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        26⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        27⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        28⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        29⤵
        Executes dropped EXE
        
        PID:112
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        30⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        31⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        32⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        33⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        34⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        35⤵
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1272
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        37⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        39⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        40⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        41⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        42⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        44⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        45⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        46⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        49⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        51⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        52⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        53⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        55⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        56⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        57⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        58⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        59⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        60⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        61⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        62⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        63⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        66⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        67⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        69⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        70⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        71⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        55⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        56⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        57⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        58⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        59⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        60⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        61⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        62⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        63⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        64⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        65⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        66⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        67⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        68⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        69⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        70⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        71⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        73⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        74⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        75⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        76⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        77⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        78⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        79⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        80⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        81⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        82⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        83⤵
        Drops file in System32 directory
        
        PID:8344

C:\Windows\SysWOW64\Mpghkf32.exe
C:\Windows\system32\Mpghkf32.exe
1⤵
PID:5404
- C:\Windows\SysWOW64\Mfaqhp32.exe
  C:\Windows\system32\Mfaqhp32.exe
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\Mhbmphjm.exe
    C:\Windows\system32\Mhbmphjm.exe
    3⤵
    PID:5504
  - - C:\Windows\SysWOW64\Molelb32.exe
      C:\Windows\system32\Molelb32.exe
      4⤵
      PID:5556
    - - C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        5⤵
        
        PID:5604
      - C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        6⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        8⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        9⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        10⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        11⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        12⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        13⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        16⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        17⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        18⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        19⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        20⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        21⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        22⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        23⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        24⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        25⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        26⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        27⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        29⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        31⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        32⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        33⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        34⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        35⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        36⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        37⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        38⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        39⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        40⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        41⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5832
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        43⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        44⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        45⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        46⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        47⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        48⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        49⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        50⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        51⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        52⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        53⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        54⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        56⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        57⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        58⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        60⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        61⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        63⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        64⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        65⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        66⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        67⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        68⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        69⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        70⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        71⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        72⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        74⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        75⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        76⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        77⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        78⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        79⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        80⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        81⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        82⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        83⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        84⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        85⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        86⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        87⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        88⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        89⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        90⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        91⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        92⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        94⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        95⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        96⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        97⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        98⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        99⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        100⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        101⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        102⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        103⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        104⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        106⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        107⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        108⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        109⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        110⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        111⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        112⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        113⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        114⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        115⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        116⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        117⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        119⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        120⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        121⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        122⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        123⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        124⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        125⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        126⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        127⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        128⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        129⤵
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        130⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        131⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        132⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        133⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        134⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        135⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        136⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        137⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        138⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        139⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        140⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        141⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        142⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        143⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        144⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        145⤵
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        146⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        147⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        148⤵
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        149⤵
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        150⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        151⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        153⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        154⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        155⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        156⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        157⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        159⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        160⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        161⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        162⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        163⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        164⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        165⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        166⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        167⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        168⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        169⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        170⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        171⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        172⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        173⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        174⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        175⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        176⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        177⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        178⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        179⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        180⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        181⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        182⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8660
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        184⤵
        Drops file in System32 directory
        
        PID:8704
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        185⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        186⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        187⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        188⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        189⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        190⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        191⤵
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        192⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        193⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        194⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9180
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        196⤵
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        197⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        198⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        199⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        200⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        201⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        202⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        203⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        204⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        205⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        206⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        207⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        208⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        209⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        210⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        211⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        212⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        214⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        215⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        216⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        217⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        218⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        219⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        220⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        221⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        222⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        223⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        224⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        225⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        226⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4216
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        228⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        229⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        230⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        231⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        232⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        233⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        234⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        236⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        237⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        238⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        239⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        240⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        241⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        242⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        243⤵
        Drops file in System32 directory
        
        PID:9380
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9420
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        245⤵
        Modifies registry class
        
        PID:9468
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        246⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        247⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        248⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        249⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        250⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        251⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        252⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9812
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        254⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        255⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        256⤵
        Modifies registry class
        
        PID:9936
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        257⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        258⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        259⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        260⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        261⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        262⤵
        Modifies registry class
        
        PID:10188
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        264⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        265⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        266⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        267⤵
        Drops file in System32 directory
        
        PID:9416
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        268⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        269⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        270⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        272⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        273⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        274⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        275⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        276⤵
        Modifies registry class
        
        PID:10000
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        277⤵
        Drops file in System32 directory
        
        PID:10052
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        278⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        279⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        281⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        282⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9524
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        284⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        285⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        286⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        287⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        288⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        289⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        290⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        291⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        292⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        293⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        294⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        295⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        296⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        297⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        298⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        299⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        300⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        301⤵
        Modifies registry class
        
        PID:10196
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        302⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        303⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        304⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        305⤵
        Modifies registry class
        
        PID:10144
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        306⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        307⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        308⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        309⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        310⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        311⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        312⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        313⤵
        Drops file in System32 directory
        
        PID:10304
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        314⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        315⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        316⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        317⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        318⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        319⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        320⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        321⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        322⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        323⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        324⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        325⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        326⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        327⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        328⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        329⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11080
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        331⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        332⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        333⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        334⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        335⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        336⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        337⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        338⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        339⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        340⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        341⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        342⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        343⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        344⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        345⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        346⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        347⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        348⤵
        Drops file in System32 directory
        
        PID:11212
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        349⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        350⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10428
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        352⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        353⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        354⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        355⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        356⤵
        Drops file in System32 directory
        
        PID:10976
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        357⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        358⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        359⤵
        Drops file in System32 directory
        
        PID:11244
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        360⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        361⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        362⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        363⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        364⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        365⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        366⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        367⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        368⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        369⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        370⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        371⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        372⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        373⤵
        Modifies registry class
        
        PID:11088
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        374⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10876
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        376⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        377⤵
        Drops file in System32 directory
        
        PID:11352
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11396
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        379⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        380⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        381⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        382⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        383⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        384⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        385⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        386⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        387⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11820
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        389⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        390⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        391⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        392⤵
        Drops file in System32 directory
        
        PID:11984
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        393⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        394⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        395⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        396⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        397⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        398⤵
        Modifies registry class
        
        PID:12248
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        399⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        400⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11388
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        402⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        403⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        404⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        405⤵
        Drops file in System32 directory
        
        PID:11644
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        406⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11764
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        408⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        409⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        410⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        411⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        412⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        413⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        414⤵
        Drops file in System32 directory
        
        PID:12228
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        415⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        416⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        417⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        418⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        419⤵
        Modifies registry class
        
        PID:11692
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        420⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        421⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12012
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        423⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        424⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        425⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        426⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        427⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        428⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        429⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        430⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        431⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12036
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        433⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        434⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12192
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        436⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        437⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        438⤵
        Modifies registry class
        
        PID:12332
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        439⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        440⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        441⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12492
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        443⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        444⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        445⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        446⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        447⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        448⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        449⤵
        Drops file in System32 directory
        
        PID:12760
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        450⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        451⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        452⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        453⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        454⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        455⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        456⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        457⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        458⤵
        Drops file in System32 directory
        
        PID:13180
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        459⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        460⤵
        Modifies registry class
        
        PID:13276
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        461⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        462⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        463⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        464⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        465⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        466⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        467⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        468⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        469⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        470⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        471⤵
        Drops file in System32 directory
        
        PID:12848
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12928
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        473⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13068
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        475⤵
        Modifies registry class
        
        PID:13164
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        476⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        477⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        478⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        479⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        480⤵
        
        PID:12488

C:\Windows\SysWOW64\Gbalopbn.exe
C:\Windows\system32\Gbalopbn.exe
1⤵
PID:12628
- C:\Windows\SysWOW64\Gmfplibd.exe
  C:\Windows\system32\Gmfplibd.exe
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\Gbchdp32.exe
    C:\Windows\system32\Gbchdp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:1360
  - - C:\Windows\SysWOW64\Gimqajgh.exe
      C:\Windows\system32\Gimqajgh.exe
      4⤵
      PID:5076
    - - C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        5⤵
        
        PID:12920
      - C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12988
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        7⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        8⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        9⤵
        Modifies registry class
        
        PID:13232
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        10⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        11⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1836
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        12⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        13⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        14⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        15⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        16⤵
        
        PID:12748

C:\Windows\SysWOW64\Iikmbh32.exe
C:\Windows\system32\Iikmbh32.exe
1⤵
- Modifies registry class
PID:1868
- C:\Windows\SysWOW64\Iinjhh32.exe
  C:\Windows\system32\Iinjhh32.exe
  2⤵
  PID:12972
- - C:\Windows\SysWOW64\Illfdc32.exe
    C:\Windows\system32\Illfdc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2680
  - - C:\Windows\SysWOW64\Iedjmioj.exe
      C:\Windows\system32\Iedjmioj.exe
      4⤵
      PID:13208
    - - C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        5⤵
        
        PID:13272
      - C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        6⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        7⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        8⤵
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        9⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        10⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        11⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        12⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        13⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        14⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        15⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        16⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        17⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        18⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        19⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1192
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        21⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        22⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        23⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        24⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        25⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        26⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        27⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        28⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        29⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        30⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        31⤵
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        32⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        33⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3300
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        35⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        36⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        37⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        38⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        39⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        40⤵
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5096
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        42⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        43⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        44⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        45⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        46⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        47⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        48⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        49⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        50⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5108
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        52⤵
        Drops file in System32 directory
        
        PID:11460
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        53⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        54⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        55⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        56⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        57⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        58⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        59⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        60⤵
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        61⤵
        
        PID:5384

C:\Windows\SysWOW64\Oclkgccf.exe
C:\Windows\system32\Oclkgccf.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4160
- C:\Windows\SysWOW64\Onapdl32.exe
  C:\Windows\system32\Onapdl32.exe
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\Ofmdio32.exe
    C:\Windows\system32\Ofmdio32.exe
    3⤵
    PID:5556
  - - C:\Windows\SysWOW64\Ohlqcagj.exe
      C:\Windows\system32\Ohlqcagj.exe
      4⤵
      PID:2300
    - - C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        5⤵
        
        PID:5808
      - C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        6⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        7⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        8⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        9⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12908
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        11⤵
        Drops file in System32 directory
        
        PID:12868
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        12⤵
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        13⤵
        Drops file in System32 directory
        
        PID:12284
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        14⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        15⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        16⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        17⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        18⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        19⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        20⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        21⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        22⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        23⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        24⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        25⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        26⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        27⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        29⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        30⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        31⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        32⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        33⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        34⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        35⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        36⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        37⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        38⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        39⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        40⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        41⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        42⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2136
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        44⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        45⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        46⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        47⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        48⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        49⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        50⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        51⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        52⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        54⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        55⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        56⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        57⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        58⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        59⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        60⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        61⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        63⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        64⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        65⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        67⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        68⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        69⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        70⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        71⤵
        
        PID:6200

C:\Windows\SysWOW64\Hlkfbocp.exe
C:\Windows\system32\Hlkfbocp.exe
1⤵
PID:6344
- C:\Windows\SysWOW64\Hecjke32.exe
  C:\Windows\system32\Hecjke32.exe
  2⤵
  PID:6748
- - C:\Windows\SysWOW64\Hehdfdek.exe
    C:\Windows\system32\Hehdfdek.exe
    3⤵
    PID:5580
  - - C:\Windows\SysWOW64\Hppeim32.exe
      C:\Windows\system32\Hppeim32.exe
      4⤵
      PID:6028
    - - C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        5⤵
        
        PID:6544
      - C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        6⤵
        Drops file in System32 directory
        
        PID:4712
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        7⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        8⤵
        
        PID:5864

C:\Windows\SysWOW64\Ihpcinld.exe
C:\Windows\system32\Ihpcinld.exe
1⤵
PID:5224
- C:\Windows\SysWOW64\Iialhaad.exe
  C:\Windows\system32\Iialhaad.exe
  2⤵
  - Drops file in System32 directory
  PID:6708
- - C:\Windows\SysWOW64\Iamamcop.exe
    C:\Windows\system32\Iamamcop.exe
    3⤵
    PID:6360
  - - C:\Windows\SysWOW64\Jidinqpb.exe
      C:\Windows\system32\Jidinqpb.exe
      4⤵
      PID:6900
    - - C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        5⤵
        Modifies registry class
        
        PID:5436
      - C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        6⤵
        
        PID:6764

C:\Windows\SysWOW64\Jhkbdmbg.exe
C:\Windows\system32\Jhkbdmbg.exe
1⤵
- Drops file in System32 directory
PID:5696
- C:\Windows\SysWOW64\Jhnojl32.exe
  C:\Windows\system32\Jhnojl32.exe
  2⤵
  - Modifies registry class
  PID:6184
- - C:\Windows\SysWOW64\Jpegkj32.exe
    C:\Windows\system32\Jpegkj32.exe
    3⤵
    PID:5428

C:\Windows\SysWOW64\Kedlip32.exe
C:\Windows\system32\Kedlip32.exe
1⤵
PID:6856
- C:\Windows\SysWOW64\Kolabf32.exe
  C:\Windows\system32\Kolabf32.exe
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\Kamjda32.exe
    C:\Windows\system32\Kamjda32.exe
    3⤵
    PID:8004
  - - C:\Windows\SysWOW64\Klbnajqc.exe
      C:\Windows\system32\Klbnajqc.exe
      4⤵
      PID:6232
    - - C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        5⤵
        
        PID:5320
      - C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        6⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        7⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        8⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        9⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        10⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        11⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        12⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        14⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        15⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4680

C:\Windows\SysWOW64\Abfdpfaj.exe
C:\Windows\system32\Abfdpfaj.exe
1⤵
PID:8120
- C:\Windows\SysWOW64\Amkhmoap.exe
  C:\Windows\system32\Amkhmoap.exe
  2⤵
  PID:6124
- - C:\Windows\SysWOW64\Abhqefpg.exe
    C:\Windows\system32\Abhqefpg.exe
    3⤵
    PID:6632
  - - C:\Windows\SysWOW64\Amnebo32.exe
      C:\Windows\system32\Amnebo32.exe
      4⤵
      PID:8920
    - - C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        5⤵
        Drops file in System32 directory
        
        PID:7824
      - C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        7⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        8⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        9⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        10⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        11⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        12⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        13⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        14⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        15⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        16⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        17⤵
        Drops file in System32 directory
        
        PID:9020
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        18⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        19⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        20⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        21⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        22⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        23⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        24⤵
        
        PID:7364

C:\Windows\SysWOW64\Cgklmacf.exe
C:\Windows\system32\Cgklmacf.exe
1⤵
PID:7684
- C:\Windows\SysWOW64\Cdolgfbp.exe
  C:\Windows\system32\Cdolgfbp.exe
  2⤵
  PID:8252
- - C:\Windows\SysWOW64\Ccdihbgg.exe
    C:\Windows\system32\Ccdihbgg.exe
    3⤵
    PID:8380
  - - C:\Windows\SysWOW64\Dinael32.exe
      C:\Windows\system32\Dinael32.exe
      4⤵
      PID:7772
    - - C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        5⤵
        
        PID:7412
      - C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        6⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        7⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 408
        8⤵
        Program crash
        
        PID:8760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7332 -ip 7332
1⤵
- Modifies registry class
PID:9032

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:11204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaohcj32.exe

Filesize
120KB

MD5
cf3110f5a3effb0a8604a3205f9d4940

SHA1
512a2032c71e5c7b8fa608c0aed6a70dcefe7634

SHA256
44dc28faec2c097e023c73aea25b7ccf06e50d7a5ca275f69c2a5c4e74c6fcc2

SHA512
d20aaa833f118da2cf64ca2a014542cf38ac11ac7c84aa13cdeb3d180aee7eee1681061f95004ba35482cbaf31969edabed3ffb84fddc862a522e0727739e7a3

Download Submit
C:\Windows\SysWOW64\Acmobchj.exe

Filesize
120KB

MD5
edc7c38a5563a3c4f12b6724d92571f4

SHA1
f2322d83cd5cda777f765f76e4c82f1fa2a59ec7

SHA256
0c08fd5df894e115998fd13566ecff74447b7069673255ecd48e9806d40f3850

SHA512
479c1b166430a29b8070bd1f49896da9ba6cd1246c0db37be2883f2fce39d3542ff3a92f5efc54b0a65c8ddcb0ad3ba51727989cac7de9962f62032cf5b3a27c

Download Submit
C:\Windows\SysWOW64\Agdhbi32.exe

Filesize
120KB

MD5
b8f806dc9be1de0054539cee4ad2d993

SHA1
07dfb1f0d0d3f9d475351b35c39e7547b79c7b4f

SHA256
fb9078bd60fd34efa259eaaa844ba8eefa7a397ec0f80e0bf8155d874c83666d

SHA512
c9fdd9e402f056a6abc626ed7ac3ce3565ec867be0c4c6482fd15f031833da5158f63694a3aa0cf42990878c19a3d4872c389193bc5abf3e26c1a62944b8dd05

Download Submit
C:\Windows\SysWOW64\Akhcfe32.exe

Filesize
120KB

MD5
290a0a5698f9de31ce4029276239eba3

SHA1
24b77ca7fd97049e9d35723adea2a6c9baaede8e

SHA256
f6cc7edac2c9981e5d15c65bd5dd75981264397a62e1e9b1c6c30b62bdd68709

SHA512
cccb13a1b95f707b7f8ec79ae4cb748660a0ae6f6ad0377fd20d1fbaa9266b37354d60c9ca983021f435c042e4938c3addf9d6037b8060a030a58d460b7b3242

Download Submit
C:\Windows\SysWOW64\Alkijdci.exe

Filesize
120KB

MD5
10d0c0779aa21196610afed3e02cb82b

SHA1
0304fbd3527726059fabecb581a122eb51254913

SHA256
9c2eff3dba305dd901ee6395307420b8a9d0f3fffd2184fab8ba20127d684e3a

SHA512
8b546c09d821bf22877c05424d96787a7cf0fb5cb746441ff0833d269fe057e449f4a19be955c4643102186f530406feee17103d54b12c5380d614252a1028a5

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
120KB

MD5
270154b59ae1d9fee69ad0c835ee96a5

SHA1
a633c86ef657da5eda4b8df4112a547c0f95e147

SHA256
2d6582ea463b65282e0ea6645de434f4167bf805bd29f84c95763d5727555a6e

SHA512
19bdb9256eb150e6a1c0433f5c96a605c89bc7fa49685044db6a51e1f258217a92c2cfa4ef8311fd74d588e14a380fd4269fff1380581a6f3631eb9992863483

Download Submit
C:\Windows\SysWOW64\Bnmoijje.exe

Filesize
120KB

MD5
ee2dea424af2f0cf8671b733fb9f9286

SHA1
27276d80ace68cd1a7c40e1a6c0a39802c0f1071

SHA256
624a3e9a76fcfd4151be41f2f179dd860fa7a7a0e53aac2c89ec573d099f4e1d

SHA512
66238936d166dd6e912f3ea3426b0e3c859cb992b79c6ad3daec1ae80443386549cd6fc3fa36437c200683620b7077155d4885ba056d55d9864355d16d699def

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
120KB

MD5
dc1ecc6655f4a8acbb3758b2aa006c6a

SHA1
0780a01f9c3420c8f5f138406bcee2641455ec15

SHA256
3b83880cd3ef4900542a5a093f3a4d141078aa55c5d18af3239124cf9efe02e1

SHA512
88dd9ffc096a049686465c764b4da8e72e5690e5582c6d7b412bf24b9c6cc8b25d22882298cd62ad0144eeb4d34c4ff60038e2be88f1139e8132428a9e269d75

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
120KB

MD5
34a1d719e2448b014e9a0031225d4fe2

SHA1
4bf03f0e07914fd13e9a0c567cd1c8fd472c809c

SHA256
fa3280190526ac891fe0d5aa82c5d33ea6b5eee0a3c32d9ed051341cf1a1e9d5

SHA512
a14f2977bb6f2d72fae75315406b30a30ad54422e5ce7c4c04079c43857c0a72e215e7422c90e66c2580f31ebf0f140b154e993966674aff91ca37bde79722e6

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
120KB

MD5
34a1d719e2448b014e9a0031225d4fe2

SHA1
4bf03f0e07914fd13e9a0c567cd1c8fd472c809c

SHA256
fa3280190526ac891fe0d5aa82c5d33ea6b5eee0a3c32d9ed051341cf1a1e9d5

SHA512
a14f2977bb6f2d72fae75315406b30a30ad54422e5ce7c4c04079c43857c0a72e215e7422c90e66c2580f31ebf0f140b154e993966674aff91ca37bde79722e6

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
120KB

MD5
8d88fc938caabc2541236f56d0cc790c

SHA1
283dcbefff8ae3d4c4033fa6f25ca5fcfb800118

SHA256
f8d3182247a97554ba455bca37036b381079a61e475901b2eb665698d84624a2

SHA512
5bdec1adf5f368b71fd96eaaf7ed7d367ded74876f9beed42eb5e38ebe3a42fa6eb23a7bde345a711f7b07e32dc740c38120de3f8c381673ddef5d887b48baf4

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
120KB

MD5
8d88fc938caabc2541236f56d0cc790c

SHA1
283dcbefff8ae3d4c4033fa6f25ca5fcfb800118

SHA256
f8d3182247a97554ba455bca37036b381079a61e475901b2eb665698d84624a2

SHA512
5bdec1adf5f368b71fd96eaaf7ed7d367ded74876f9beed42eb5e38ebe3a42fa6eb23a7bde345a711f7b07e32dc740c38120de3f8c381673ddef5d887b48baf4

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
120KB

MD5
263eeca56fc35e8585eedd326a426036

SHA1
75283d87a8b28ae9e8bb6aabb1bf4523159a3c65

SHA256
aa5a51c50bd2d8dd0995799e58a86ec086c7a2b36b188c9500cb56f192feb8ea

SHA512
62a71c0d674fdd605e07b404462db3257a026260a1c7796cfb44f85c4962a1eb8cf8a04d90b327f526b7abf1655a44683901972f5fa00c8a1051c066aa6371bb

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
120KB

MD5
263eeca56fc35e8585eedd326a426036

SHA1
75283d87a8b28ae9e8bb6aabb1bf4523159a3c65

SHA256
aa5a51c50bd2d8dd0995799e58a86ec086c7a2b36b188c9500cb56f192feb8ea

SHA512
62a71c0d674fdd605e07b404462db3257a026260a1c7796cfb44f85c4962a1eb8cf8a04d90b327f526b7abf1655a44683901972f5fa00c8a1051c066aa6371bb

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
120KB

MD5
ecc038c91a7d8b9b4e95d2e3e16ccbe5

SHA1
39d92e5ab66ba6a7f72807389f77ef67ff866e76

SHA256
41bbc85410b752dd82df4560f2f30403cf00e28388c53bb73aa3724ca80ae7cf

SHA512
79b809247ea736cd3e869ded92f58f4936a5ec10c615718f34f2e7efcd91b19b481b2d1fecef534aee2a74bbe619485f500536f0662883e386b5426408ae1073

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
120KB

MD5
ecc038c91a7d8b9b4e95d2e3e16ccbe5

SHA1
39d92e5ab66ba6a7f72807389f77ef67ff866e76

SHA256
41bbc85410b752dd82df4560f2f30403cf00e28388c53bb73aa3724ca80ae7cf

SHA512
79b809247ea736cd3e869ded92f58f4936a5ec10c615718f34f2e7efcd91b19b481b2d1fecef534aee2a74bbe619485f500536f0662883e386b5426408ae1073

Download Submit
C:\Windows\SysWOW64\Edmjfifl.exe

Filesize
120KB

MD5
511de5d305ae7aa0441c1431cd5e2239

SHA1
e11398886dcac6ca05d3217a8c9defbb8d0c97da

SHA256
2c3cf0e6ce3b0c4ca741d45c400ceb098094906586993322a8161443f09be912

SHA512
933d6f5b402efc951f6101851d604b831ad271769ec538284df6870c5ff023ec92f6f5ad3ea7fb1ad69f19a25bb19030c416e7b72192c1b313acdcdad4efef65

Download Submit
C:\Windows\SysWOW64\Edmjfifl.exe

Filesize
120KB

MD5
511de5d305ae7aa0441c1431cd5e2239

SHA1
e11398886dcac6ca05d3217a8c9defbb8d0c97da

SHA256
2c3cf0e6ce3b0c4ca741d45c400ceb098094906586993322a8161443f09be912

SHA512
933d6f5b402efc951f6101851d604b831ad271769ec538284df6870c5ff023ec92f6f5ad3ea7fb1ad69f19a25bb19030c416e7b72192c1b313acdcdad4efef65

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
120KB

MD5
40fa6eb62ddb6c4b865721d4a645575a

SHA1
6ad56fe44f1bc18ec6368134c2ff875083647edb

SHA256
67f6f46239ac69da471fdbb94fbafcf5caafa68a52cdb8e2cbc9d4e5de99fbd1

SHA512
f9eec54e5d5f0505a71245623bb78234bdf79a2ac09bafc04f397f6256678acfc285e95c36a33e833f1a7c0a4650324f6c1a32f70599946a680bc049d4588886

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
120KB

MD5
40fa6eb62ddb6c4b865721d4a645575a

SHA1
6ad56fe44f1bc18ec6368134c2ff875083647edb

SHA256
67f6f46239ac69da471fdbb94fbafcf5caafa68a52cdb8e2cbc9d4e5de99fbd1

SHA512
f9eec54e5d5f0505a71245623bb78234bdf79a2ac09bafc04f397f6256678acfc285e95c36a33e833f1a7c0a4650324f6c1a32f70599946a680bc049d4588886

Download Submit
C:\Windows\SysWOW64\Eipinkib.exe

Filesize
120KB

MD5
e160051192d3cb32a544e92fb96a030c

SHA1
c051227a38863247b9cde6481fb95bfbb41ac616

SHA256
7309be4c676338ce98a89a6760f2a52b91d5b04b7470d91ba8c7a27a16f35f9b

SHA512
ee6e2eff6a89e997fa32add4bb4a3904fb30f13f9519e1cd81dfb43e03b7626aebab532481a50681ec74b0dc585cfcf9e0efb5ef4111b492403f0b4a0cd474de

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
120KB

MD5
286aec839bb8d313e576692316457ff1

SHA1
e2e72d464e919c9dc0047b9b947ad36aeef8b766

SHA256
433b6ec32aaaa09ce9b2b0767e5c2aeab7851dc9725539ea8d26fe9a65affd8e

SHA512
2c4e10e1cd17a9dc822dadd19513d563ad41fdd034f1df85ffef4237c867734f60aa7e99be0e0aaab3188df66f221cb77a3656eb3828f479ca67498657c497f0

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
120KB

MD5
286aec839bb8d313e576692316457ff1

SHA1
e2e72d464e919c9dc0047b9b947ad36aeef8b766

SHA256
433b6ec32aaaa09ce9b2b0767e5c2aeab7851dc9725539ea8d26fe9a65affd8e

SHA512
2c4e10e1cd17a9dc822dadd19513d563ad41fdd034f1df85ffef4237c867734f60aa7e99be0e0aaab3188df66f221cb77a3656eb3828f479ca67498657c497f0

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
120KB

MD5
4678984188c579bc73fd42432d78de49

SHA1
30d706aa97b6e2bace4b3d7ed0bdf13f3a1578a4

SHA256
8506c944ddf5d39380b0dc1c5b1facd0330fcfc8f8097c74333ec12167558d11

SHA512
5227ae6d05fbb3c9187ba55eac0e71e0f7abf2299ebed2f7ad83526cf02e28b3c9d898e63a520e75c375edebab1514e56ab49564444eb09a1eba38b38de5078e

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
120KB

MD5
4678984188c579bc73fd42432d78de49

SHA1
30d706aa97b6e2bace4b3d7ed0bdf13f3a1578a4

SHA256
8506c944ddf5d39380b0dc1c5b1facd0330fcfc8f8097c74333ec12167558d11

SHA512
5227ae6d05fbb3c9187ba55eac0e71e0f7abf2299ebed2f7ad83526cf02e28b3c9d898e63a520e75c375edebab1514e56ab49564444eb09a1eba38b38de5078e

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
120KB

MD5
2d5276ab2341377c583eb18222328bd9

SHA1
57bfdc414123619aff338daf48cf8723bfc41808

SHA256
af4bf4868241d9f635b489aaf7e2e3330aee297fb6a7d3437e21d852d274f1c0

SHA512
c40491c535b982bbe6768e10163a858a1c6d727f581dc8a9405477662d8dc721f851a25b7275696238f5f38957f0dd7059cf5c083cef36d37d56fdf0343d2711

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
120KB

MD5
2d5276ab2341377c583eb18222328bd9

SHA1
57bfdc414123619aff338daf48cf8723bfc41808

SHA256
af4bf4868241d9f635b489aaf7e2e3330aee297fb6a7d3437e21d852d274f1c0

SHA512
c40491c535b982bbe6768e10163a858a1c6d727f581dc8a9405477662d8dc721f851a25b7275696238f5f38957f0dd7059cf5c083cef36d37d56fdf0343d2711

Download Submit
C:\Windows\SysWOW64\Fdkggg32.exe

Filesize
120KB

MD5
907b542e1bf120d1dd9055f69833ad0f

SHA1
dcd09af9b52f8a2ab012d8f5fbbc7e748cf09e0b

SHA256
50c83e39f5934e5698da59ead90867a388ebb73e3a5719f112c138a5d1bb3079

SHA512
25d4f9ba3bba1bc621581c00d76a189f13e99567af374703edc171cc0711f2ffea429de1b3b92e7e4f73dc50a10c8686dc5eab8d1bb012c5ce1055c04395d88c

Download Submit
C:\Windows\SysWOW64\Fdkggg32.exe

Filesize
120KB

MD5
907b542e1bf120d1dd9055f69833ad0f

SHA1
dcd09af9b52f8a2ab012d8f5fbbc7e748cf09e0b

SHA256
50c83e39f5934e5698da59ead90867a388ebb73e3a5719f112c138a5d1bb3079

SHA512
25d4f9ba3bba1bc621581c00d76a189f13e99567af374703edc171cc0711f2ffea429de1b3b92e7e4f73dc50a10c8686dc5eab8d1bb012c5ce1055c04395d88c

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
120KB

MD5
dd9ca8e996a6aa49aa90aa9fe970fb5e

SHA1
f0d4f481650a4dfe300ffa1058659c8bf3559af2

SHA256
f4d793ef7afe68c520d11fc6b22bc706a81277ddce0e0cc36fc1af74a2ee01de

SHA512
43783c9121a6cfe504ed7c04480d83d669f4a8375b4127bac4cc24f9f723dc68e3be5baa4533d1fb1ec05373cdc181317555d66700698df6e38196acdc13be1d

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
120KB

MD5
dd9ca8e996a6aa49aa90aa9fe970fb5e

SHA1
f0d4f481650a4dfe300ffa1058659c8bf3559af2

SHA256
f4d793ef7afe68c520d11fc6b22bc706a81277ddce0e0cc36fc1af74a2ee01de

SHA512
43783c9121a6cfe504ed7c04480d83d669f4a8375b4127bac4cc24f9f723dc68e3be5baa4533d1fb1ec05373cdc181317555d66700698df6e38196acdc13be1d

Download Submit
C:\Windows\SysWOW64\Fhdfbfdh.exe

Filesize
120KB

MD5
691ed74e90a2bbe179d1d01442eebbbe

SHA1
f4f07f57a995a866ef789af84e322e755d99b73d

SHA256
777e904d4110cdc523e8107300e110f8c14ccb2b61a6acd3fe87f869aa897196

SHA512
3c32b9ab5ffa43cccf3e645a49effa4209f709f19aa45d1d74639236e240225538c718e4d38555c67bfc68c73493ad607cdf35eea27be014157c6ac8d7685c09

Download Submit
C:\Windows\SysWOW64\Fhdfbfdh.exe

Filesize
120KB

MD5
691ed74e90a2bbe179d1d01442eebbbe

SHA1
f4f07f57a995a866ef789af84e322e755d99b73d

SHA256
777e904d4110cdc523e8107300e110f8c14ccb2b61a6acd3fe87f869aa897196

SHA512
3c32b9ab5ffa43cccf3e645a49effa4209f709f19aa45d1d74639236e240225538c718e4d38555c67bfc68c73493ad607cdf35eea27be014157c6ac8d7685c09

Download Submit
C:\Windows\SysWOW64\Fnaokmco.exe

Filesize
120KB

MD5
a2f08a09f659067742c02eb6c2d9f571

SHA1
f1ad0221656f21d3da157e3f7a26567959eeafc0

SHA256
d3b2029500d79e2170fd6081bdc64e4013bbe26fde8b3c8e5ab97cb753f269bd

SHA512
f2ca9621c0ce178e5e5d6a963bd70d80977764f6ab8a86e48c4fe03818e71af296ea5cbc9441ae506df74c46ff5003a95e96523e9a9835bbcdf91afcb3f7511f

Download Submit
C:\Windows\SysWOW64\Fnaokmco.exe

Filesize
120KB

MD5
a2f08a09f659067742c02eb6c2d9f571

SHA1
f1ad0221656f21d3da157e3f7a26567959eeafc0

SHA256
d3b2029500d79e2170fd6081bdc64e4013bbe26fde8b3c8e5ab97cb753f269bd

SHA512
f2ca9621c0ce178e5e5d6a963bd70d80977764f6ab8a86e48c4fe03818e71af296ea5cbc9441ae506df74c46ff5003a95e96523e9a9835bbcdf91afcb3f7511f

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
120KB

MD5
5b38a4cd35575228eefab1feaea93a8c

SHA1
c839b15bf83314dd5cf7d880a68e60cd9cc47ee9

SHA256
1fee92dbffa36ac29ebace38eba9f782c81f612c1a4cfaec656be973f30ba122

SHA512
9f44aaaa6c16f83a93e6977a03e93d2eebf9dbe0beb9557045a1c684a68d2fa4157292652505c1a60055790cf44b562ea7a83c08bcd7612ac518fb501600c25d

Download Submit
C:\Windows\SysWOW64\Fnjhjn32.exe

Filesize
120KB

MD5
2266bf5c8a9f6cdf66f00f95234a21d1

SHA1
e4d5a17c6298b89acc73c3941eaafd34c4c73ef8

SHA256
7fa48e4938261e3d82eb0f3d23bd437a06dc93c8fd827e887a38ee5cb95c1007

SHA512
927637f236221880101e3a28518de183cf3c87758bc6bc237f8c8243f029505881840723bb578f0afeccdc84b45556733e90a778f158f69d08e7e987b14e317d

Download Submit
C:\Windows\SysWOW64\Fnjhjn32.exe

Filesize
120KB

MD5
2266bf5c8a9f6cdf66f00f95234a21d1

SHA1
e4d5a17c6298b89acc73c3941eaafd34c4c73ef8

SHA256
7fa48e4938261e3d82eb0f3d23bd437a06dc93c8fd827e887a38ee5cb95c1007

SHA512
927637f236221880101e3a28518de183cf3c87758bc6bc237f8c8243f029505881840723bb578f0afeccdc84b45556733e90a778f158f69d08e7e987b14e317d

Download Submit
C:\Windows\SysWOW64\Fnjhjn32.exe

Filesize
120KB

MD5
2266bf5c8a9f6cdf66f00f95234a21d1

SHA1
e4d5a17c6298b89acc73c3941eaafd34c4c73ef8

SHA256
7fa48e4938261e3d82eb0f3d23bd437a06dc93c8fd827e887a38ee5cb95c1007

SHA512
927637f236221880101e3a28518de183cf3c87758bc6bc237f8c8243f029505881840723bb578f0afeccdc84b45556733e90a778f158f69d08e7e987b14e317d

Download Submit
C:\Windows\SysWOW64\Fojedapj.exe

Filesize
120KB

MD5
25792c8733cbfc4ba13a057ca1fbf1b7

SHA1
49f3c3f0bdf988ff9abe1634fe710d9d0069910b

SHA256
ec60aece4062fec5ab405320009d0daec1d3dc5a16f33ea84a86da11ff655cbe

SHA512
04ce2335c147b49ee713579ce69670303e33cdb5a33c9f20a2b62422e7074c77984e34263963179b45d72c45c59276752fc26826e07c33605194958cfca50bb4

Download Submit
C:\Windows\SysWOW64\Fojedapj.exe

Filesize
120KB

MD5
25792c8733cbfc4ba13a057ca1fbf1b7

SHA1
49f3c3f0bdf988ff9abe1634fe710d9d0069910b

SHA256
ec60aece4062fec5ab405320009d0daec1d3dc5a16f33ea84a86da11ff655cbe

SHA512
04ce2335c147b49ee713579ce69670303e33cdb5a33c9f20a2b62422e7074c77984e34263963179b45d72c45c59276752fc26826e07c33605194958cfca50bb4

Download Submit
C:\Windows\SysWOW64\Foqkdp32.exe

Filesize
120KB

MD5
cab25992d6196126e4333fc2b3eaf8be

SHA1
5b21588d737f58ef2d1080a3b3a672a7245527ca

SHA256
c71e31efb5e37de5706f85bf6a681b8d59176a327d50df1ddb1e2bc5c0647d5c

SHA512
bb720ee6014140312a346f086d7a06bae9f1fd00942842f5e1fd55b6ba291c8e84068ddfbdd6a08c5277f7e4dce24a7d72580b4c0dff7b19a842516550134ea0

Download Submit
C:\Windows\SysWOW64\Foqkdp32.exe

Filesize
120KB

MD5
cab25992d6196126e4333fc2b3eaf8be

SHA1
5b21588d737f58ef2d1080a3b3a672a7245527ca

SHA256
c71e31efb5e37de5706f85bf6a681b8d59176a327d50df1ddb1e2bc5c0647d5c

SHA512
bb720ee6014140312a346f086d7a06bae9f1fd00942842f5e1fd55b6ba291c8e84068ddfbdd6a08c5277f7e4dce24a7d72580b4c0dff7b19a842516550134ea0

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
120KB

MD5
e5b433bf09924c4b9feb9b22f30adc42

SHA1
4f27212217e810e01fcde00559831f5d1e14f275

SHA256
a13860d4b942ec8fb3210ab26f1c42ecd1cfff03dad10e2d226f8eb35ef379b7

SHA512
5e3bac9f01df6bdf1863a02978c1ea21a6f999a3af12e29a502e8c833e852d8dfed3fdfda0a97cc3ba99f79bd95ee37cd90ec3b05f8e08058c8e859547be214f

Download Submit
C:\Windows\SysWOW64\Gdppbfff.exe

Filesize
120KB

MD5
8cbdd8c4f941c6330735f14ebaab9201

SHA1
218da4d35643afb77fa9a6cc295aef2916cc5adc

SHA256
ae44dffc3292833d507a68601953a862737863ba7e02cad8b823742b1906699b

SHA512
55ae4018ece2e8eaf03123f8210907c104dcc76a67f6a6303881d65cbf1336b078cd40a8d63ed5a802db39c2357990cf054db54a8e637e41723925386383d4b4

Download Submit
C:\Windows\SysWOW64\Gdppbfff.exe

Filesize
120KB

MD5
8cbdd8c4f941c6330735f14ebaab9201

SHA1
218da4d35643afb77fa9a6cc295aef2916cc5adc

SHA256
ae44dffc3292833d507a68601953a862737863ba7e02cad8b823742b1906699b

SHA512
55ae4018ece2e8eaf03123f8210907c104dcc76a67f6a6303881d65cbf1336b078cd40a8d63ed5a802db39c2357990cf054db54a8e637e41723925386383d4b4

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
120KB

MD5
92d7d48876d5671dfd20c7123550b565

SHA1
fca3864eee7ecb0842d5583b7e9d51639932056a

SHA256
47b1f069ac53449b1447f91f75f8489d7082eec6122443bdb4c5a8d93e7f4f1f

SHA512
8d5fad4d00e4d9e96e7f8c1ad1795d58715e1db608ccef03380df2350197ddd06ffde4ab76495affdf7f317d06611ba1f1b58422e3d57c105fd150ef39fd7535

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
120KB

MD5
92d7d48876d5671dfd20c7123550b565

SHA1
fca3864eee7ecb0842d5583b7e9d51639932056a

SHA256
47b1f069ac53449b1447f91f75f8489d7082eec6122443bdb4c5a8d93e7f4f1f

SHA512
8d5fad4d00e4d9e96e7f8c1ad1795d58715e1db608ccef03380df2350197ddd06ffde4ab76495affdf7f317d06611ba1f1b58422e3d57c105fd150ef39fd7535

Download Submit
C:\Windows\SysWOW64\Gfbibikg.exe

Filesize
120KB

MD5
9a7ca72db50d261b57615bd46f17f23c

SHA1
b75f0b4865edcfe23adc187493a58b2119fec1d0

SHA256
f1bd176029f5dc914b8bff83ffb9b9006a9deab18c6ac8c1b2dc20ea9fe48e25

SHA512
a19fd04db57e670c7c5bb7ff1dcdf144ad8975bb49909549029db9e04f2b6f1641bf1bc1b6209915dec6285a19e6c4bc0e4c53ebb5a1cc0db43b93ea6cf2ce7b

Download Submit
C:\Windows\SysWOW64\Gfbibikg.exe

Filesize
120KB

MD5
9a7ca72db50d261b57615bd46f17f23c

SHA1
b75f0b4865edcfe23adc187493a58b2119fec1d0

SHA256
f1bd176029f5dc914b8bff83ffb9b9006a9deab18c6ac8c1b2dc20ea9fe48e25

SHA512
a19fd04db57e670c7c5bb7ff1dcdf144ad8975bb49909549029db9e04f2b6f1641bf1bc1b6209915dec6285a19e6c4bc0e4c53ebb5a1cc0db43b93ea6cf2ce7b

Download Submit
C:\Windows\SysWOW64\Gfdfgiid.exe

Filesize
120KB

MD5
5944539ecd96d20bcc90e5e6bebdbce9

SHA1
82ea73e6a1bac0d8c9f5386804a76285e1333307

SHA256
491e424a8dcec8504f3f5f77227c907fae076ab75ec9f42b0af44d94fd1d3fa0

SHA512
869d2a8d4df6659f2a2c3ec767521345084597e07a7a4f42422305a806424a71f42910518992df8882ac6b76cb3060b469dadca70b3d630d7637508f0e644e1e

Download Submit
C:\Windows\SysWOW64\Gfdfgiid.exe

Filesize
120KB

MD5
5944539ecd96d20bcc90e5e6bebdbce9

SHA1
82ea73e6a1bac0d8c9f5386804a76285e1333307

SHA256
491e424a8dcec8504f3f5f77227c907fae076ab75ec9f42b0af44d94fd1d3fa0

SHA512
869d2a8d4df6659f2a2c3ec767521345084597e07a7a4f42422305a806424a71f42910518992df8882ac6b76cb3060b469dadca70b3d630d7637508f0e644e1e

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
120KB

MD5
64b3a4ebe7b26dfbc29e707553162bee

SHA1
89c5dd598a5694e8e2c123d03b592f4c26a479f4

SHA256
3926f8b986b11fa455794b24a4ef4759bc0be9b31d033530a8157597565ea53b

SHA512
f7d73bc33480f6067e401e9513303c6da53df3ec3a6986facd1b5b3e30bdc7afa1445e2c7c9d5ebb95ec998d5718387f17460a8a5c25005ad0ff5650efca34e4

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
120KB

MD5
64b3a4ebe7b26dfbc29e707553162bee

SHA1
89c5dd598a5694e8e2c123d03b592f4c26a479f4

SHA256
3926f8b986b11fa455794b24a4ef4759bc0be9b31d033530a8157597565ea53b

SHA512
f7d73bc33480f6067e401e9513303c6da53df3ec3a6986facd1b5b3e30bdc7afa1445e2c7c9d5ebb95ec998d5718387f17460a8a5c25005ad0ff5650efca34e4

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
120KB

MD5
f7d5709af4a4ad27de0d65dcc93e0509

SHA1
935bf5f51bcbf6a37c20df5ffde1f4f68aff1925

SHA256
050e5d5811814e75e13fbdc48c68e0cea0a348b6f96e1ea80f9e55b5578221b3

SHA512
4fa93ab1622b5b01a020a1070b2ad40c96cf2ec3f637bc3ebe57c664b6bebc6fad4c030fdfbfd718ccb815847586f3895340471c724997fed20adedab0d72cf5

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
120KB

MD5
f7d5709af4a4ad27de0d65dcc93e0509

SHA1
935bf5f51bcbf6a37c20df5ffde1f4f68aff1925

SHA256
050e5d5811814e75e13fbdc48c68e0cea0a348b6f96e1ea80f9e55b5578221b3

SHA512
4fa93ab1622b5b01a020a1070b2ad40c96cf2ec3f637bc3ebe57c664b6bebc6fad4c030fdfbfd718ccb815847586f3895340471c724997fed20adedab0d72cf5

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
120KB

MD5
4543d011d4d4a421686008aadf2dcb47

SHA1
c0c8e8828cfc20d7dd5344dee2bc297f7abe38eb

SHA256
06c5440e3d4c58a49a2529dc1a59fbe93b012ae9fa0210e70188c019c3c54851

SHA512
dbc8791d8c8c3fafa95f055fdbc9ed5df4d053ec00d2474133aaf4e7892fefab9cacaa1def43bc88001dc5d8f1e404ecac2659c35a52440623d55a38fd0ab279

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
120KB

MD5
4543d011d4d4a421686008aadf2dcb47

SHA1
c0c8e8828cfc20d7dd5344dee2bc297f7abe38eb

SHA256
06c5440e3d4c58a49a2529dc1a59fbe93b012ae9fa0210e70188c019c3c54851

SHA512
dbc8791d8c8c3fafa95f055fdbc9ed5df4d053ec00d2474133aaf4e7892fefab9cacaa1def43bc88001dc5d8f1e404ecac2659c35a52440623d55a38fd0ab279

Download Submit
C:\Windows\SysWOW64\Gohaeo32.exe

Filesize
120KB

MD5
869e6df7868ec157d4feea576b096e44

SHA1
20f9121768eeb3734fff2af318003fc29c83bd28

SHA256
15ea26c2eb6208c383bff3a88654ed3fef6e589761ffa255a1832435180df83a

SHA512
328e3d8f3bf55c78a6852037130fb301dbde73bc0622022f97e02946fb9a4317638ad2191e997cf2d401c5a1aab46036658c63056a784d51cad04110e071c854

Download Submit
C:\Windows\SysWOW64\Gohaeo32.exe

Filesize
120KB

MD5
869e6df7868ec157d4feea576b096e44

SHA1
20f9121768eeb3734fff2af318003fc29c83bd28

SHA256
15ea26c2eb6208c383bff3a88654ed3fef6e589761ffa255a1832435180df83a

SHA512
328e3d8f3bf55c78a6852037130fb301dbde73bc0622022f97e02946fb9a4317638ad2191e997cf2d401c5a1aab46036658c63056a784d51cad04110e071c854

Download Submit
C:\Windows\SysWOW64\Goljqnpd.exe

Filesize
120KB

MD5
33464fd65edf4d4f42796e0db0351048

SHA1
27946169a0d3a62f9108d10dbfc1bb3132776c98

SHA256
6e3f787d26ff63861c5cc1b5eff40715b7928905f0c0c7fd3b486707d41bdca8

SHA512
66b0baf8377bea67fb3cbd8520f68ccbaa99d4e0972a35bc88f7d10252296f0b6254bf39ca50227146ef560ac2bacdf9e2c7eee5a5170c17bfdf22f12e4f5d24

Download Submit
C:\Windows\SysWOW64\Goljqnpd.exe

Filesize
120KB

MD5
33464fd65edf4d4f42796e0db0351048

SHA1
27946169a0d3a62f9108d10dbfc1bb3132776c98

SHA256
6e3f787d26ff63861c5cc1b5eff40715b7928905f0c0c7fd3b486707d41bdca8

SHA512
66b0baf8377bea67fb3cbd8520f68ccbaa99d4e0972a35bc88f7d10252296f0b6254bf39ca50227146ef560ac2bacdf9e2c7eee5a5170c17bfdf22f12e4f5d24

Download Submit
C:\Windows\SysWOW64\Hbmcbime.exe

Filesize
120KB

MD5
eb08a70379d716fbd5092ac38f7959e2

SHA1
869dc4b7d286d57db63f78125c51481b682c7e08

SHA256
4fbf5e652ff8455b83f15735152c2a74f90ace7bbce788dc6b583b76fa46a843

SHA512
50eac0c0607f02acdd8ceb7d770b5aaa1a3cc36b38345af539f6e669f130ff940c28805dc95112098673ee27d941d5fd1b1713f310fcd22da625acba4ed1d205

Download Submit
C:\Windows\SysWOW64\Hbmcbime.exe

Filesize
120KB

MD5
eb08a70379d716fbd5092ac38f7959e2

SHA1
869dc4b7d286d57db63f78125c51481b682c7e08

SHA256
4fbf5e652ff8455b83f15735152c2a74f90ace7bbce788dc6b583b76fa46a843

SHA512
50eac0c0607f02acdd8ceb7d770b5aaa1a3cc36b38345af539f6e669f130ff940c28805dc95112098673ee27d941d5fd1b1713f310fcd22da625acba4ed1d205

Download Submit
C:\Windows\SysWOW64\Hbpphi32.exe

Filesize
120KB

MD5
047d37fb8722c481b55dc63ad7fa6c37

SHA1
7c37c781d70b4d9e3ac17969e5b26242cf5872c4

SHA256
01b2e0877779992cc295fe154e46fc2cfed3026eacdb7f912f6bdbfc2f9c22ce

SHA512
088c1b130957820e2462c37de68b5ff919868d34884d85371ab6a10111e9abd40c6de2a5ce088734b4bc74f7b5b266367b9ef0a2ea0a7acd28f91b9beb740fdd

Download Submit
C:\Windows\SysWOW64\Hbpphi32.exe

Filesize
120KB

MD5
047d37fb8722c481b55dc63ad7fa6c37

SHA1
7c37c781d70b4d9e3ac17969e5b26242cf5872c4

SHA256
01b2e0877779992cc295fe154e46fc2cfed3026eacdb7f912f6bdbfc2f9c22ce

SHA512
088c1b130957820e2462c37de68b5ff919868d34884d85371ab6a10111e9abd40c6de2a5ce088734b4bc74f7b5b266367b9ef0a2ea0a7acd28f91b9beb740fdd

Download Submit
C:\Windows\SysWOW64\Hdbfodfa.exe

Filesize
120KB

MD5
403b300992690ef99103b25b81550d68

SHA1
23bfb3529417208baef10cb143580c9bb59cc893

SHA256
879397c3cdb46e1d21bf1c8a5a44e7881f52f17b9ea336ff6cd83d527655f12c

SHA512
9d82eda7b45af4998591e82ad3f76589efa224aa04cf56297bc9ead942663a39f2449b3132742e1c4aa45ff5fb1e469c1faf2dd30237ef1d2391299153d81f88

Download Submit
C:\Windows\SysWOW64\Hdbfodfa.exe

Filesize
120KB

MD5
403b300992690ef99103b25b81550d68

SHA1
23bfb3529417208baef10cb143580c9bb59cc893

SHA256
879397c3cdb46e1d21bf1c8a5a44e7881f52f17b9ea336ff6cd83d527655f12c

SHA512
9d82eda7b45af4998591e82ad3f76589efa224aa04cf56297bc9ead942663a39f2449b3132742e1c4aa45ff5fb1e469c1faf2dd30237ef1d2391299153d81f88

Download Submit
C:\Windows\SysWOW64\Hgmgqc32.exe

Filesize
120KB

MD5
3decf4e074a14a1d481170d1f12795a5

SHA1
ad114ed5d8ab44739e15ec2b9368d907dc388ca9

SHA256
7e21712e49ca89e5bed8fbf64a4b757e4d28035d622e2324631ff8153ca89cd0

SHA512
c60469bef50546e58fc7b9810b8f16a229df8ecd18209820cc95d2837ca138383bae0f07bec1415a5603742881a57060444d5a07cddfd72eadc173c54f6f3956

Download Submit
C:\Windows\SysWOW64\Hheoid32.exe

Filesize
120KB

MD5
bb97db151cc993cf0cfc9088ea0fa681

SHA1
7e3695ecf89df34ae2781566453b741b770dcdfe

SHA256
ebf5da1f2bbba275547511b09017a0ba2e6234b535151da64d07484c0c08e249

SHA512
bfe950a4034dcc20572ce3770c3e15bb4800dd056da5a4081be9475b75502547b4308e0b9c89c68ce601701f7076d5b15a8ca5bb195d31fe02551695b374fc40

Download Submit
C:\Windows\SysWOW64\Hheoid32.exe

Filesize
120KB

MD5
bb97db151cc993cf0cfc9088ea0fa681

SHA1
7e3695ecf89df34ae2781566453b741b770dcdfe

SHA256
ebf5da1f2bbba275547511b09017a0ba2e6234b535151da64d07484c0c08e249

SHA512
bfe950a4034dcc20572ce3770c3e15bb4800dd056da5a4081be9475b75502547b4308e0b9c89c68ce601701f7076d5b15a8ca5bb195d31fe02551695b374fc40

Download Submit
C:\Windows\SysWOW64\Hhgloc32.exe

Filesize
120KB

MD5
59d5fbb3fe93a74786a0231ea23de8dc

SHA1
fc588eead2eb30f8543da67d3787823d3b837b00

SHA256
b2760a5e45a3b3825a28095989f5a8628a007ff1363006d91d2093ecdd5bc423

SHA512
3d65b202e0170a35ad65501c2958022ba0666dcbfafdc2ecf93dfd029387e81c29f2d0a19d6e549cc65d111bc91d348e783ca635d7678cfc91c5fd07c95ac840

Download Submit
C:\Windows\SysWOW64\Hhgloc32.exe

Filesize
120KB

MD5
59d5fbb3fe93a74786a0231ea23de8dc

SHA1
fc588eead2eb30f8543da67d3787823d3b837b00

SHA256
b2760a5e45a3b3825a28095989f5a8628a007ff1363006d91d2093ecdd5bc423

SHA512
3d65b202e0170a35ad65501c2958022ba0666dcbfafdc2ecf93dfd029387e81c29f2d0a19d6e549cc65d111bc91d348e783ca635d7678cfc91c5fd07c95ac840

Download Submit
C:\Windows\SysWOW64\Hhihdcbp.exe

Filesize
120KB

MD5
fec20326ba33252debfd0ee6f01474fe

SHA1
fa0c8608b8e62128284c04665eedb15ccf608418

SHA256
4bf19b308eb01f3b07ee9de4acdd8f91fb100d3fbb358b19756d8ea415ab5468

SHA512
734859c637901515587053fb07829514c4a8ff25fa23b389ea880e91ec9e1536d4aae502842875e553fb25ce36c80ab53dc5dd9f8f95dd176d348128dc34b1dc

Download Submit
C:\Windows\SysWOW64\Hhihdcbp.exe

Filesize
120KB

MD5
fec20326ba33252debfd0ee6f01474fe

SHA1
fa0c8608b8e62128284c04665eedb15ccf608418

SHA256
4bf19b308eb01f3b07ee9de4acdd8f91fb100d3fbb358b19756d8ea415ab5468

SHA512
734859c637901515587053fb07829514c4a8ff25fa23b389ea880e91ec9e1536d4aae502842875e553fb25ce36c80ab53dc5dd9f8f95dd176d348128dc34b1dc

Download Submit
C:\Windows\SysWOW64\Hkjafn32.exe

Filesize
120KB

MD5
5bb162b50e1393597e183794bced6671

SHA1
481fa6ef079af81d4616bbbc749aef2d5602fc57

SHA256
3349e7242e4ff1e7778f01117bf2d6f855662a1e3e1bce79a88083537b418cd8

SHA512
346fce53a3dd05d898e9f3a288e15bc8faaafcb1ea159cc536b107d6567cdf248d38901dee6fff742ff8af0aa8a0325dbb9ab1d4b896dd3c4ad6b3f898de8f86

Download Submit
C:\Windows\SysWOW64\Hkjafn32.exe

Filesize
120KB

MD5
5bb162b50e1393597e183794bced6671

SHA1
481fa6ef079af81d4616bbbc749aef2d5602fc57

SHA256
3349e7242e4ff1e7778f01117bf2d6f855662a1e3e1bce79a88083537b418cd8

SHA512
346fce53a3dd05d898e9f3a288e15bc8faaafcb1ea159cc536b107d6567cdf248d38901dee6fff742ff8af0aa8a0325dbb9ab1d4b896dd3c4ad6b3f898de8f86

Download Submit
C:\Windows\SysWOW64\Ifgldfio.exe

Filesize
120KB

MD5
1741047f8b4ce34156d43a61e2159f3a

SHA1
e6ba7f8ebd7053b3be1f546b6a389d57691977fb

SHA256
95dfcfc227e61ce0e6345a77023b88c5ac1c425c9dcd7387b6bdf02deda9f235

SHA512
18477d51833504a82af2209122835df2e713cd0523bce5971f8fff1f03cbede404eb63ca2c6c8aea5c67e5e6813bf0b2dc905f51046ed37869279583f82847b9

Download Submit
C:\Windows\SysWOW64\Ihgnkkbd.exe

Filesize
120KB

MD5
0f796b94b5c67be23c601347c4631126

SHA1
637e6012179113544940134bb720d8207b3a74e5

SHA256
4e87e4b19a5ccf382ede45ed114f0b9cc292a35bff4b625b64b7d540c31e05dc

SHA512
82304c4f76610909487331c7c1e5b66d0da08ef2af34483454349fdba01cdd77aca38fa9fb3a29322b1c3bc53e2a4eec5231d2a8cbffd7910cda81f1075a73a3

Download Submit
C:\Windows\SysWOW64\Injcmc32.exe

Filesize
120KB

MD5
7b53558bfe0d9378872007ca4bd18973

SHA1
66a5993c0d8d893702160e7a20d6ff839fc4f891

SHA256
b419893d392ed414fd28fc96c1e87b40ba3a9e9bcab1e0ffb2955469b17c3428

SHA512
60d8f4bbdcaf74a33c6d4947c079352800f83f4d6f24eb3d3ae641c69b93794f1bbf88c1962232d9276ae0456961cccbb8eb572d085193eef4eab8bc438eaf2d

Download Submit
C:\Windows\SysWOW64\Jlmfeg32.exe

Filesize
120KB

MD5
a0b40ca8a12dd42fb9f6a5f08318911d

SHA1
2b036179fe5b14fe2fa04404e79103fe10dc48b1

SHA256
6350027259efb6dbf26ccb1b87462d519fd6d3ad895448af3246dcb002894eb9

SHA512
b875ed1b85c2d94db519e401ba942c01810944da1598ca3986e79614ed2e020f73afedeb150ce39d0d35eadf4e728ab2f96723be556bef60a59f534d0dcbfbba

Download Submit
C:\Windows\SysWOW64\Kmfhkf32.exe

Filesize
120KB

MD5
40c9f0d31d094d64452b0c308612d548

SHA1
7652315cf41a489434fa189581739d609caa613c

SHA256
5dfdb84be4f33113f67e25810635e5a675a547415d1a03c6ed92f5124d638082

SHA512
1a75ef38c79a67b06f719e2b62c9ef2bbf6faf79e0f5c6b287fc56df4c5d4e79c2ec6412ec71c55f3e880f79fc13dc02c73806de774965a3c4616b0137133c27

Download Submit
C:\Windows\SysWOW64\Mjkblhfo.exe

Filesize
120KB

MD5
c3518c09b9af6289a3155518d8d634c0

SHA1
a38f8a6aa816dc5d8fce73941da7324faa1b3652

SHA256
a889feebd80189e3e6d3d356c3ec036616b5664d260c4332b23607f0769ab279

SHA512
2e0cf4ae4d4e1141f1574e4612144f66b1a7da624f69832665990f9bdb472ad184a8c111de65260572a81b3dcfca42810e61b22156c6e45d35f0760a5e4dbb36

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
120KB

MD5
e135dc3a740af5aa7d93828b66ad5aa5

SHA1
e19f20cd1f29b1d9d53af6f3a97bc8fbd36f807b

SHA256
fd02654b165b94e058568903021cac5adc945ca3d2245db17199f620996e2280

SHA512
6b7215741e4e1164a0748d6b826c4543e9f5b57fc203c4f9fed855f1ae4a5c6ec6bb5832a79cb9fa75c07a04b411e709b388d0d94f31e6ebdad27714473f90af

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
120KB

MD5
7837e27052599606b0f1328a9aaa6009

SHA1
ec11852f867319eed5f549e2e6a30d755336e3b2

SHA256
8b23a2186da2147d527b0b3e7e7e79d7cc5732130fc4e06007ea42e9d90fccc4

SHA512
82a318635a9f970adbc93c95c87d921ea20d03ab9c7ea229663388f1b05f58c384e273f57a2314e66acb3854b5683ec1dfe7a769101ffa0c9af958f4e08ac01e

Download Submit
C:\Windows\SysWOW64\Oeaoab32.exe

Filesize
120KB

MD5
2b58054b196d4a662507b609aaa97f79

SHA1
76631111c3cee4152b4540892bd8b3c417ca9d54

SHA256
2be37db6e5b88b8b34a9a7787d4967d637f4c488487390324ff7a05b1208047b

SHA512
d3cea70f0cf3f7217caff152e2f3e664a87603189cd843b5d4598a3e99d0d90c0b7e4c50fda7398b56488e133732e5487984c20ea2e98c368566b287666a9d49

Download Submit
C:\Windows\SysWOW64\Oigllh32.exe

Filesize
120KB

MD5
53d5ece7f6fcf4d7be42a1981b965e0f

SHA1
bef5304be8c5175788eb0a3f626ff71d70498146

SHA256
ad458b770d5d94afbb3bda93f23a1f72c767aa84de1429549d21d71321c796ce

SHA512
f4ff7e24c1c644f94c5238090afe779dc0d940af66a86c04371b0060bc275b91aafe12f19e0e15a010d0d0326eff0182ca48a9ecb14f2845c345d7c74a179647

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
120KB

MD5
866c687009ad57ca2568044db4f47398

SHA1
e69a1732942852e67a6307a209997beed3c58612

SHA256
526d9b905b0f68860c1d1594ca533d2c67aa66c67799719335fcb12426483b6e

SHA512
9c8203b2d6194ae84ed264550db15280290f43c6e9fd40950d267be12417a1f885de87348cd68aa385c6d66cc5fdb288749b30893e8992489dc3781b6e1153f3

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
120KB

MD5
321e1f7877790c9ffdfda1db495c52a0

SHA1
0d6790dd9ea97d02b1b8f097cd5fe19652fd3529

SHA256
1f3fa97dec3427638a80df14172db4d737bda82c034fd65ce155db35fcc6507a

SHA512
313e5c27e018061b1ccbe03ca611e3b8dfb1415e75dca221261199d87127693e1a0501b66d104818d178f84ae9fb7a9708fc38a5759ad68883f2a1fcda0196ee

Download Submit
C:\Windows\SysWOW64\Pehngkcg.exe

Filesize
120KB

MD5
1afa70f8df5893fdaca28732a690b85e

SHA1
7296360a7e657d61457be22fcb1e637e8549a50d

SHA256
faf7115e9b6a15c43d6f72d42d39e7d35bcdb57ba91d59dbe98b7bde4c4a554e

SHA512
9f46ee1d7a2af8d07d658ddb00579c24130ac0f915e53c0444a318503cc1b3bf33cd9dc11791a118b6a61f4fabc4b9fc519713554cab327b160ebaa2e4afb8bf

Download Submit
C:\Windows\SysWOW64\Qfbobf32.exe

Filesize
120KB

MD5
80f8ed6ab1552997c7a4954cf9ea75bb

SHA1
c094b1e69d89c972f1c3846e4123ba2ff816d1a3

SHA256
99491c9c05c65dd60cb5a1d8e11f52dbadae60cdd8f90fdea0ed4f0a2e8b0bbb

SHA512
aa864815049c71a21d46935c4c3468ad67348875b4cccae768ec4424d557e9b3288340d3f7d201454f543bc23b34a97570760054043560008e42aa55a2aa6adc

Download Submit
C:\Windows\SysWOW64\Qhkdof32.exe

Filesize
120KB

MD5
54f3651c279b1ac7e1e01fbb4df7d920

SHA1
0ad5b0a7d326ab0b6ef23285e4e62fe67971359b

SHA256
8d823bf134648928576d7f6394c42e080d57dc9becfafba81b4a125a8992a1c3

SHA512
a570e0c6060d96835d16533843ac494a0001e5a7a5c47bb5bdfc640c1e97a632a9660b02888c79b40160afde1728ca661cf6040c91858a2d53bc01fa5efc55da

Download Submit
C:\Windows\SysWOW64\Qlggjk32.exe

Filesize
120KB

MD5
99bc34dc2522ceec34316d870aba218c

SHA1
f466dfeed8384f2af982231564afbdf390593057

SHA256
f2cca972c67e0227553da2c66247e86d773fd4db4646f6b530232e9ff7a8a67d

SHA512
77d3ac5e548acfbabf20cae51d7692ac3a6f670defb574784d2d024c3153a2487dd489ad9a994ff3476247408178c3a3af22ad24d1976e3fae7394d62177121b

Download Submit
C:\Windows\SysWOW64\Qohpkf32.exe

Filesize
120KB

MD5
880ec67ac50756c6bdcc789afdebf8db

SHA1
dc9ea57bb4067f9ca9d0d2b18ddfc11171642c47

SHA256
9610b779c08cb67da05012160040c15579179e1a4657d75ee998abb604d644ef

SHA512
53e5997249990c7791c34bdac0ee2ecb81b18ba19034129a92d578a16ae9a2facd87de170bd0c59bf135f532caf4e335d9f4b39e32fbf8714e8de7cadf5f1e99

Download Submit
memory/112-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/864-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1132-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1272-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1588-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1748-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1812-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2664-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2784-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3296-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3356-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3416-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3560-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3716-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3764-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3788-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3836-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3876-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3900-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4028-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4108-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4204-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4276-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4764-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5096-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads