42f589d7b5b785d07fa8a40f87de60c00eb06c6ab5df89c1e93c536cf8dccfcf

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1dd719624873f307a1da3c60f08262b0.exe
Size

366KB
MD5

1dd719624873f307a1da3c60f08262b0
SHA1

be26b9e0bd95ec7b2c4bb86f5d69d746c13f4e0b
SHA256

42f589d7b5b785d07fa8a40f87de60c00eb06c6ab5df89c1e93c536cf8dccfcf
SHA512

581409a278e2b5d852fd7f2a2b5f0a473ae0d6d7aec03fd14881aa5dc1545fa988c25c4381d0ab5bd5202d836cc8aae7770d86e40e59cb37f0b8eca9926a08f1
SSDEEP

6144:5dg4CfkqjwszeXmD6hUUZ4lef4Ek3u9zZawF6:5afPjTAUy4lef4Ek3u9zZawF6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmikb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnaffdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idahjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcmmhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khonkogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ainnhdbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cihjeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfoamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deidjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okqbac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fijkdmhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bllbaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phkmoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okcogc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fongpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlopc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fefcgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkkmaalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icgbob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcnpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbnbhfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjkcqdje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkjbgooi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbbnpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehhpge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbegakcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mekdffee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmfodn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddcogo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfefdpfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ciaddaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddkpoelb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piepnfnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icefib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eihcln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nipffmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhlgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pblolb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqofippg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iandjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eljknl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccipelcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiaoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiqomj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogoncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiagi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdddhlbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnmoglij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oecnmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnblm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ciogobcm.exe

Executes dropped EXE 64 IoCs

pid	Process
2508	Eiaoid32.exe
388	Fcniglmb.exe
4820	Fjjnifbl.exe
2220	Fipkjb32.exe
3604	Fdglmkeg.exe
316	Gjdaodja.exe
4060	Gpcfmkff.exe
3528	Gkhkjd32.exe
1460	Gphphj32.exe
1424	Hbhijepa.exe
456	Hdhedh32.exe
3408	Hlegnjbm.exe
5000	Hkicaahi.exe
4800	Idahjg32.exe
1016	Iciaqc32.exe
4624	Idkkpf32.exe
4412	Jcphab32.exe
4076	Jdodkebj.exe
228	Jgpmmp32.exe
4368	Jqhafffk.exe
4848	Jcikgacl.exe
2592	Kdkdgchl.exe
2164	Kcpahpmd.exe
4564	Kmieae32.exe
4088	Kkjeomld.exe
572	Lklbdm32.exe
3924	Ljaoeini.exe
960	Lgepom32.exe
3548	Lggldm32.exe
3132	Lmdemd32.exe
4584	Mcqjon32.exe
1068	Mkjnfkma.exe
3032	Mcecjmkl.exe
3980	Mmnhcb32.exe
4116	Mjahlgpf.exe
3140	Mkadfj32.exe
8	Manmoq32.exe
1832	Njfagf32.exe
3288	Ncofplba.exe
5056	Nhmofj32.exe
2904	Nlmdbh32.exe
4220	Odhifjkg.exe
2376	Onnmdcjm.exe
3184	Odjeljhd.exe
4552	Olanmgig.exe
4168	Odmbaj32.exe
2320	Omegjomb.exe
2524	Odoogi32.exe
1624	Oacoqnci.exe
1232	Pddhbipj.exe
452	Pahilmoc.exe
4880	Poliea32.exe
2044	Pdhbmh32.exe
3320	Ponfka32.exe
4632	Plbfdekd.exe
2308	Pmcclm32.exe
2016	Pocpfphe.exe
3412	Qhkdof32.exe
3180	Qachgk32.exe
2380	Qklmpalf.exe
4924	Amjillkj.exe
3532	Alkijdci.exe
3768	Adfnofpd.exe
1116	Akqfkp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cfbhhfbg.exe	Cnlpgibd.exe
File opened for modification	C:\Windows\SysWOW64\Dhbqalle.exe	Decdeama.exe
File opened for modification	C:\Windows\SysWOW64\Kggjghkd.exe	Kanbjn32.exe
File created	C:\Windows\SysWOW64\Plbeef32.dll	Fmejlcoj.exe
File opened for modification	C:\Windows\SysWOW64\Nocphd32.exe	Mhihkjfj.exe
File created	C:\Windows\SysWOW64\Ifjgobkn.dll	Mciokcgg.exe
File created	C:\Windows\SysWOW64\Lnjgfb32.exe	Lpfgmnfp.exe
File created	C:\Windows\SysWOW64\Nqaiecjd.exe	Llcghg32.exe
File opened for modification	C:\Windows\SysWOW64\Oqbagd32.exe	Onceji32.exe
File created	C:\Windows\SysWOW64\Jenmcggo.exe	Jiglnf32.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Mjlobkie.dll	Eljknl32.exe
File opened for modification	C:\Windows\SysWOW64\Olpjii32.exe	Oianmm32.exe
File created	C:\Windows\SysWOW64\Jfdnfdoa.dll	Nhmofj32.exe
File created	C:\Windows\SysWOW64\Npdopj32.dll	Igdgglfl.exe
File created	C:\Windows\SysWOW64\Pjnbdofa.dll	Dabhomea.exe
File opened for modification	C:\Windows\SysWOW64\Ckclfp32.exe	Cjcolm32.exe
File created	C:\Windows\SysWOW64\Aaocfebe.dll	Enfjdh32.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqcmjo.exe	Mgidgakk.exe
File created	C:\Windows\SysWOW64\Cmmbgpmq.dll	Okcmingd.exe
File created	C:\Windows\SysWOW64\Bflagg32.exe	Bpomem32.exe
File created	C:\Windows\SysWOW64\Kpilekqj.exe	Kmkpipaf.exe
File created	C:\Windows\SysWOW64\Eaenkj32.exe	Engaon32.exe
File created	C:\Windows\SysWOW64\Jjemle32.exe	Jggapj32.exe
File opened for modification	C:\Windows\SysWOW64\Bgodjiio.exe	Bdphnmjk.exe
File opened for modification	C:\Windows\SysWOW64\Ifnbph32.exe	Icpecm32.exe
File created	C:\Windows\SysWOW64\Jgfajp32.dll	Icpecm32.exe
File created	C:\Windows\SysWOW64\Bfgkjnai.dll	Nieoal32.exe
File created	C:\Windows\SysWOW64\Bbappaql.dll	Eelpqi32.exe
File opened for modification	C:\Windows\SysWOW64\Eijigg32.exe	Eacaej32.exe
File opened for modification	C:\Windows\SysWOW64\Dgliapic.exe	Ddnmeejo.exe
File opened for modification	C:\Windows\SysWOW64\Cmpjoloh.exe	Bkmeha32.exe
File opened for modification	C:\Windows\SysWOW64\Bkhjpn32.exe	Bflagg32.exe
File opened for modification	C:\Windows\SysWOW64\Jnfjbj32.exe	Jglaepim.exe
File created	C:\Windows\SysWOW64\Jikjmbmb.exe	Jflnafno.exe
File created	C:\Windows\SysWOW64\Fmejlcoj.exe	Fhhaclqc.exe
File created	C:\Windows\SysWOW64\Abnnnjfh.exe	Appaangd.exe
File created	C:\Windows\SysWOW64\Gkhkjd32.exe	Gpcfmkff.exe
File created	C:\Windows\SysWOW64\Iinjhh32.exe	Hemdlj32.exe
File opened for modification	C:\Windows\SysWOW64\Oacmchcl.exe	Jaddpppa.exe
File opened for modification	C:\Windows\SysWOW64\Kffhakjp.exe	Kfdklllb.exe
File created	C:\Windows\SysWOW64\Iqdfmajd.exe	Ihmnldib.exe
File created	C:\Windows\SysWOW64\Oleojm32.dll	Fbggkl32.exe
File opened for modification	C:\Windows\SysWOW64\Bedgjgkg.exe	Bllbaa32.exe
File created	C:\Windows\SysWOW64\Kgffoo32.dll	Ickglm32.exe
File created	C:\Windows\SysWOW64\Bfjllnnm.exe	Bmagch32.exe
File created	C:\Windows\SysWOW64\Ddegbipa.dll	Icnphd32.exe
File created	C:\Windows\SysWOW64\Ifihdi32.exe	Icklhnop.exe
File created	C:\Windows\SysWOW64\Kdinpc32.dll	Jcpojk32.exe
File opened for modification	C:\Windows\SysWOW64\Kdpfbp32.exe	Kobnji32.exe
File created	C:\Windows\SysWOW64\Akljinhl.dll	Pnmhqh32.exe
File created	C:\Windows\SysWOW64\Dkodcb32.dll	Mjlhgaqp.exe
File opened for modification	C:\Windows\SysWOW64\Oabhfg32.exe	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Deqqek32.exe	Dnghhqdk.exe
File created	C:\Windows\SysWOW64\Dafhdj32.dll	Pgkegn32.exe
File opened for modification	C:\Windows\SysWOW64\Bdphnmjk.exe	Bbbkbbkg.exe
File opened for modification	C:\Windows\SysWOW64\Jcikgacl.exe	Jqhafffk.exe
File created	C:\Windows\SysWOW64\Ddnmeejo.exe	Dkehlo32.exe
File created	C:\Windows\SysWOW64\Gncchb32.exe	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Poknopjk.dll	Iqdfmajd.exe
File created	C:\Windows\SysWOW64\Kijhgmeo.dll	Ofdhlh32.exe
File opened for modification	C:\Windows\SysWOW64\Gkhkjd32.exe	Gpcfmkff.exe
File created	C:\Windows\SysWOW64\Ffqhcq32.exe	Fpgpgfmh.exe
File opened for modification	C:\Windows\SysWOW64\Ogljcokf.exe	Oqbagd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6500	11064	WerFault.exe	1028

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhjcpmd.dll"	Ijmapm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkpeom32.dll"	Mdddhlbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcelel32.dll"	Okcogc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhleefhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnnklg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckcbaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opdiobod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coohhlpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpilekqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpbmfghh.dll"	Minipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pafcofcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjdaodja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dabhomea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgmfel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafhdj32.dll"	Pgkegn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aghdco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqichhmn.dll"	Poliea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijjekn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anepki32.dll"	Nkncno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeioiboe.dll"	Aghdco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfopcgpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nglala32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filhkmch.dll"	Jakchf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgoigcip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcidg32.dll"	Dkehlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oemofpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjoenl32.dll"	Pbapom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajlfmg32.dll"	Oendaipn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ablahjhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcdjbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjehnm32.dll"	Pplobcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgekdq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmkfoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piepnfnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	NEAS.1dd719624873f307a1da3c60f08262b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpcfmkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecanojgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oalpigkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacboi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efpomccg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doqbifpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkngglh.dll"	Dhcfleff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bindmcbj.dll"	Hfhqkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naamaled.dll"	Ogjmnomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmbaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bflaeggi.dll"	Donecfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipihkobl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fempbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gphphj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfidbo32.dll"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pplobcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhlgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqmggi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbjhph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbgdjmhm.dll"	Imbaobmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2508	1568	NEAS.1dd719624873f307a1da3c60f08262b0.exe	93
PID 1568 wrote to memory of 2508	1568	NEAS.1dd719624873f307a1da3c60f08262b0.exe	93
PID 1568 wrote to memory of 2508	1568	NEAS.1dd719624873f307a1da3c60f08262b0.exe	93
PID 2508 wrote to memory of 388	2508	Eiaoid32.exe	94
PID 2508 wrote to memory of 388	2508	Eiaoid32.exe	94
PID 2508 wrote to memory of 388	2508	Eiaoid32.exe	94
PID 388 wrote to memory of 4820	388	Fcniglmb.exe	95
PID 388 wrote to memory of 4820	388	Fcniglmb.exe	95
PID 388 wrote to memory of 4820	388	Fcniglmb.exe	95
PID 4820 wrote to memory of 2220	4820	Fjjnifbl.exe	96
PID 4820 wrote to memory of 2220	4820	Fjjnifbl.exe	96
PID 4820 wrote to memory of 2220	4820	Fjjnifbl.exe	96
PID 2220 wrote to memory of 3604	2220	Fipkjb32.exe	97
PID 2220 wrote to memory of 3604	2220	Fipkjb32.exe	97
PID 2220 wrote to memory of 3604	2220	Fipkjb32.exe	97
PID 3604 wrote to memory of 316	3604	Fdglmkeg.exe	98
PID 3604 wrote to memory of 316	3604	Fdglmkeg.exe	98
PID 3604 wrote to memory of 316	3604	Fdglmkeg.exe	98
PID 316 wrote to memory of 4060	316	Gjdaodja.exe	99
PID 316 wrote to memory of 4060	316	Gjdaodja.exe	99
PID 316 wrote to memory of 4060	316	Gjdaodja.exe	99
PID 4060 wrote to memory of 3528	4060	Gpcfmkff.exe	100
PID 4060 wrote to memory of 3528	4060	Gpcfmkff.exe	100
PID 4060 wrote to memory of 3528	4060	Gpcfmkff.exe	100
PID 3528 wrote to memory of 1460	3528	Gkhkjd32.exe	101
PID 3528 wrote to memory of 1460	3528	Gkhkjd32.exe	101
PID 3528 wrote to memory of 1460	3528	Gkhkjd32.exe	101
PID 1460 wrote to memory of 1424	1460	Gphphj32.exe	102
PID 1460 wrote to memory of 1424	1460	Gphphj32.exe	102
PID 1460 wrote to memory of 1424	1460	Gphphj32.exe	102
PID 1424 wrote to memory of 456	1424	Hbhijepa.exe	103
PID 1424 wrote to memory of 456	1424	Hbhijepa.exe	103
PID 1424 wrote to memory of 456	1424	Hbhijepa.exe	103
PID 456 wrote to memory of 3408	456	Hdhedh32.exe	104
PID 456 wrote to memory of 3408	456	Hdhedh32.exe	104
PID 456 wrote to memory of 3408	456	Hdhedh32.exe	104
PID 3408 wrote to memory of 5000	3408	Hlegnjbm.exe	105
PID 3408 wrote to memory of 5000	3408	Hlegnjbm.exe	105
PID 3408 wrote to memory of 5000	3408	Hlegnjbm.exe	105
PID 5000 wrote to memory of 4800	5000	Hkicaahi.exe	107
PID 5000 wrote to memory of 4800	5000	Hkicaahi.exe	107
PID 5000 wrote to memory of 4800	5000	Hkicaahi.exe	107
PID 4800 wrote to memory of 1016	4800	Idahjg32.exe	108
PID 4800 wrote to memory of 1016	4800	Idahjg32.exe	108
PID 4800 wrote to memory of 1016	4800	Idahjg32.exe	108
PID 1016 wrote to memory of 4624	1016	Iciaqc32.exe	109
PID 1016 wrote to memory of 4624	1016	Iciaqc32.exe	109
PID 1016 wrote to memory of 4624	1016	Iciaqc32.exe	109
PID 4624 wrote to memory of 4412	4624	Idkkpf32.exe	110
PID 4624 wrote to memory of 4412	4624	Idkkpf32.exe	110
PID 4624 wrote to memory of 4412	4624	Idkkpf32.exe	110
PID 4412 wrote to memory of 4076	4412	Jcphab32.exe	111
PID 4412 wrote to memory of 4076	4412	Jcphab32.exe	111
PID 4412 wrote to memory of 4076	4412	Jcphab32.exe	111
PID 4076 wrote to memory of 228	4076	Jdodkebj.exe	112
PID 4076 wrote to memory of 228	4076	Jdodkebj.exe	112
PID 4076 wrote to memory of 228	4076	Jdodkebj.exe	112
PID 228 wrote to memory of 4368	228	Jgpmmp32.exe	113
PID 228 wrote to memory of 4368	228	Jgpmmp32.exe	113
PID 228 wrote to memory of 4368	228	Jgpmmp32.exe	113
PID 4368 wrote to memory of 4848	4368	Jqhafffk.exe	114
PID 4368 wrote to memory of 4848	4368	Jqhafffk.exe	114
PID 4368 wrote to memory of 4848	4368	Jqhafffk.exe	114
PID 4848 wrote to memory of 2592	4848	Jcikgacl.exe	115

C:\Users\Admin\AppData\Local\Temp\NEAS.1dd719624873f307a1da3c60f08262b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1dd719624873f307a1da3c60f08262b0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\Eiaoid32.exe
  C:\Windows\system32\Eiaoid32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\Fcniglmb.exe
    C:\Windows\system32\Fcniglmb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\SysWOW64\Fjjnifbl.exe
      C:\Windows\system32\Fjjnifbl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        23⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        24⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        25⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        26⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        27⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        28⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        29⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        30⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        31⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        32⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        33⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        34⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        35⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        36⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        37⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        38⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        39⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        40⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        42⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        43⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        44⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        45⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        48⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        49⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        50⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        51⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        52⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        54⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        55⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        56⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        57⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        58⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        59⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        60⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        61⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        62⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        63⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        64⤵
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        65⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        66⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        67⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        68⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        69⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        70⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3972
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        72⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        73⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        74⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        75⤵
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        76⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        77⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        78⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        79⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        80⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        82⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        83⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        84⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        85⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        87⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        88⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        89⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        90⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        91⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        92⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        93⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        94⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        95⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        96⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        97⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        98⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        99⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        101⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        102⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        103⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        104⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        105⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        106⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        107⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        109⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        110⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        112⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        113⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        114⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        115⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        116⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        117⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        118⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        119⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        120⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        121⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        122⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        123⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        124⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        125⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        126⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        128⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        129⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        130⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        131⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        133⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        134⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        135⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        136⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        137⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        139⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        142⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        144⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        145⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        146⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        147⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        148⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        149⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        150⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        151⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        152⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        153⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        154⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        155⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        156⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        157⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        159⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        160⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        161⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        162⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        164⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        165⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        166⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        167⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        168⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        169⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        170⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        171⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        172⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        173⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        174⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        175⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        176⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        177⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        178⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        179⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        180⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        181⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        182⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        183⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        184⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6300
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        186⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        187⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        188⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        189⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        190⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        191⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        192⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        193⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        194⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        195⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        196⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        197⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        199⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        200⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        201⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        202⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        203⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        204⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        205⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        207⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        208⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        209⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        210⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        211⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        213⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        214⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        215⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        216⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        217⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        218⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        219⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        220⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        221⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        222⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        223⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        224⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        225⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        226⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        227⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        228⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        229⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        231⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        232⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        233⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        234⤵
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        235⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        236⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        237⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        238⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        239⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        240⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        241⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        242⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4744

C:\Windows\SysWOW64\Pfncia32.exe
C:\Windows\system32\Pfncia32.exe
1⤵
PID:8244
- C:\Windows\SysWOW64\Pfppoa32.exe
  C:\Windows\system32\Pfppoa32.exe
  2⤵
  PID:8340
- - C:\Windows\SysWOW64\Pfbmdabh.exe
    C:\Windows\system32\Pfbmdabh.exe
    3⤵
    PID:8404
  - - C:\Windows\SysWOW64\Qbngeadf.exe
      C:\Windows\system32\Qbngeadf.exe
      4⤵
      PID:8492
    - - C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        5⤵
        
        PID:8564
      - C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        6⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        7⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        8⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        9⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        10⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        11⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        12⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        13⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        14⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        15⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        16⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        17⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        18⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        19⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        20⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        21⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        22⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        23⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        24⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        25⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        26⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        27⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        28⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        29⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        30⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3440
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        32⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        33⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Deidjf32.exe
        
        C:\Windows\system32\Deidjf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Dcmedk32.exe
        
        C:\Windows\system32\Dcmedk32.exe
        35⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        36⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Edlann32.exe
        
        C:\Windows\system32\Edlann32.exe
        37⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Emeffcid.exe
        
        C:\Windows\system32\Emeffcid.exe
        38⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Ecanojgl.exe
        
        C:\Windows\system32\Ecanojgl.exe
        39⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Emgblc32.exe
        
        C:\Windows\system32\Emgblc32.exe
        40⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        41⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        42⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        43⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        44⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        45⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Fjjcmbci.exe
        
        C:\Windows\system32\Fjjcmbci.exe
        46⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        47⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        48⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Fdadpk32.exe
        
        C:\Windows\system32\Fdadpk32.exe
        49⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        50⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        51⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        52⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        53⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        54⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        55⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Gcngafol.exe
        
        C:\Windows\system32\Gcngafol.exe
        56⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        57⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        58⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        59⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        60⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Hmmakk32.exe
        
        C:\Windows\system32\Hmmakk32.exe
        61⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2680
        
        C:\Windows\SysWOW64\Hmpnqj32.exe
        
        C:\Windows\system32\Hmpnqj32.exe
        63⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        64⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Iggocbke.exe
        
        C:\Windows\system32\Iggocbke.exe
        65⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        66⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        67⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Incdem32.exe
        
        C:\Windows\system32\Incdem32.exe
        68⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        69⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        70⤵
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Imiagi32.exe
        
        C:\Windows\system32\Imiagi32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Igneda32.exe
        
        C:\Windows\system32\Igneda32.exe
        72⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        73⤵
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Iqgjmg32.exe
        
        C:\Windows\system32\Iqgjmg32.exe
        74⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        76⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        77⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Jffokn32.exe
        
        C:\Windows\system32\Jffokn32.exe
        79⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        80⤵
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Jgekdq32.exe
        
        C:\Windows\system32\Jgekdq32.exe
        81⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        82⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Jeilne32.exe
        
        C:\Windows\system32\Jeilne32.exe
        83⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jfkhfmdm.exe
        
        C:\Windows\system32\Jfkhfmdm.exe
        84⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Jmdqbg32.exe
        
        C:\Windows\system32\Jmdqbg32.exe
        85⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jgjeppkp.exe
        
        C:\Windows\system32\Jgjeppkp.exe
        86⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        87⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        88⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        89⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        90⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        92⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Kebodc32.exe
        
        C:\Windows\system32\Kebodc32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5032
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        94⤵
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        95⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        96⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        97⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        98⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        99⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        100⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Lfmnbjcg.exe
        
        C:\Windows\system32\Lfmnbjcg.exe
        101⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Lmgfod32.exe
        
        C:\Windows\system32\Lmgfod32.exe
        102⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Lhmjlm32.exe
        
        C:\Windows\system32\Lhmjlm32.exe
        103⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        104⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        105⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        106⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Mginniij.exe
        
        C:\Windows\system32\Mginniij.exe
        107⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Mgngih32.exe
        
        C:\Windows\system32\Mgngih32.exe
        108⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        109⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        111⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        112⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pbpall32.exe
        
        C:\Windows\system32\Pbpall32.exe
        79⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        80⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Pbbnbkpe.exe
        
        C:\Windows\system32\Pbbnbkpe.exe
        81⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Qniogl32.exe
        
        C:\Windows\system32\Qniogl32.exe
        82⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Qajhigcj.exe
        
        C:\Windows\system32\Qajhigcj.exe
        83⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        84⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        85⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Ahiiqafa.exe
        
        C:\Windows\system32\Ahiiqafa.exe
        86⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Appaangd.exe
        
        C:\Windows\system32\Appaangd.exe
        87⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        88⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Biolkc32.exe
        
        C:\Windows\system32\Biolkc32.exe
        89⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Hfhqkk32.exe
        
        C:\Windows\system32\Hfhqkk32.exe
        90⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Hameic32.exe
        
        C:\Windows\system32\Hameic32.exe
        91⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Hmdend32.exe
        
        C:\Windows\system32\Hmdend32.exe
        92⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Hpbajp32.exe
        
        C:\Windows\system32\Hpbajp32.exe
        93⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        94⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Hikfbeod.exe
        
        C:\Windows\system32\Hikfbeod.exe
        95⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        96⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Hcpjpn32.exe
        
        C:\Windows\system32\Hcpjpn32.exe
        97⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Hjjbmhfg.exe
        
        C:\Windows\system32\Hjjbmhfg.exe
        98⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Himche32.exe
        
        C:\Windows\system32\Himche32.exe
        99⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Hpgkeodo.exe
        
        C:\Windows\system32\Hpgkeodo.exe
        100⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Hbegakcb.exe
        
        C:\Windows\system32\Hbegakcb.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Ijmobhdd.exe
        
        C:\Windows\system32\Ijmobhdd.exe
        102⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Imklncch.exe
        
        C:\Windows\system32\Imklncch.exe
        103⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        104⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        105⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        106⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        107⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Iakajagl.exe
        
        C:\Windows\system32\Iakajagl.exe
        108⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Idjmfmgp.exe
        
        C:\Windows\system32\Idjmfmgp.exe
        109⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Ifhibhfc.exe
        
        C:\Windows\system32\Ifhibhfc.exe
        110⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Imbaobmp.exe
        
        C:\Windows\system32\Imbaobmp.exe
        111⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        112⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        113⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Imdndbkn.exe
        
        C:\Windows\system32\Imdndbkn.exe
        114⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Idnfal32.exe
        
        C:\Windows\system32\Idnfal32.exe
        115⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Jmgkja32.exe
        
        C:\Windows\system32\Jmgkja32.exe
        116⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Jpegfm32.exe
        
        C:\Windows\system32\Jpegfm32.exe
        117⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jdqcglqh.exe
        
        C:\Windows\system32\Jdqcglqh.exe
        118⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Jfopcgpk.exe
        
        C:\Windows\system32\Jfopcgpk.exe
        119⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        120⤵
        Drops file in System32 directory
        
        PID:9456
        
        C:\Windows\SysWOW64\Jjoeoedo.exe
        
        C:\Windows\system32\Jjoeoedo.exe
        121⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Jmnakqcc.exe
        
        C:\Windows\system32\Jmnakqcc.exe
        122⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        123⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        124⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Mkkmaalo.exe
        
        C:\Windows\system32\Mkkmaalo.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Maefnk32.exe
        
        C:\Windows\system32\Maefnk32.exe
        126⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        127⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        128⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Mahbck32.exe
        
        C:\Windows\system32\Mahbck32.exe
        129⤵
        
        PID:504
        
        C:\Windows\SysWOW64\Mciokcgg.exe
        
        C:\Windows\system32\Mciokcgg.exe
        130⤵
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Mnochl32.exe
        
        C:\Windows\system32\Mnochl32.exe
        131⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        132⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        133⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        134⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Mpoljg32.exe
        
        C:\Windows\system32\Mpoljg32.exe
        135⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Mgidgakk.exe
        
        C:\Windows\system32\Mgidgakk.exe
        136⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Mjhqcmjo.exe
        
        C:\Windows\system32\Mjhqcmjo.exe
        137⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Nqaipgal.exe
        
        C:\Windows\system32\Nqaipgal.exe
        138⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        139⤵
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        140⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Nklfho32.exe
        
        C:\Windows\system32\Nklfho32.exe
        141⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        142⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Nddkaddm.exe
        
        C:\Windows\system32\Nddkaddm.exe
        143⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Nkncno32.exe
        
        C:\Windows\system32\Nkncno32.exe
        144⤵
        Modifies registry class
        
        PID:10188
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        145⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        146⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        147⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        148⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Ocldhqgb.exe
        
        C:\Windows\system32\Ocldhqgb.exe
        149⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        150⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Onaieifh.exe
        
        C:\Windows\system32\Onaieifh.exe
        151⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        152⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        153⤵
        Modifies registry class
        
        PID:9816
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        154⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        155⤵
        Drops file in System32 directory
        
        PID:10832
        
        C:\Windows\SysWOW64\Ogljcokf.exe
        
        C:\Windows\system32\Ogljcokf.exe
        156⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Ojjfpjjj.exe
        
        C:\Windows\system32\Ojjfpjjj.exe
        157⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Oqdnld32.exe
        
        C:\Windows\system32\Oqdnld32.exe
        158⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        159⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Okjbimal.exe
        
        C:\Windows\system32\Okjbimal.exe
        160⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        161⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        162⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Onklkhnn.exe
        
        C:\Windows\system32\Onklkhnn.exe
        163⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Pqihgcma.exe
        
        C:\Windows\system32\Pqihgcma.exe
        164⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        165⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Pkoldl32.exe
        
        C:\Windows\system32\Pkoldl32.exe
        166⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pnmhqh32.exe
        
        C:\Windows\system32\Pnmhqh32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        168⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11064 -s 400
        169⤵
        Program crash
        
        PID:6500
        
        C:\Windows\SysWOW64\Pikqcl32.exe
        
        C:\Windows\system32\Pikqcl32.exe
        11⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Pfoamp32.exe
        
        C:\Windows\system32\Pfoamp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3528
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        13⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Qojeabie.exe
        
        C:\Windows\system32\Qojeabie.exe
        14⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Qmkfoj32.exe
        
        C:\Windows\system32\Qmkfoj32.exe
        15⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        16⤵
        
        PID:2572

C:\Windows\SysWOW64\Nehjmnei.exe
C:\Windows\system32\Nehjmnei.exe
1⤵
PID:6484
- C:\Windows\SysWOW64\Nockkcjg.exe
  C:\Windows\system32\Nockkcjg.exe
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\Onhhmpoo.exe
    C:\Windows\system32\Onhhmpoo.exe
    3⤵
    PID:8252
  - - C:\Windows\SysWOW64\Ohpiphlb.exe
      C:\Windows\system32\Ohpiphlb.exe
      4⤵
      PID:7284
    - - C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        5⤵
        
        PID:5504
      - C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Ohdbkh32.exe
        
        C:\Windows\system32\Ohdbkh32.exe
        7⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        9⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        10⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Okeklcen.exe
        
        C:\Windows\system32\Okeklcen.exe
        11⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        12⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Pocdba32.exe
        
        C:\Windows\system32\Pocdba32.exe
        13⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        14⤵
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Pgoigcip.exe
        
        C:\Windows\system32\Pgoigcip.exe
        15⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Poeahaib.exe
        
        C:\Windows\system32\Poeahaib.exe
        16⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        17⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        18⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        19⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Pkonbamc.exe
        
        C:\Windows\system32\Pkonbamc.exe
        20⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Qghlmbae.exe
        
        C:\Windows\system32\Qghlmbae.exe
        21⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        22⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3768
        
        C:\Windows\SysWOW64\Bbklli32.exe
        
        C:\Windows\system32\Bbklli32.exe
        24⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        25⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Bflagg32.exe
        
        C:\Windows\system32\Bflagg32.exe
        26⤵
        Drops file in System32 directory
        
        PID:5756

C:\Windows\SysWOW64\Bkhjpn32.exe
C:\Windows\system32\Bkhjpn32.exe
1⤵
PID:5868
- C:\Windows\SysWOW64\Bnicai32.exe
  C:\Windows\system32\Bnicai32.exe
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\Bfpkbfdi.exe
    C:\Windows\system32\Bfpkbfdi.exe
    3⤵
    PID:7112
  - - C:\Windows\SysWOW64\Ciogobcm.exe
      C:\Windows\system32\Ciogobcm.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:960
    - - C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        5⤵
        
        PID:5524
      - C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        6⤵
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        7⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        9⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        10⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        11⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Cicqja32.exe
        
        C:\Windows\system32\Cicqja32.exe
        12⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Clbmfm32.exe
        
        C:\Windows\system32\Clbmfm32.exe
        13⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        14⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Cfgace32.exe
        
        C:\Windows\system32\Cfgace32.exe
        15⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        16⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Cppelkeb.exe
        
        C:\Windows\system32\Cppelkeb.exe
        17⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        19⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        21⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        22⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Deokja32.exe
        
        C:\Windows\system32\Deokja32.exe
        23⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        24⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Dpdogj32.exe
        
        C:\Windows\system32\Dpdogj32.exe
        25⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        26⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        27⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        28⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        29⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Decdeama.exe
        
        C:\Windows\system32\Decdeama.exe
        30⤵
        Drops file in System32 directory
        
        PID:3704
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        31⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Dpihbjmg.exe
        
        C:\Windows\system32\Dpihbjmg.exe
        32⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        33⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        34⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Dlpigk32.exe
        
        C:\Windows\system32\Dlpigk32.exe
        35⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        36⤵
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        37⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        38⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        39⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        40⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Ehifak32.exe
        
        C:\Windows\system32\Ehifak32.exe
        41⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        42⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ebokodfc.exe
        
        C:\Windows\system32\Ebokodfc.exe
        43⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        45⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ebagdddp.exe
        
        C:\Windows\system32\Ebagdddp.exe
        46⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        47⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        48⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        49⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        50⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        51⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        52⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Ebeapc32.exe
        
        C:\Windows\system32\Ebeapc32.exe
        53⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        54⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        55⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        56⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Fefjanml.exe
        
        C:\Windows\system32\Fefjanml.exe
        57⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        58⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Fbjjkble.exe
        
        C:\Windows\system32\Fbjjkble.exe
        59⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        60⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        61⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        62⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        63⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        64⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        65⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        66⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        67⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Fpeaeedg.exe
        
        C:\Windows\system32\Fpeaeedg.exe
        68⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        69⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        70⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        71⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        72⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        73⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        74⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        75⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        76⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        77⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        78⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        79⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        80⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Hpejlc32.exe
        
        C:\Windows\system32\Hpejlc32.exe
        81⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        82⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        83⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        84⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        85⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        86⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        87⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        88⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Iqmplbpl.exe
        
        C:\Windows\system32\Iqmplbpl.exe
        89⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        90⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        91⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        92⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        93⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        94⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        95⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        97⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        98⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Iqdfmajd.exe
        
        C:\Windows\system32\Iqdfmajd.exe
        99⤵
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        100⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        101⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        102⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Igpkok32.exe
        
        C:\Windows\system32\Igpkok32.exe
        103⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        104⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jmmcgbnf.exe
        
        C:\Windows\system32\Jmmcgbnf.exe
        105⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jgbhdkml.exe
        
        C:\Windows\system32\Jgbhdkml.exe
        106⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        107⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        108⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        109⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        110⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        111⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        112⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        113⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        114⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Jqofippg.exe
        
        C:\Windows\system32\Jqofippg.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        116⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        117⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        118⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        119⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        121⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        122⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        123⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        124⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        125⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        126⤵
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Kpilekqj.exe
        
        C:\Windows\system32\Kpilekqj.exe
        127⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        128⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        129⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        130⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        131⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Kjamhd32.exe
        
        C:\Windows\system32\Kjamhd32.exe
        132⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        133⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        134⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Kifjip32.exe
        
        C:\Windows\system32\Kifjip32.exe
        135⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        136⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        137⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        138⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        139⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        140⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1288
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        142⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        143⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        144⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        145⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Lfaqcclf.exe
        
        C:\Windows\system32\Lfaqcclf.exe
        146⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lmkipncc.exe
        
        C:\Windows\system32\Lmkipncc.exe
        147⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        148⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        149⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        150⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        151⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        152⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        153⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        154⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        155⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        156⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mpqklh32.exe
        
        C:\Windows\system32\Mpqklh32.exe
        157⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        158⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        159⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        160⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        161⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        162⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        163⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Mhmmieil.exe
        
        C:\Windows\system32\Mhmmieil.exe
        164⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        165⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        166⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        167⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Nipffmmg.exe
        
        C:\Windows\system32\Nipffmmg.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4884
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        169⤵
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        170⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        171⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        172⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        173⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        174⤵
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        175⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        176⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        177⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ngklppei.exe
        
        C:\Windows\system32\Ngklppei.exe
        178⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Nmedmj32.exe
        
        C:\Windows\system32\Nmedmj32.exe
        179⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ndomiddc.exe
        
        C:\Windows\system32\Ndomiddc.exe
        180⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        181⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Oileakbj.exe
        
        C:\Windows\system32\Oileakbj.exe
        182⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        183⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        184⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        185⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        186⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Oiqomj32.exe
        
        C:\Windows\system32\Oiqomj32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9684
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        188⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        189⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        190⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        191⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        192⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        193⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        194⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        195⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        196⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        199⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Pdofpb32.exe
        
        C:\Windows\system32\Pdofpb32.exe
        200⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        202⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pklkbl32.exe
        
        C:\Windows\system32\Pklkbl32.exe
        203⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Pafcofcg.exe
        
        C:\Windows\system32\Pafcofcg.exe
        204⤵
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        205⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        206⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        207⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Akenij32.exe
        
        C:\Windows\system32\Akenij32.exe
        208⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        209⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        210⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        211⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        212⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        213⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        214⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        215⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        216⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        217⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        218⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        219⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        220⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        221⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        222⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        223⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        224⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        225⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        226⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        227⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        229⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        230⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        231⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        232⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9356
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        234⤵
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        235⤵
        Drops file in System32 directory
        
        PID:9776
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        236⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9284
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        238⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        239⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        240⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        241⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        242⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        243⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        244⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        245⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        246⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        247⤵
        Modifies registry class
        
        PID:10336
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        248⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        249⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        250⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        251⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        253⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        254⤵
        Drops file in System32 directory
        
        PID:10648
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        255⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        256⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        257⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        258⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        259⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        260⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        261⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        262⤵
        Modifies registry class
        
        PID:11008
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        263⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        264⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        265⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        266⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        267⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10244
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        269⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        270⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        271⤵
        Drops file in System32 directory
        
        PID:10416
        
        C:\Windows\SysWOW64\Ehklmd32.exe
        
        C:\Windows\system32\Ehklmd32.exe
        272⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        273⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Eacaej32.exe
        
        C:\Windows\system32\Eacaej32.exe
        274⤵
        Drops file in System32 directory
        
        PID:10660
        
        C:\Windows\SysWOW64\Eijigg32.exe
        
        C:\Windows\system32\Eijigg32.exe
        275⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Eliecc32.exe
        
        C:\Windows\system32\Eliecc32.exe
        276⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Engaon32.exe
        
        C:\Windows\system32\Engaon32.exe
        277⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Eaenkj32.exe
        
        C:\Windows\system32\Eaenkj32.exe
        278⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Elkbhbeb.exe
        
        C:\Windows\system32\Elkbhbeb.exe
        279⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        280⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        281⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Flmonbbp.exe
        
        C:\Windows\system32\Flmonbbp.exe
        282⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        283⤵
        Drops file in System32 directory
        
        PID:11256
        
        C:\Windows\SysWOW64\Fefcgh32.exe
        
        C:\Windows\system32\Fefcgh32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10284
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        285⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Fongpm32.exe
        
        C:\Windows\system32\Fongpm32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10468
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        287⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Fhflhcfa.exe
        
        C:\Windows\system32\Fhflhcfa.exe
        288⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        289⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Fblpflfg.exe
        
        C:\Windows\system32\Fblpflfg.exe
        290⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Fhiinbdo.exe
        
        C:\Windows\system32\Fhiinbdo.exe
        291⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Gikbneio.exe
        
        C:\Windows\system32\Gikbneio.exe
        292⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        293⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Gimoce32.exe
        
        C:\Windows\system32\Gimoce32.exe
        294⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        295⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        296⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Oiphbd32.exe
        
        C:\Windows\system32\Oiphbd32.exe
        297⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Odelpm32.exe
        
        C:\Windows\system32\Odelpm32.exe
        298⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Ofdhlh32.exe
        
        C:\Windows\system32\Ofdhlh32.exe
        299⤵
        Drops file in System32 directory
        
        PID:10816
        
        C:\Windows\SysWOW64\Bjhpqn32.exe
        
        C:\Windows\system32\Bjhpqn32.exe
        300⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Bnclamqe.exe
        
        C:\Windows\system32\Bnclamqe.exe
        301⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Bqahmhpi.exe
        
        C:\Windows\system32\Bqahmhpi.exe
        302⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Bglpjb32.exe
        
        C:\Windows\system32\Bglpjb32.exe
        303⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        304⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        305⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Cnhell32.exe
        
        C:\Windows\system32\Cnhell32.exe
        306⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Cqfahh32.exe
        
        C:\Windows\system32\Cqfahh32.exe
        307⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Cklffq32.exe
        
        C:\Windows\system32\Cklffq32.exe
        308⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10804
        
        C:\Windows\SysWOW64\Cjcolm32.exe
        
        C:\Windows\system32\Cjcolm32.exe
        310⤵
        Drops file in System32 directory
        
        PID:10924
        
        C:\Windows\SysWOW64\Ckclfp32.exe
        
        C:\Windows\system32\Ckclfp32.exe
        311⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Ddkpoelb.exe
        
        C:\Windows\system32\Ddkpoelb.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2972
        
        C:\Windows\SysWOW64\Dkehlo32.exe
        
        C:\Windows\system32\Dkehlo32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Ddnmeejo.exe
        
        C:\Windows\system32\Ddnmeejo.exe
        314⤵
        Drops file in System32 directory
        
        PID:4912
        
        C:\Windows\SysWOW64\Dgliapic.exe
        
        C:\Windows\system32\Dgliapic.exe
        315⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Dkjbgooi.exe
        
        C:\Windows\system32\Dkjbgooi.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8672
        
        C:\Windows\SysWOW64\Dnhncjom.exe
        
        C:\Windows\system32\Dnhncjom.exe
        317⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Dqgjoenq.exe
        
        C:\Windows\system32\Dqgjoenq.exe
        318⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Dcegkamd.exe
        
        C:\Windows\system32\Dcegkamd.exe
        319⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Dqigee32.exe
        
        C:\Windows\system32\Dqigee32.exe
        320⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Dgcoaock.exe
        
        C:\Windows\system32\Dgcoaock.exe
        321⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Djalnkbo.exe
        
        C:\Windows\system32\Djalnkbo.exe
        322⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Eegpkcbd.exe
        
        C:\Windows\system32\Eegpkcbd.exe
        323⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Egelgoah.exe
        
        C:\Windows\system32\Egelgoah.exe
        324⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Ejdhcjpl.exe
        
        C:\Windows\system32\Ejdhcjpl.exe
        325⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Embdofop.exe
        
        C:\Windows\system32\Embdofop.exe
        326⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ekcemmgo.exe
        
        C:\Windows\system32\Ekcemmgo.exe
        327⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Emgnje32.exe
        
        C:\Windows\system32\Emgnje32.exe
        328⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Eglbhnkp.exe
        
        C:\Windows\system32\Eglbhnkp.exe
        329⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Enfjdh32.exe
        
        C:\Windows\system32\Enfjdh32.exe
        330⤵
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Eepbabjj.exe
        
        C:\Windows\system32\Eepbabjj.exe
        331⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Eljknl32.exe
        
        C:\Windows\system32\Eljknl32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Fhalcm32.exe
        
        C:\Windows\system32\Fhalcm32.exe
        333⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Fjphoi32.exe
        
        C:\Windows\system32\Fjphoi32.exe
        334⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Flodilma.exe
        
        C:\Windows\system32\Flodilma.exe
        335⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Falmabki.exe
        
        C:\Windows\system32\Falmabki.exe
        336⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Fcjimnjl.exe
        
        C:\Windows\system32\Fcjimnjl.exe
        337⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Flaaok32.exe
        
        C:\Windows\system32\Flaaok32.exe
        338⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Fejegaao.exe
        
        C:\Windows\system32\Fejegaao.exe
        339⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Fhhaclqc.exe
        
        C:\Windows\system32\Fhhaclqc.exe
        340⤵
        Drops file in System32 directory
        
        PID:2376
        
        C:\Windows\SysWOW64\Fmejlcoj.exe
        
        C:\Windows\system32\Fmejlcoj.exe
        341⤵
        Drops file in System32 directory
        
        PID:4060
        
        C:\Windows\SysWOW64\Felbmqpl.exe
        
        C:\Windows\system32\Felbmqpl.exe
        342⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Flfjjkgi.exe
        
        C:\Windows\system32\Flfjjkgi.exe
        343⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Gmggac32.exe
        
        C:\Windows\system32\Gmggac32.exe
        344⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mdloelpc.exe
        
        C:\Windows\system32\Mdloelpc.exe
        50⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Moacbe32.exe
        
        C:\Windows\system32\Moacbe32.exe
        51⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Mqbpjmeg.exe
        
        C:\Windows\system32\Mqbpjmeg.exe
        52⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Mhihkjfj.exe
        
        C:\Windows\system32\Mhihkjfj.exe
        53⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Nocphd32.exe
        
        C:\Windows\system32\Nocphd32.exe
        54⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Nqdlpmce.exe
        
        C:\Windows\system32\Nqdlpmce.exe
        55⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ngodlgka.exe
        
        C:\Windows\system32\Ngodlgka.exe
        56⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        57⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Nqlbqlmm.exe
        
        C:\Windows\system32\Nqlbqlmm.exe
        58⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ngekmf32.exe
        
        C:\Windows\system32\Ngekmf32.exe
        59⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        60⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Oendaipn.exe
        
        C:\Windows\system32\Oendaipn.exe
        61⤵
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Opdiobod.exe
        
        C:\Windows\system32\Opdiobod.exe
        62⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Obbekn32.exe
        
        C:\Windows\system32\Obbekn32.exe
        63⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Oeqagi32.exe
        
        C:\Windows\system32\Oeqagi32.exe
        64⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ogoncd32.exe
        
        C:\Windows\system32\Ogoncd32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Onifpodl.exe
        
        C:\Windows\system32\Onifpodl.exe
        66⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Oecnmi32.exe
        
        C:\Windows\system32\Oecnmi32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        68⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Palkgi32.exe
        
        C:\Windows\system32\Palkgi32.exe
        69⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Phfcdcfg.exe
        
        C:\Windows\system32\Phfcdcfg.exe
        70⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Plapdb32.exe
        
        C:\Windows\system32\Plapdb32.exe
        71⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Piepnfnj.exe
        
        C:\Windows\system32\Piepnfnj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Phkmoc32.exe
        
        C:\Windows\system32\Phkmoc32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Lonnfg32.exe
        
        C:\Windows\system32\Lonnfg32.exe
        32⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jdkmgali.exe
        
        C:\Windows\system32\Jdkmgali.exe
        10⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Jkeedk32.exe
        
        C:\Windows\system32\Jkeedk32.exe
        11⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kaonaekb.exe
        
        C:\Windows\system32\Kaonaekb.exe
        12⤵
        
        PID:5484

C:\Windows\SysWOW64\Nppfnige.exe
C:\Windows\system32\Nppfnige.exe
1⤵
PID:9008
- C:\Windows\SysWOW64\Ofjokc32.exe
  C:\Windows\system32\Ofjokc32.exe
  2⤵
  PID:8116
- - C:\Windows\SysWOW64\Oemofpel.exe
    C:\Windows\system32\Oemofpel.exe
    3⤵
    - Modifies registry class
    PID:5808
  - - C:\Windows\SysWOW64\Olfgcj32.exe
      C:\Windows\system32\Olfgcj32.exe
      4⤵
      PID:1124
    - - C:\Windows\SysWOW64\Oflkqc32.exe
        
        C:\Windows\system32\Oflkqc32.exe
        5⤵
        
        PID:8232
      - C:\Windows\SysWOW64\Oijgmokc.exe
        
        C:\Windows\system32\Oijgmokc.exe
        6⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Opdpih32.exe
        
        C:\Windows\system32\Opdpih32.exe
        7⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        8⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Opgloh32.exe
        
        C:\Windows\system32\Opgloh32.exe
        9⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ofadlbhj.exe
        
        C:\Windows\system32\Ofadlbhj.exe
        10⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Oioahn32.exe
        
        C:\Windows\system32\Oioahn32.exe
        11⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Onlipd32.exe
        
        C:\Windows\system32\Onlipd32.exe
        12⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Obgeqcnn.exe
        
        C:\Windows\system32\Obgeqcnn.exe
        13⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Oefamoma.exe
        
        C:\Windows\system32\Oefamoma.exe
        14⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Oianmm32.exe
        
        C:\Windows\system32\Oianmm32.exe
        15⤵
        Drops file in System32 directory
        
        PID:572
        
        C:\Windows\SysWOW64\Olpjii32.exe
        
        C:\Windows\system32\Olpjii32.exe
        16⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Opkfjgmh.exe
        
        C:\Windows\system32\Opkfjgmh.exe
        17⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Ppnbpg32.exe
        
        C:\Windows\system32\Ppnbpg32.exe
        18⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8772
        
        C:\Windows\SysWOW64\Pldcdhpi.exe
        
        C:\Windows\system32\Pldcdhpi.exe
        20⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Pocpqcpm.exe
        
        C:\Windows\system32\Pocpqcpm.exe
        21⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Pbokab32.exe
        
        C:\Windows\system32\Pbokab32.exe
        22⤵
        
        PID:8844

C:\Windows\SysWOW64\Qefkcl32.exe
C:\Windows\system32\Qefkcl32.exe
1⤵
PID:1584
- C:\Windows\SysWOW64\Affgno32.exe
  C:\Windows\system32\Affgno32.exe
  2⤵
  PID:8880
- - C:\Windows\SysWOW64\Aghdco32.exe
    C:\Windows\system32\Aghdco32.exe
    3⤵
    - Modifies registry class
    PID:5088
  - - C:\Windows\SysWOW64\Aifpoj32.exe
      C:\Windows\system32\Aifpoj32.exe
      4⤵
      PID:6468
    - - C:\Windows\SysWOW64\Amgekh32.exe
        
        C:\Windows\system32\Amgekh32.exe
        5⤵
        
        PID:8480
      - C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        6⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Bpgnmcdh.exe
        
        C:\Windows\system32\Bpgnmcdh.exe
        7⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Bcfkiock.exe
        
        C:\Windows\system32\Bcfkiock.exe
        8⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Bipcei32.exe
        
        C:\Windows\system32\Bipcei32.exe
        9⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Bmlofhca.exe
        
        C:\Windows\system32\Bmlofhca.exe
        10⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        11⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Bomknp32.exe
        
        C:\Windows\system32\Bomknp32.exe
        12⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Bgdcom32.exe
        
        C:\Windows\system32\Bgdcom32.exe
        13⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Bnnklg32.exe
        
        C:\Windows\system32\Bnnklg32.exe
        14⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Blqlgdhi.exe
        
        C:\Windows\system32\Blqlgdhi.exe
        15⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        16⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Beippj32.exe
        
        C:\Windows\system32\Beippj32.exe
        17⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Bnphag32.exe
        
        C:\Windows\system32\Bnphag32.exe
        18⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Cnealfkf.exe
        
        C:\Windows\system32\Cnealfkf.exe
        19⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Cgmfel32.exe
        
        C:\Windows\system32\Cgmfel32.exe
        20⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        21⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Cljomc32.exe
        
        C:\Windows\system32\Cljomc32.exe
        22⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Cohkinob.exe
        
        C:\Windows\system32\Cohkinob.exe
        23⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cfbcfh32.exe
        
        C:\Windows\system32\Cfbcfh32.exe
        24⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Cllkcbnl.exe
        
        C:\Windows\system32\Cllkcbnl.exe
        25⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Cokgonmp.exe
        
        C:\Windows\system32\Cokgonmp.exe
        26⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Cfeplh32.exe
        
        C:\Windows\system32\Cfeplh32.exe
        27⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Clohhbli.exe
        
        C:\Windows\system32\Clohhbli.exe
        28⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ccipelcf.exe
        
        C:\Windows\system32\Ccipelcf.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        30⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dobnpm32.exe
        
        C:\Windows\system32\Dobnpm32.exe
        31⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Dofgklcb.exe
        
        C:\Windows\system32\Dofgklcb.exe
        32⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Dcglfjgf.exe
        
        C:\Windows\system32\Dcglfjgf.exe
        33⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Iandjg32.exe
        
        C:\Windows\system32\Iandjg32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8588
        
        C:\Windows\SysWOW64\Iodaikfl.exe
        
        C:\Windows\system32\Iodaikfl.exe
        35⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Jpfnqc32.exe
        
        C:\Windows\system32\Jpfnqc32.exe
        36⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Jgpfmncg.exe
        
        C:\Windows\system32\Jgpfmncg.exe
        37⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jmjojh32.exe
        
        C:\Windows\system32\Jmjojh32.exe
        38⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        39⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        40⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        41⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        42⤵
        
        PID:3676

C:\Windows\SysWOW64\Kobnji32.exe
C:\Windows\system32\Kobnji32.exe
1⤵
- Drops file in System32 directory
PID:7296
- C:\Windows\SysWOW64\Kdpfbp32.exe
  C:\Windows\system32\Kdpfbp32.exe
  2⤵
  PID:7812
- - C:\Windows\SysWOW64\Knhkkfod.exe
    C:\Windows\system32\Knhkkfod.exe
    3⤵
    PID:6528
  - - C:\Windows\SysWOW64\Kpfggang.exe
      C:\Windows\system32\Kpfggang.exe
      4⤵
      PID:7828
    - - C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        5⤵
        
        PID:8128
      - C:\Windows\SysWOW64\Kpkqbq32.exe
        
        C:\Windows\system32\Kpkqbq32.exe
        6⤵
        
        PID:7688

C:\Windows\SysWOW64\Ldnbdnlc.exe
C:\Windows\system32\Ldnbdnlc.exe
1⤵
PID:8080
- C:\Windows\SysWOW64\Laacmbkm.exe
  C:\Windows\system32\Laacmbkm.exe
  2⤵
  PID:5504
- - C:\Windows\SysWOW64\Lgnleiid.exe
    C:\Windows\system32\Lgnleiid.exe
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\Ladpcb32.exe
      C:\Windows\system32\Ladpcb32.exe
      4⤵
      PID:8648
    - - C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        5⤵
        
        PID:1908
      - C:\Windows\SysWOW64\Moofmeal.exe
        
        C:\Windows\system32\Moofmeal.exe
        6⤵
        
        PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 11064 -ip 11064
1⤵
PID:11080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajaelc32.exe

Filesize
366KB

MD5
b7c077c884821968095784640b554219

SHA1
189bebe55f1879e48ea11b9c2648a36a983e1b4f

SHA256
fb2737940c50147b81dcf5ee3bd4a4825219e35736897ff64c78efc51ddacafa

SHA512
f30b911ed6131e9ea6f9be80077b55be8a99e1a4b82374d47b00d6ed15a790cba2006d531eeb78fada8b56298d779efceb9949a61ad676719d7ae6a6d74d1e83

Download Submit
C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
366KB

MD5
396bd2f3a3a451a91f8d690a737eeed5

SHA1
06eaa9ab6aac87f7adafdf30cee80b08cac076da

SHA256
3c8be8785e6ab6f8445ed09321360eb2acf0bba16d12c0ee0dfb84786b763fcd

SHA512
be19cba21fe34185e5d4acfd57c23a8fa4fbc67d654861eb59dd633074f25a51082c6f772e818a2f11c3bc0607fae5fa0fc9223f9e2e389f9b60d72e3961af4f

Download Submit
C:\Windows\SysWOW64\Dinael32.exe

Filesize
366KB

MD5
1de7a405a1205bfe2820185e1ea720a8

SHA1
6eea8ed759be1f6f1af48fb718129b9cad44bd9c

SHA256
7ff67fd09e60eaca1559d010cfd2e44df7fff83349c4dab1b934ffd70a9bdac3

SHA512
b231b2e878bed30cfedbc1f1e51c5a2cbe73eaf8112a49b7a5d4340eaef0903c54354b2fb816f687e0821342f7a956b5309d1e5b273c441116354d0584a03f31

Download Submit
C:\Windows\SysWOW64\Eiaoid32.exe

Filesize
366KB

MD5
cd898a531cc34ec1568aa736807a9f43

SHA1
9a0c54e355d3aecc20cecbe0fb14ea4f314f23b0

SHA256
49f3491233978a57bb64f699e6320008ef4d027ea2d929f94ef6b9c0e1954a05

SHA512
0591ae3b71beeb4e5a65deb6bcf1f5224da3754a071cc1efd77fac8bfa7d4f31fc00cb9d07155b06388ca7311ad15c3ae682ea0ecf39a6934df1cbb36b8636ef

Download Submit
C:\Windows\SysWOW64\Eiaoid32.exe

Filesize
366KB

MD5
cd898a531cc34ec1568aa736807a9f43

SHA1
9a0c54e355d3aecc20cecbe0fb14ea4f314f23b0

SHA256
49f3491233978a57bb64f699e6320008ef4d027ea2d929f94ef6b9c0e1954a05

SHA512
0591ae3b71beeb4e5a65deb6bcf1f5224da3754a071cc1efd77fac8bfa7d4f31fc00cb9d07155b06388ca7311ad15c3ae682ea0ecf39a6934df1cbb36b8636ef

Download Submit
C:\Windows\SysWOW64\Eppjfgcp.exe

Filesize
366KB

MD5
f9157dc1b5b746d4160921eb0779cce1

SHA1
840a4cffe0161a3020fc55f6049919726a19f0ba

SHA256
b12e299abaf785d0cec1b7518daa21350e7ff5ffb124efb7e75a76a66d0d8a34

SHA512
2c8540bcd25e9874bb69fc8d1e8bc94a07e1f26551bfb865eca870a860ba0e7df0669a8992627f45feb9acf3b0e60adab88512732cd968cdc2570a57cf038d09

Download Submit
C:\Windows\SysWOW64\Fcniglmb.exe

Filesize
366KB

MD5
9c232ed1af01d915308640e45fcc422d

SHA1
df4c7dd5ea43be7e198b19ee52bac4ee73c321e5

SHA256
134aa83fd3a772d7f33a65f104905065ee5484c953b3446ed44e8218983911b7

SHA512
f96af3600bf7e0748782db369e488277300fb52a38d0e9be77aa4fc8c1c86f04622121c7e275bf7bc5593a8aeafca510f9531859afc91deda894fbd5a7b46a1b

Download Submit
C:\Windows\SysWOW64\Fcniglmb.exe

Filesize
366KB

MD5
9c232ed1af01d915308640e45fcc422d

SHA1
df4c7dd5ea43be7e198b19ee52bac4ee73c321e5

SHA256
134aa83fd3a772d7f33a65f104905065ee5484c953b3446ed44e8218983911b7

SHA512
f96af3600bf7e0748782db369e488277300fb52a38d0e9be77aa4fc8c1c86f04622121c7e275bf7bc5593a8aeafca510f9531859afc91deda894fbd5a7b46a1b

Download Submit
C:\Windows\SysWOW64\Fdglmkeg.exe

Filesize
366KB

MD5
bce70af62e113a4b82dd6cbae456c38e

SHA1
91e92c56db36a8201e974c6806afbbc0eaa48474

SHA256
71885ea8aa3b1a963ab108ae1dc0da939efa2ad67a57770b84ee9a726670a260

SHA512
0157feaf65c3252fcc66a5f2cabcba08bdc5e2e24e723a411b1ec3d00c6c6e3ddc4173a151c926e4ec0584c1c58744146e38a7a5036ff03bd9fc652b2cf7220a

Download Submit
C:\Windows\SysWOW64\Fdglmkeg.exe

Filesize
366KB

MD5
bce70af62e113a4b82dd6cbae456c38e

SHA1
91e92c56db36a8201e974c6806afbbc0eaa48474

SHA256
71885ea8aa3b1a963ab108ae1dc0da939efa2ad67a57770b84ee9a726670a260

SHA512
0157feaf65c3252fcc66a5f2cabcba08bdc5e2e24e723a411b1ec3d00c6c6e3ddc4173a151c926e4ec0584c1c58744146e38a7a5036ff03bd9fc652b2cf7220a

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
366KB

MD5
ece78f786aee3e497bf80e3fddf76b8a

SHA1
14cdacf6a23eb1e64d065537e29009ebd72a0854

SHA256
2920e9dfac1d15165ae70e1b90fd724b4e5d3c726e6aafff7649bee7d386b72f

SHA512
d479a111f867e8ac026b7d70ffaf229c9d50654b6ed5a0658dae8060e38819cf65a5a2f1f16d139834d59f026bf5b99e1389bb2b0959ec1037e9e4ee8afdc4fa

Download Submit
C:\Windows\SysWOW64\Fipkjb32.exe

Filesize
366KB

MD5
8eeb32ac52aede6b11a6d84013508250

SHA1
0508dc6cff3ecd4258732e42e67b41407bb1f9b6

SHA256
0e4abdf07355be560aa94ff22df4489db6364ba31ceffd100e8a4cc091ceb8a5

SHA512
bcc13fe897cae9e60966b1270f63c7c3d4e7ce88361cef88b9792ba0687af6701c7bdc00ff3b1a6cd7690763d11eb486a645d47a1c56198f42c3a97dbfcca591

Download Submit
C:\Windows\SysWOW64\Fipkjb32.exe

Filesize
366KB

MD5
8eeb32ac52aede6b11a6d84013508250

SHA1
0508dc6cff3ecd4258732e42e67b41407bb1f9b6

SHA256
0e4abdf07355be560aa94ff22df4489db6364ba31ceffd100e8a4cc091ceb8a5

SHA512
bcc13fe897cae9e60966b1270f63c7c3d4e7ce88361cef88b9792ba0687af6701c7bdc00ff3b1a6cd7690763d11eb486a645d47a1c56198f42c3a97dbfcca591

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
366KB

MD5
d576d850c3772668ce8d273129a3c0d4

SHA1
a00a9b8ecb15011fd253d909ae638a50a4968fa6

SHA256
204a732dcb42efd25b07e1ac026e2b148794e7331b042046e72c785a758fffc6

SHA512
2d745491c6f8add64568d674b70efeb68f8515db49bc80c917c4f6a27edb79e6056541fc15886d84e09eb5e70e9fef9301e25bc6deaa49387f97d3c4a9f18f11

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
366KB

MD5
d576d850c3772668ce8d273129a3c0d4

SHA1
a00a9b8ecb15011fd253d909ae638a50a4968fa6

SHA256
204a732dcb42efd25b07e1ac026e2b148794e7331b042046e72c785a758fffc6

SHA512
2d745491c6f8add64568d674b70efeb68f8515db49bc80c917c4f6a27edb79e6056541fc15886d84e09eb5e70e9fef9301e25bc6deaa49387f97d3c4a9f18f11

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
366KB

MD5
8091e3631547b31aaa0a68b6ffb43502

SHA1
010539dc7031d550a26f3ff588ae424e73a4fcb0

SHA256
41e9ee8024592f1b15c7a98380f8f1bdb8e3d29cae74a00b976d642ee35d16c9

SHA512
37d82baf72fa0cc461c845c5ecb06f27b836977cd790458b74fb7c58e67456c8006defe79e961d66c7a83f1845c6761153a1c4549684ee0bf580475b96788416

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
366KB

MD5
e257aaa3feef9ba749549a6767368782

SHA1
43e9b14c5c68291a30f17f1d1157dfc73e3cf8a8

SHA256
a24ff0ccc9f2f0dfd7989c66a4b504e494e0a1aa5b5fbba4a75ac1e12a23161e

SHA512
55d17080bca239fa8714dfec497866ef36298ac95a8ae0b5b98f77e28a3fcb5557d0ab2bb5263761d457acd7437087e5b80784ffb401f48ab31c9618303ef318

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
366KB

MD5
e257aaa3feef9ba749549a6767368782

SHA1
43e9b14c5c68291a30f17f1d1157dfc73e3cf8a8

SHA256
a24ff0ccc9f2f0dfd7989c66a4b504e494e0a1aa5b5fbba4a75ac1e12a23161e

SHA512
55d17080bca239fa8714dfec497866ef36298ac95a8ae0b5b98f77e28a3fcb5557d0ab2bb5263761d457acd7437087e5b80784ffb401f48ab31c9618303ef318

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
366KB

MD5
b954cd580d0d2e21e482adaa7a9351a6

SHA1
ecb759005e9d27af799d6e2b025f2dc24fb08992

SHA256
5d7f3794691b2c011c763eaee79e617044c00df75105aa80c07d884769c5841b

SHA512
b70e873684da553cc233c68cc09baa7719e4975ad1bc1a11f1a35abe0443e1a0f2f46cc5dabaab733702e1d125b2ea4bb6e9402cce3cc144f5d77c775395b4bd

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
366KB

MD5
b954cd580d0d2e21e482adaa7a9351a6

SHA1
ecb759005e9d27af799d6e2b025f2dc24fb08992

SHA256
5d7f3794691b2c011c763eaee79e617044c00df75105aa80c07d884769c5841b

SHA512
b70e873684da553cc233c68cc09baa7719e4975ad1bc1a11f1a35abe0443e1a0f2f46cc5dabaab733702e1d125b2ea4bb6e9402cce3cc144f5d77c775395b4bd

Download Submit
C:\Windows\SysWOW64\Gncchb32.exe

Filesize
366KB

MD5
de8339724aecc957c888ac5e5e03321c

SHA1
efd8896c952192e9ca8b69d73bbe834750820d3d

SHA256
5734fde56af23aacc7abeeb77df3fdeb83fb5daebf26e8d345c70524830a8683

SHA512
5195a222e7b7bdda78a2c1a94ad2d0e8acea325cf18a47e1087663e18e08022c757ae962d5833d04c6490328f04045da6e89a8ce957a100ebf738c2de313deca

Download Submit
C:\Windows\SysWOW64\Gpcfmkff.exe

Filesize
366KB

MD5
d31e57bbe6852d14cc19f71069a70bc4

SHA1
e39a7b406dd563d338eda79395b03ddc5fa21ad4

SHA256
393f74d6e590dda2197927ba1a537cc0360ab5fa8a5820ff98440280e50bd4dc

SHA512
92d36b9914ed7af35c64e25b57832359dcc6db1734b6a4fd0b594606bc7559ec22437d7c9509310ebf27329acdf6c73e570476ba04a97533c2b1a9a23b42b81e

Download Submit
C:\Windows\SysWOW64\Gpcfmkff.exe

Filesize
366KB

MD5
d31e57bbe6852d14cc19f71069a70bc4

SHA1
e39a7b406dd563d338eda79395b03ddc5fa21ad4

SHA256
393f74d6e590dda2197927ba1a537cc0360ab5fa8a5820ff98440280e50bd4dc

SHA512
92d36b9914ed7af35c64e25b57832359dcc6db1734b6a4fd0b594606bc7559ec22437d7c9509310ebf27329acdf6c73e570476ba04a97533c2b1a9a23b42b81e

Download Submit
C:\Windows\SysWOW64\Gphphj32.exe

Filesize
366KB

MD5
a4886cf99daefcebd9a935ca42620360

SHA1
5ba10e6eca8f1ce2e4b6b88d112b5a72c48c0b52

SHA256
8f10742217b815e3da656c0e821944411b76fa688c1a98cad76730a68d35cc4e

SHA512
51907e04d3ac3db35e7c79df07c87402f0dc14820776e7c3a7d2d9a989c269c4408e9de895177ae11c762e392cbca5806356103d4f58be2cd359ee2bd6932e81

Download Submit
C:\Windows\SysWOW64\Gphphj32.exe

Filesize
366KB

MD5
a4886cf99daefcebd9a935ca42620360

SHA1
5ba10e6eca8f1ce2e4b6b88d112b5a72c48c0b52

SHA256
8f10742217b815e3da656c0e821944411b76fa688c1a98cad76730a68d35cc4e

SHA512
51907e04d3ac3db35e7c79df07c87402f0dc14820776e7c3a7d2d9a989c269c4408e9de895177ae11c762e392cbca5806356103d4f58be2cd359ee2bd6932e81

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
366KB

MD5
db5b4fc254b91ca5d7dd43ffb2e463bd

SHA1
2997211bcb5997b97a0116400f497dcf65cdb2e2

SHA256
e06949f86a68ff12fdb686e29d3b8751ad090c96e582cfa62d0a7ac23df0e5f3

SHA512
344fa393654fd37718aaf70f7ac60c53b15b320def35d4f949fb3b7f384a9018e3d4bc4b3ceaf7da29fa6ee484f18fbfa979a51f2b77b3df3ec447caa7571fbc

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
366KB

MD5
db5b4fc254b91ca5d7dd43ffb2e463bd

SHA1
2997211bcb5997b97a0116400f497dcf65cdb2e2

SHA256
e06949f86a68ff12fdb686e29d3b8751ad090c96e582cfa62d0a7ac23df0e5f3

SHA512
344fa393654fd37718aaf70f7ac60c53b15b320def35d4f949fb3b7f384a9018e3d4bc4b3ceaf7da29fa6ee484f18fbfa979a51f2b77b3df3ec447caa7571fbc

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
366KB

MD5
aedb53da1550d1a893169a80cf921d10

SHA1
8a98b4621dfca9d749b7e6b615cf9d3014407ef7

SHA256
c586c7803d29eef9bab13343628d9a9f56cb3761b9d0f28ce80d8426686813e0

SHA512
e4725b6806e5c1f9e5faf7c71f049bf21010c06b48e5330a4d3e2fa764b81aec389496cdb644b7932e9e8b749ef19d2ef923603e533b2fa04f453b742e837e30

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
366KB

MD5
b6d48a12174ffac87d97bc924ec15557

SHA1
99968fc4a241ead9e26c2a8cb1a02040f3a3b4b1

SHA256
4b8b5c1344d2873eb017c3e26d9cd3c880d3ccbeb2dac28feda79d169bd09871

SHA512
e1a68018c5f7baad17144cb2192520d4f8fc008c15defd76489a4f5fab319e517172568a9ff2b1620a8d4f8593428c0ffb52e0248486dfc73040238334f2e03d

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
366KB

MD5
b6d48a12174ffac87d97bc924ec15557

SHA1
99968fc4a241ead9e26c2a8cb1a02040f3a3b4b1

SHA256
4b8b5c1344d2873eb017c3e26d9cd3c880d3ccbeb2dac28feda79d169bd09871

SHA512
e1a68018c5f7baad17144cb2192520d4f8fc008c15defd76489a4f5fab319e517172568a9ff2b1620a8d4f8593428c0ffb52e0248486dfc73040238334f2e03d

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
366KB

MD5
fdfc2acbde5f199b88731ab65b573d69

SHA1
82a0b5963a5cb962ae55704d06614f91f3c79bc3

SHA256
cd32bcfde81fde1b56eed73902ef42c0f9c1395c9e879e043027ed1b1e9c9a77

SHA512
da36028b7fe0a180543e3cbe3fd3169d0e992d69fc786cc7cc04d65a145f70ce9612fc660405b8152f6a6b7c8c157cbda47100dbfa9567077b354717794f0203

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
366KB

MD5
fdfc2acbde5f199b88731ab65b573d69

SHA1
82a0b5963a5cb962ae55704d06614f91f3c79bc3

SHA256
cd32bcfde81fde1b56eed73902ef42c0f9c1395c9e879e043027ed1b1e9c9a77

SHA512
da36028b7fe0a180543e3cbe3fd3169d0e992d69fc786cc7cc04d65a145f70ce9612fc660405b8152f6a6b7c8c157cbda47100dbfa9567077b354717794f0203

Download Submit
C:\Windows\SysWOW64\Hlegnjbm.exe

Filesize
366KB

MD5
4a4e439417ff32163079714e6e26c7e1

SHA1
57f40a993f6ccb2ee9e331e96a70e77f0dc29eb7

SHA256
06d0f1753005cb1055cc5829725255f037a21ca0579f4a554452ae435db18020

SHA512
f885d2fed3000084564d2505e3c98c573635cf124279bd5ef3e3cce6cbadb12b51abbe3757c6e1fbb04b70c8a798221fe94cc734eb72dd2a00004bbd04f70c77

Download Submit
C:\Windows\SysWOW64\Hlegnjbm.exe

Filesize
366KB

MD5
4a4e439417ff32163079714e6e26c7e1

SHA1
57f40a993f6ccb2ee9e331e96a70e77f0dc29eb7

SHA256
06d0f1753005cb1055cc5829725255f037a21ca0579f4a554452ae435db18020

SHA512
f885d2fed3000084564d2505e3c98c573635cf124279bd5ef3e3cce6cbadb12b51abbe3757c6e1fbb04b70c8a798221fe94cc734eb72dd2a00004bbd04f70c77

Download Submit
C:\Windows\SysWOW64\Hlogfd32.exe

Filesize
366KB

MD5
74544d35d6503ffbad352f2231625bdc

SHA1
1171670fa991d9e4b34124392ca973d74d65a3c6

SHA256
d2edf6f1c7b5f67d808fd93a3b35f8b9c074f342286b95467e7fca57c3c292d9

SHA512
b74a1988d9d2ee4c5f75124097c4a78e521e482534c38e3ea3fdddc95b0fb78c3b94992338ed5c198f200f409571fd3108caeb0552a133f0eb8f1df03d99cd66

Download Submit
C:\Windows\SysWOW64\Iciaqc32.exe

Filesize
366KB

MD5
2d6460e4dc71cae638c6f5e6d136b1d0

SHA1
6f271c2219d404e526af56c944689ebdf4bb8bd4

SHA256
fdc0672d51270f888745a69c0ae5f87d7db4e87d2ecf5d259bbd01cfc613db3d

SHA512
96342df44d8003ffd3a1992e0accc3c212dd3417c28e968ca434743594dda757b5067e6d265b6be63d952ecf5444f72d44321e5d613de771f492629e146a38ca

Download Submit
C:\Windows\SysWOW64\Iciaqc32.exe

Filesize
366KB

MD5
94a8a3f86346f048e525aa0cd35caa3a

SHA1
16b27ba84860ca2ff5e74348b72ae0f219898a05

SHA256
9ca6e1281473c93b801ea8c52c047c6105b2deeb61cda744cd39e9936a0774c2

SHA512
80ada6ebea1fce4cc1365f9f7c892a873439e1dc56ceb72d12c6d7a99d7d3706268b120cad76b144c272b79f3c4737aad62c1deab7416d9e60b82f0ae406ed8b

Download Submit
C:\Windows\SysWOW64\Iciaqc32.exe

Filesize
366KB

MD5
94a8a3f86346f048e525aa0cd35caa3a

SHA1
16b27ba84860ca2ff5e74348b72ae0f219898a05

SHA256
9ca6e1281473c93b801ea8c52c047c6105b2deeb61cda744cd39e9936a0774c2

SHA512
80ada6ebea1fce4cc1365f9f7c892a873439e1dc56ceb72d12c6d7a99d7d3706268b120cad76b144c272b79f3c4737aad62c1deab7416d9e60b82f0ae406ed8b

Download Submit
C:\Windows\SysWOW64\Idahjg32.exe

Filesize
366KB

MD5
2d6460e4dc71cae638c6f5e6d136b1d0

SHA1
6f271c2219d404e526af56c944689ebdf4bb8bd4

SHA256
fdc0672d51270f888745a69c0ae5f87d7db4e87d2ecf5d259bbd01cfc613db3d

SHA512
96342df44d8003ffd3a1992e0accc3c212dd3417c28e968ca434743594dda757b5067e6d265b6be63d952ecf5444f72d44321e5d613de771f492629e146a38ca

Download Submit
C:\Windows\SysWOW64\Idahjg32.exe

Filesize
366KB

MD5
2d6460e4dc71cae638c6f5e6d136b1d0

SHA1
6f271c2219d404e526af56c944689ebdf4bb8bd4

SHA256
fdc0672d51270f888745a69c0ae5f87d7db4e87d2ecf5d259bbd01cfc613db3d

SHA512
96342df44d8003ffd3a1992e0accc3c212dd3417c28e968ca434743594dda757b5067e6d265b6be63d952ecf5444f72d44321e5d613de771f492629e146a38ca

Download Submit
C:\Windows\SysWOW64\Idkkpf32.exe

Filesize
366KB

MD5
e3a936e733ce7f0da2a2ad08338236b3

SHA1
de940f5bca34f822e3c10cb0b892f10cf92aa463

SHA256
09e4d7787b340b40d44e4fbb241e0dc1120ba80df5f3e702a6a1b4170b103a4a

SHA512
8d8f6a8497e5f5aeab615accc49456e6caa8ff1d58b24ada6b8b21cdb3141465d26d39b0fbdaaea3731b5e793e97fce781fc0ee5ca3c05f0dbd819dd97083118

Download Submit
C:\Windows\SysWOW64\Idkkpf32.exe

Filesize
366KB

MD5
e3a936e733ce7f0da2a2ad08338236b3

SHA1
de940f5bca34f822e3c10cb0b892f10cf92aa463

SHA256
09e4d7787b340b40d44e4fbb241e0dc1120ba80df5f3e702a6a1b4170b103a4a

SHA512
8d8f6a8497e5f5aeab615accc49456e6caa8ff1d58b24ada6b8b21cdb3141465d26d39b0fbdaaea3731b5e793e97fce781fc0ee5ca3c05f0dbd819dd97083118

Download Submit
C:\Windows\SysWOW64\Idkkpf32.exe

Filesize
366KB

MD5
e3a936e733ce7f0da2a2ad08338236b3

SHA1
de940f5bca34f822e3c10cb0b892f10cf92aa463

SHA256
09e4d7787b340b40d44e4fbb241e0dc1120ba80df5f3e702a6a1b4170b103a4a

SHA512
8d8f6a8497e5f5aeab615accc49456e6caa8ff1d58b24ada6b8b21cdb3141465d26d39b0fbdaaea3731b5e793e97fce781fc0ee5ca3c05f0dbd819dd97083118

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
366KB

MD5
65bac8ff8017bf48c5e20e92be3bb06f

SHA1
7e999435ee416b194af6835afe7d9a1fbb378bf9

SHA256
3a2d9cdab8130825660c80140c86ecb4b32ccd8dd9ed5322986f5652f1a8c0ba

SHA512
90d1e4aa475787bf3b0b4a46ae865aeabdd4ab9135fdc6bf3e75d41fabea4b45c20d0e31253e2496f4b55fcac340200bd70bcf4f006bbe0f3fd98f9fbade73fb

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
366KB

MD5
8cae0fc7f8efae8618158a56cd3cdcc6

SHA1
2bc34de2493a73035284b327aafbc0407c8811b1

SHA256
af0ebfb5893add6ba88505e0ad0ee655f7f9063f885c5a4235702c19b28f893a

SHA512
350527f0c09acf2dc19d9b15b27a3b018570e52026b77343e143d4d96163e0b18796d7d7fb279a4712ebf98c68511c722c4638a0b62e87d9883a96a003159bb0

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
366KB

MD5
8cae0fc7f8efae8618158a56cd3cdcc6

SHA1
2bc34de2493a73035284b327aafbc0407c8811b1

SHA256
af0ebfb5893add6ba88505e0ad0ee655f7f9063f885c5a4235702c19b28f893a

SHA512
350527f0c09acf2dc19d9b15b27a3b018570e52026b77343e143d4d96163e0b18796d7d7fb279a4712ebf98c68511c722c4638a0b62e87d9883a96a003159bb0

Download Submit
C:\Windows\SysWOW64\Jcphab32.exe

Filesize
366KB

MD5
37155bd5e2c6be1c94f8604bcbfa8f43

SHA1
755a88e526e1d67da130e833c0c99643d5435144

SHA256
20b8730d069ea799ba07d473dc25a1e900bcb8ab4ded5e67df9cacd5cf3b2f53

SHA512
3bea23b33257ae7eed32eec7b692e69eb965491a15e2c0d3fd716bc44f44fdd10fe1a368d56fc7c9eaf0774bef51afb74e991e3733eecdd118bbdb763756721d

Download Submit
C:\Windows\SysWOW64\Jcphab32.exe

Filesize
366KB

MD5
37155bd5e2c6be1c94f8604bcbfa8f43

SHA1
755a88e526e1d67da130e833c0c99643d5435144

SHA256
20b8730d069ea799ba07d473dc25a1e900bcb8ab4ded5e67df9cacd5cf3b2f53

SHA512
3bea23b33257ae7eed32eec7b692e69eb965491a15e2c0d3fd716bc44f44fdd10fe1a368d56fc7c9eaf0774bef51afb74e991e3733eecdd118bbdb763756721d

Download Submit
C:\Windows\SysWOW64\Jdodkebj.exe

Filesize
366KB

MD5
a21e2654a9cbd0ef66244258ab80f7c1

SHA1
8488618f4df9dcc31254383bf5a707c922f1365d

SHA256
1687c2d3bbd4fb53667b1ed8da6c369c7093ac18ac696c8e08a3a5040b4ba30f

SHA512
5fd601ce5eeaba3256bdabbf2aa7d68de56d3cbcf7a78b8e559505fbcc0b7ef8a3dbc533934ddb156c5f2142db2b16f5818b87d811d9c915fd2cf752e80d70de

Download Submit
C:\Windows\SysWOW64\Jdodkebj.exe

Filesize
366KB

MD5
a21e2654a9cbd0ef66244258ab80f7c1

SHA1
8488618f4df9dcc31254383bf5a707c922f1365d

SHA256
1687c2d3bbd4fb53667b1ed8da6c369c7093ac18ac696c8e08a3a5040b4ba30f

SHA512
5fd601ce5eeaba3256bdabbf2aa7d68de56d3cbcf7a78b8e559505fbcc0b7ef8a3dbc533934ddb156c5f2142db2b16f5818b87d811d9c915fd2cf752e80d70de

Download Submit
C:\Windows\SysWOW64\Jgpmmp32.exe

Filesize
366KB

MD5
6b6491db8e6ba9cf467b28777c312c22

SHA1
bada79e49ba16eaa87d509dea04f9da4e8ca1e37

SHA256
86a508bc5146c885536730aeb9e0ff51e7338743b1059026d14b68d904c62125

SHA512
e8b04cb810f41ea0bfe2c57ee3d040ad9628992a4f6948374147301f756422642b3b5b6f38c4b407d8c425f501c49372d9bca1c9b05f5f574b24d841de96d1fb

Download Submit
C:\Windows\SysWOW64\Jgpmmp32.exe

Filesize
366KB

MD5
6b6491db8e6ba9cf467b28777c312c22

SHA1
bada79e49ba16eaa87d509dea04f9da4e8ca1e37

SHA256
86a508bc5146c885536730aeb9e0ff51e7338743b1059026d14b68d904c62125

SHA512
e8b04cb810f41ea0bfe2c57ee3d040ad9628992a4f6948374147301f756422642b3b5b6f38c4b407d8c425f501c49372d9bca1c9b05f5f574b24d841de96d1fb

Download Submit
C:\Windows\SysWOW64\Jmmcgbnf.exe

Filesize
366KB

MD5
f9aa3d2ef7ece447bbd000ce6f1f8a11

SHA1
06acb64dbe923bd8f3d15cd91751e7c6f85f105a

SHA256
3443e40337a1dc8634892a46f1d79d9b6653830d682a391ae7c5ddcb73f81121

SHA512
02464f179945b370dfed7e6897bbd78d93bf0b772f692312eb2d9c28764eb47b8ff26e1c6d0ae5c7d0b3aa1f0eb7bf89e6f072a96a7430ccb3b364a1b7b2bfaf

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
366KB

MD5
65bac8ff8017bf48c5e20e92be3bb06f

SHA1
7e999435ee416b194af6835afe7d9a1fbb378bf9

SHA256
3a2d9cdab8130825660c80140c86ecb4b32ccd8dd9ed5322986f5652f1a8c0ba

SHA512
90d1e4aa475787bf3b0b4a46ae865aeabdd4ab9135fdc6bf3e75d41fabea4b45c20d0e31253e2496f4b55fcac340200bd70bcf4f006bbe0f3fd98f9fbade73fb

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
366KB

MD5
65bac8ff8017bf48c5e20e92be3bb06f

SHA1
7e999435ee416b194af6835afe7d9a1fbb378bf9

SHA256
3a2d9cdab8130825660c80140c86ecb4b32ccd8dd9ed5322986f5652f1a8c0ba

SHA512
90d1e4aa475787bf3b0b4a46ae865aeabdd4ab9135fdc6bf3e75d41fabea4b45c20d0e31253e2496f4b55fcac340200bd70bcf4f006bbe0f3fd98f9fbade73fb

Download Submit
C:\Windows\SysWOW64\Kcpahpmd.exe

Filesize
366KB

MD5
aac7736d8e3ddbf33157e5cc878a0679

SHA1
c96b08213102d77b351904cdbdee0974ad817de3

SHA256
1b8a94ed2f0066eea81ded4b667f1a2cc6956e8d6363caace8afa2f4be258f3c

SHA512
e8438c958f60f9584c025d09c396a5617a14bff3e633528338d6f51d425bf184b404b2258ca9cc03ec4c5d4f1e8376c25d9cfa0996adf72e8c0675828bddb0f0

Download Submit
C:\Windows\SysWOW64\Kcpahpmd.exe

Filesize
366KB

MD5
aac7736d8e3ddbf33157e5cc878a0679

SHA1
c96b08213102d77b351904cdbdee0974ad817de3

SHA256
1b8a94ed2f0066eea81ded4b667f1a2cc6956e8d6363caace8afa2f4be258f3c

SHA512
e8438c958f60f9584c025d09c396a5617a14bff3e633528338d6f51d425bf184b404b2258ca9cc03ec4c5d4f1e8376c25d9cfa0996adf72e8c0675828bddb0f0

Download Submit
C:\Windows\SysWOW64\Kdkdgchl.exe

Filesize
366KB

MD5
2174e82d51c5a01c09e75bce67d1c3ac

SHA1
a52023c0e3685af98a0ffaf62e1afa87449aaaae

SHA256
6e4b10535a8ae6a7a54e961d743cc2f4ed22479761d037a7086894366b0e5f18

SHA512
eb1b3e81ae548d7087cb363833a3f5d21c9a50e711de80abfa102e4579ed0391e0fb9ab3dd3bc35e201dbe391502011b8e38e3fc74a354e3348fe6118c7d2bbe

Download Submit
C:\Windows\SysWOW64\Kdkdgchl.exe

Filesize
366KB

MD5
2174e82d51c5a01c09e75bce67d1c3ac

SHA1
a52023c0e3685af98a0ffaf62e1afa87449aaaae

SHA256
6e4b10535a8ae6a7a54e961d743cc2f4ed22479761d037a7086894366b0e5f18

SHA512
eb1b3e81ae548d7087cb363833a3f5d21c9a50e711de80abfa102e4579ed0391e0fb9ab3dd3bc35e201dbe391502011b8e38e3fc74a354e3348fe6118c7d2bbe

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
366KB

MD5
b33b30aa3538016836f3b45ee56b98ab

SHA1
326013eff6aa1a42171194d5c03bc79fbafc4b45

SHA256
ec804327007eab455f2696fd79c1bfc44200da9717de879189ef484a5b25b453

SHA512
31e4b5a87e1bdba5e8f15a2d943a81dda1741a33205a86f4e8a958fca2f7db5500d04a2322dd607d2a9b8a143bb57e4710cb79862ca1acfd05d3c310f346b657

Download Submit
C:\Windows\SysWOW64\Kkjeomld.exe

Filesize
366KB

MD5
f8b6e54d9a42fa82726fb845d60c6587

SHA1
1c48411b2b27809c9ae277d495386c529108d045

SHA256
08fb78b58ec08c3ac6538da5bf738dd4d824af462fd656d048d2e9927214df81

SHA512
899334b4fcb125f4e19b2b61c6e76483ec1ed6fa5c9ab613e525e148a48b44c09cc319b5cf2d85ddab303cb57f5d65694dfaa23083a558046a88f7014832c8dc

Download Submit
C:\Windows\SysWOW64\Kkjeomld.exe

Filesize
366KB

MD5
f8b6e54d9a42fa82726fb845d60c6587

SHA1
1c48411b2b27809c9ae277d495386c529108d045

SHA256
08fb78b58ec08c3ac6538da5bf738dd4d824af462fd656d048d2e9927214df81

SHA512
899334b4fcb125f4e19b2b61c6e76483ec1ed6fa5c9ab613e525e148a48b44c09cc319b5cf2d85ddab303cb57f5d65694dfaa23083a558046a88f7014832c8dc

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
366KB

MD5
8a90d4905356d1699026c5a1ab31ecc6

SHA1
a351f0a33338f7cd2ef115e9cedef296df11b2ad

SHA256
5b7e1279b84461a7f4af568af569cc1ee0bf7785a9889e74f7c953435a5e7130

SHA512
cb89d9b6dd25a76af2e9dd44d693a217574789ff0b8ecf647396465a7a087b3a78551f684edfdcb20ff254686468d4f3e42bcbc419ac4f28c8e55d6182dcf35e

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
366KB

MD5
8a90d4905356d1699026c5a1ab31ecc6

SHA1
a351f0a33338f7cd2ef115e9cedef296df11b2ad

SHA256
5b7e1279b84461a7f4af568af569cc1ee0bf7785a9889e74f7c953435a5e7130

SHA512
cb89d9b6dd25a76af2e9dd44d693a217574789ff0b8ecf647396465a7a087b3a78551f684edfdcb20ff254686468d4f3e42bcbc419ac4f28c8e55d6182dcf35e

Download Submit
C:\Windows\SysWOW64\Lgepom32.exe

Filesize
366KB

MD5
4b5c38e56fd2fa748c6faf9fea88680e

SHA1
5b7ef2c6bfa3bcc8f09034273dd820913cba4139

SHA256
7c1890fe98caf8c7dc509eafc11ddee678efdbcd6e3a42e85aa07a48be40cc7c

SHA512
7842878abde735869b9ca0b3fd85e0dd68039ef9f219381105e74e6823c73951de838b1c9323ca144a62a08541062b2110f76c116ce82370e7c1cd37a6e61532

Download Submit
C:\Windows\SysWOW64\Lgepom32.exe

Filesize
366KB

MD5
4b5c38e56fd2fa748c6faf9fea88680e

SHA1
5b7ef2c6bfa3bcc8f09034273dd820913cba4139

SHA256
7c1890fe98caf8c7dc509eafc11ddee678efdbcd6e3a42e85aa07a48be40cc7c

SHA512
7842878abde735869b9ca0b3fd85e0dd68039ef9f219381105e74e6823c73951de838b1c9323ca144a62a08541062b2110f76c116ce82370e7c1cd37a6e61532

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
366KB

MD5
1ad3bcbac853ce0f8c1f7add5616d827

SHA1
5241ecad4dae369d992653cad24e0794d67c1741

SHA256
35d012f007d9cf766c7ccb818300ba27705ca0e34a63b57cd2fbad2673e80f95

SHA512
36a4f250c6e182dd072b7441172b07ee49aebf55910ef3fb2fc8cd48ef721539c7ebd4ddedf62fd4bc6a348af8aae836d2ab3fc60722816bf3faed3ca3e2ca42

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
366KB

MD5
1ad3bcbac853ce0f8c1f7add5616d827

SHA1
5241ecad4dae369d992653cad24e0794d67c1741

SHA256
35d012f007d9cf766c7ccb818300ba27705ca0e34a63b57cd2fbad2673e80f95

SHA512
36a4f250c6e182dd072b7441172b07ee49aebf55910ef3fb2fc8cd48ef721539c7ebd4ddedf62fd4bc6a348af8aae836d2ab3fc60722816bf3faed3ca3e2ca42

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
366KB

MD5
3a7a22e49f4a74466de4cb125a20f9f8

SHA1
f6752ceb855df86a83063404459cecd8453dee60

SHA256
06cc4f552733752cfb6acd480a4bdea58cec1f44a8d2bfaa730b362add1a8d97

SHA512
b2d29508ac079bfdd5905bacc0d202eaf4e64b61397f8ea76621367545637881e1d00a99e61ddcacd895fcd1a9e132ccb594fbee7e7c9c3689c9bfbc8735a9b9

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
366KB

MD5
3a7a22e49f4a74466de4cb125a20f9f8

SHA1
f6752ceb855df86a83063404459cecd8453dee60

SHA256
06cc4f552733752cfb6acd480a4bdea58cec1f44a8d2bfaa730b362add1a8d97

SHA512
b2d29508ac079bfdd5905bacc0d202eaf4e64b61397f8ea76621367545637881e1d00a99e61ddcacd895fcd1a9e132ccb594fbee7e7c9c3689c9bfbc8735a9b9

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
64KB

MD5
45920eee8ef4b4ae5b6bfc9549991809

SHA1
ff5964ca6603eb5dc5aac3d85e00a58b434f2458

SHA256
344ed51db7390814b129c99f0671034f518188df7f09f87c98bab1c1173d8859

SHA512
7ffcf3d36dfefc22dacb48d6b744a7506758162c21d2ad186b4878f224f058e42f0a0d5b7c554aa13254a3527ef4c848463c7a9572574a6a6433ec5b565c0141

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
366KB

MD5
f5bbc3bbf34f70fe5ecb5e5562a542af

SHA1
bc8651a4c2d0c2b1e15f8385ae78a9479a51bbc3

SHA256
7a434b102abed93ebfc3f2365ddbe82c24ba3b52391001514a5a5c826b98d32c

SHA512
a421be53b2276a908f6ae018b28e5483ad5b681fbb70c26dc041899d0042549e2356d93f43290d965d9b64fe5c405ff47c38dce92c1c88f2b1ca9c48b7c5083d

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
366KB

MD5
f5bbc3bbf34f70fe5ecb5e5562a542af

SHA1
bc8651a4c2d0c2b1e15f8385ae78a9479a51bbc3

SHA256
7a434b102abed93ebfc3f2365ddbe82c24ba3b52391001514a5a5c826b98d32c

SHA512
a421be53b2276a908f6ae018b28e5483ad5b681fbb70c26dc041899d0042549e2356d93f43290d965d9b64fe5c405ff47c38dce92c1c88f2b1ca9c48b7c5083d

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
366KB

MD5
37d59ecd3bb2f70c3b2e74fc4385e6ff

SHA1
a6e2032b510f10bd96a28cbd4c7e9c70c24095db

SHA256
d692ccf3fb533f08e735828d38a010b4e22b6c9c951a7290257741ac9afe9858

SHA512
2ea06d3f4f5603d885f0683629b944fec73445d92805ad87477e8eabbb83d50237818924b806d44b53c95a003930a3ae323aa073b9ea45e66445ff0f256cc387

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
366KB

MD5
37d59ecd3bb2f70c3b2e74fc4385e6ff

SHA1
a6e2032b510f10bd96a28cbd4c7e9c70c24095db

SHA256
d692ccf3fb533f08e735828d38a010b4e22b6c9c951a7290257741ac9afe9858

SHA512
2ea06d3f4f5603d885f0683629b944fec73445d92805ad87477e8eabbb83d50237818924b806d44b53c95a003930a3ae323aa073b9ea45e66445ff0f256cc387

Download Submit
C:\Windows\SysWOW64\Lpfgmnfp.exe

Filesize
366KB

MD5
792d7a7688133147d6737e3126535a0a

SHA1
e071d2d05bdaaf2afcf00e70fc90cb007949a1e9

SHA256
776ec07948d803501ad50b1134f36c7d36c5aa8e172f7908a990f10a19e60038

SHA512
542241a87622bbd7902b63b53d0a0abe4cefce68db0ac6ea5c9742bb8e6548cc41b0cfcced67067558d577f6df84527d8f707515da4cb429a589f528af58fb7f

Download Submit
C:\Windows\SysWOW64\Mcqjon32.exe

Filesize
366KB

MD5
d8474e44fa79679d463cf091f675176d

SHA1
a69b46892945f86f690a79a180b91be257a817d5

SHA256
f66d546dcfdf399747d552b5faa7662965be22a364ed5858d16d0d2754e38d4e

SHA512
4ef4a27bd65ef3fd290d751cdc46f54f77afc1b495d4f15695665fcbcd73c8f0cc2715fb5ca4b35bf11ad924bd61829eeaccf6351f0c442ab587946020da1930

Download Submit
C:\Windows\SysWOW64\Mcqjon32.exe

Filesize
366KB

MD5
d8474e44fa79679d463cf091f675176d

SHA1
a69b46892945f86f690a79a180b91be257a817d5

SHA256
f66d546dcfdf399747d552b5faa7662965be22a364ed5858d16d0d2754e38d4e

SHA512
4ef4a27bd65ef3fd290d751cdc46f54f77afc1b495d4f15695665fcbcd73c8f0cc2715fb5ca4b35bf11ad924bd61829eeaccf6351f0c442ab587946020da1930

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
366KB

MD5
e2264f32271a6cc1680cf368bc419669

SHA1
2c91b685e90463422ae1dc82a3b6d820fdb7058f

SHA256
2fddf05b01012d28f655ae9533ac1c0fb7d6fcce6a4b97bc1f954c07bbf79bb2

SHA512
bed632faf56b587af2a8d113677cb0cc2f5ec25fbdf62c4af910e217ba0be4974c8444f6686211139804cffab74271bbc0052a103c352b75864510038152a516

Download Submit
C:\Windows\SysWOW64\Mkjnfkma.exe

Filesize
366KB

MD5
d25f1422242003c0597ac4d5093e20ec

SHA1
69a5ce41e540d41a241517c1ad793ca5bd5bbdf7

SHA256
acb64fc85e72528eb6e4447c8cbf784836594888e97b288fbf5660b0b303f857

SHA512
ff8f5d9ec858563899364cca384bbd8c0c7736dc54e50911827a66c66bdef55cbf238248a6c33066478d68929bdb35c534fe9f469b6db778b6e8914b39d6ca69

Download Submit
C:\Windows\SysWOW64\Mkjnfkma.exe

Filesize
366KB

MD5
d25f1422242003c0597ac4d5093e20ec

SHA1
69a5ce41e540d41a241517c1ad793ca5bd5bbdf7

SHA256
acb64fc85e72528eb6e4447c8cbf784836594888e97b288fbf5660b0b303f857

SHA512
ff8f5d9ec858563899364cca384bbd8c0c7736dc54e50911827a66c66bdef55cbf238248a6c33066478d68929bdb35c534fe9f469b6db778b6e8914b39d6ca69

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
366KB

MD5
48b8a6eaf200a6fb8d17aa252649d00f

SHA1
3e9ce20fdce941207a224e7484ae2a212b0cb306

SHA256
01490f09aef4d3c954c6c2c79ee4e113749ad0c95d598e546277de6418e60743

SHA512
6933e296d1bff55f72180e05e5721562db60849e2de8ced7806977fa880720c9bb9dc414cf308ea0ad6c2c244a83b807858b9d0928f4c62bfa3fd99ba1ec5c7f

Download Submit
C:\Windows\SysWOW64\Nkncno32.exe

Filesize
366KB

MD5
c84c08cc1af1bf9e916c1fff446f415e

SHA1
ee94f995ee04588eb4b2f2cdf342b32d231e08b6

SHA256
0136b68e5bedb3f284557a2740802c74cb89caf1bf459231f53d671279ca2f84

SHA512
c92f2387fbbd8660787c7d602dfd0c6ec2537a8f4ab415c949a9209a8b431516730ef189bb8cdebf17b6f6aa8416354bbf0e4174db0e30c62c4bb2f8d5f79292

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
366KB

MD5
07543bc87034dc3058019c3e6fbe1411

SHA1
0e85034918ad7b9917178ae818c048d62b15e264

SHA256
0abca383a8c0acaa47109d3e840d366b938f050847a7f4d190a34b7bf7fe5a64

SHA512
8c20fb029fd087c47919eb3d00c1d9c127cdf902443b022acfa264bea348f0a9501fa4c99dc79d42f999a4d8b43b8dfc29d07c38f0ee567492da22fb1aa9559c

Download Submit
C:\Windows\SysWOW64\Ombcji32.exe

Filesize
366KB

MD5
4f7850b98565c103e3d6214809ea00d2

SHA1
ac5af8792ebaf9aa147918748bff1a6ed5ec8c7b

SHA256
cce49e43b607ef6767898b2eb17b609005fa3fafac9bf7b32be293301ea6e341

SHA512
4e0c5adb1174dccc963dd121b741b5d496e958a308ecd693238dc84230e690eb96f4c6153f8085f680e9c9c25458d37d6c8eb337a222ae98e08d2f7327b9a251

Download Submit
C:\Windows\SysWOW64\Omegjomb.exe

Filesize
366KB

MD5
5990c693a7f6b76799ecccfc86ffa479

SHA1
3c76c4a103be6ed476d351dc93458bd0f612cd4c

SHA256
7f0d0f97ada811c5b0903a86937d3d30071ee5b2d39d645c0828aefb18f6c6a8

SHA512
0de75dbb7f6b70a96a45ca4b648e0ed291dc97ce0f97c851c1e66ff0526438773f42d33c9f0ae1eb12839f3a970117ce0dccd96b2141a8076841418640cc8fb1

Download Submit
C:\Windows\SysWOW64\Qhkdof32.exe

Filesize
366KB

MD5
7e85628aa12135cdebc990eb73019586

SHA1
ea7064092239fca5d1508e40fb816bb83732266d

SHA256
cda48734973fb6dd1baacb7350cf620f78d79273063930f15ee499a1754fab55

SHA512
3f3e4c6e3071a051d7b5f2508b6801a8287cf4abf8049be0a6795480214f341592d60ed3904451b367c4ade047c018b24ee56cfb041754aff5bd8a052fe09c59

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
366KB

MD5
a5ad37ce88174046eea7c938a547dcc1

SHA1
94f4a7d256c1efd1a7c7c7e0475e10e6aac399e5

SHA256
5abb1612e099e7a2f283b347a5a972a3c58d05d0a2351a98c2a9268e193968b1

SHA512
b85bc91476b5640371dc3e5f19c2b43594dc524ae4e8488d6969c43f4bde528c3db3e27b26f9f35e8429dd67b87690efa58b3c00d1903d73475b82aa38a1e40b

Download Submit
memory/8-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-154-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/316-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-373-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/456-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/572-211-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/960-227-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1016-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1068-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-83-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1832-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2016-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2044-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2220-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-403-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2320-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-325-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-427-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2508-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2592-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2904-313-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3032-265-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-283-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3180-421-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3184-331-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3288-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3320-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3408-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3412-415-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3548-235-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3924-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-58-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4076-147-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4088-203-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-277-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4168-343-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4220-319-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-163-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-195-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-131-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-397-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4800-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4820-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4880-379-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4924-433-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5056-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads