0c363c28b701fd4e41ab0bf60b6c67bdb4e83de6db9ace44873706e0c153bfce

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe
Size

111KB
MD5

94ca53ff975bc7917bfdbc759bcb1cd0
SHA1

fb591b13f39ab698579a26390e9d84f2592967d7
SHA256

0c363c28b701fd4e41ab0bf60b6c67bdb4e83de6db9ace44873706e0c153bfce
SHA512

e1f9226c8de402f0b2196493c91e20c06f8eeac4104961a7cdc29d4c96ba6c73192cacbb26b4901319ba1d1855d28859721db64689fda8386ac5c2a8eaef8d64
SSDEEP

3072:EYDztpePvPKepeMw0v0wnJcefSXQHPTTAkvB5Ddj:fqqxKtnJfKXqPTX7DB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eplgeokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlbbkfoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fideeaco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chqogq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkleeplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hefnkkkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickglm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lihfcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fbjena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngmpcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfqkddfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmpjmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgnbaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkgpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aefjii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjaifp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lomqcjie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqafhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjkaabc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caageq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffmfchle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecellgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opemca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dlkbjqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahchda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llgcph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eplnpeol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iomoenej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikaggmii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agbkmijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bqmeal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddjpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngdfdmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glbjggof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpjcgm32.exe

Executes dropped EXE 64 IoCs

pid	Process
5092	Dmefhako.exe
4288	Ddonekbl.exe
4408	Dkifae32.exe
4960	Ddakjkqi.exe
1148	Daekdooc.exe
3912	Dgbdlf32.exe
3792	Dahhio32.exe
3508	Egdqae32.exe
3228	Eajeon32.exe
3908	Ehdmlhcj.exe
1004	Eonehbjg.exe
3096	Ekefmc32.exe
1388	Ehiffh32.exe
1540	Eaakpm32.exe
3104	Emhldnkj.exe
3292	Fdbdah32.exe
1060	Fkllnbjc.exe
4552	Fafdkmap.exe
2632	Fddqghpd.exe
1072	Fgbmccpg.exe
4212	Fdfmlhna.exe
3212	Fajnfl32.exe
4140	Fkcboack.exe
5088	Fehfljca.exe
3440	Foqkdp32.exe
2128	Gekcaj32.exe
3956	Gkjhoq32.exe
3800	Gepmlimi.exe
2868	Gkleeplq.exe
3848	Gafmaj32.exe
1432	Ghpendjj.exe
4416	Ghbbcd32.exe
2704	Hnoklk32.exe
3152	Hghoeqmp.exe
4692	Hdlpneli.exe
4528	Hoadkn32.exe
4320	Hninbj32.exe
3772	Hdbfodfa.exe
3648	Inkjhi32.exe
4248	Igcoqocb.exe
4584	Inmgmijo.exe
1064	Idgojc32.exe
5072	Ikaggmii.exe
4732	Inpccihl.exe
868	Lhijijbg.exe
3784	Lppbkgcj.exe
4840	Lihfcm32.exe
4712	Llgcph32.exe
3464	Lbqklb32.exe
2588	Likcilhh.exe
1780	Lbchba32.exe
2824	Mhppji32.exe
4472	Mojhgbdl.exe
812	Mhbmphjm.exe
864	Mibijk32.exe
224	Mlpeff32.exe
4532	Mbjnbqhp.exe
760	Mlbbkfoq.exe
3088	Npchgdcd.exe
4956	Ngmpcn32.exe
1648	Nlihle32.exe
324	Nbcqiope.exe
1600	Nedjjj32.exe
3384	Npjnhc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cgqqdeod.exe	Cmklglpn.exe
File created	C:\Windows\SysWOW64\Fmlbhekk.dll	Fnipbc32.exe
File opened for modification	C:\Windows\SysWOW64\Jcmdaljn.exe	Impliekg.exe
File opened for modification	C:\Windows\SysWOW64\Jljbeali.exe	Jilfifme.exe
File created	C:\Windows\SysWOW64\Ghbbcd32.exe	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Gefklj32.dll	Hekgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Acpbbi32.exe	Ajhniccb.exe
File created	C:\Windows\SysWOW64\Diffglam.exe	Dgejpd32.exe
File created	C:\Windows\SysWOW64\Folnlh32.dll	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Olaafabl.dll	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Gffnlmnd.dll	Gkjhoq32.exe
File created	C:\Windows\SysWOW64\Jhidngmn.dll	Efhlhh32.exe
File created	C:\Windows\SysWOW64\Bdgged32.exe	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Cpabibmg.dll	Hidgai32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Dhkehk32.dll	Inkjhi32.exe
File created	C:\Windows\SysWOW64\Kpamdcha.dll	Nookip32.exe
File created	C:\Windows\SysWOW64\Ghcjeh32.dll	Enkdaepb.exe
File created	C:\Windows\SysWOW64\Ealkjh32.exe	Eidbij32.exe
File created	C:\Windows\SysWOW64\Mfeeabda.exe	Mokmdh32.exe
File created	C:\Windows\SysWOW64\Apgnjp32.dll	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Aphnnafb.exe	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bahdob32.exe
File created	C:\Windows\SysWOW64\Paedlhhc.dll	Mjokgg32.exe
File opened for modification	C:\Windows\SysWOW64\Ojomcopk.exe	Ngqagcag.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Mhpbkngk.dll	Nmnqjp32.exe
File created	C:\Windows\SysWOW64\Aiffheej.dll	Bllbaa32.exe
File created	C:\Windows\SysWOW64\Mkfefigf.dll	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Cfigpm32.exe	Ajggomog.exe
File created	C:\Windows\SysWOW64\Hlglidlo.exe	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Bkamodje.dll	Bogkmgba.exe
File opened for modification	C:\Windows\SysWOW64\Cibmlmeb.exe	Cgqqdeod.exe
File created	C:\Windows\SysWOW64\Bmhocd32.exe	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	Baegibae.exe
File created	C:\Windows\SysWOW64\Clchbqoo.exe	Camddhoi.exe
File created	C:\Windows\SysWOW64\Glbjggof.exe	Gehbjm32.exe
File created	C:\Windows\SysWOW64\Geaepk32.exe	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Hpiecd32.exe	Hmkigh32.exe
File created	C:\Windows\SysWOW64\Fmhbagkn.dll	Mlbbkfoq.exe
File opened for modification	C:\Windows\SysWOW64\Eiaoid32.exe	Ecefqnel.exe
File opened for modification	C:\Windows\SysWOW64\Hbhijepa.exe	Hpjmnjqn.exe
File created	C:\Windows\SysWOW64\Pkgcea32.exe	Pejkmk32.exe
File created	C:\Windows\SysWOW64\Jhglpo32.dll	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Pdmdnadc.exe	Panhbfep.exe
File opened for modification	C:\Windows\SysWOW64\Apodoq32.exe	Aaldccip.exe
File created	C:\Windows\SysWOW64\Opemca32.exe	Oepifi32.exe
File created	C:\Windows\SysWOW64\Bpnihiio.exe	Bfedoc32.exe
File opened for modification	C:\Windows\SysWOW64\Efhlhh32.exe	Eciplm32.exe
File created	C:\Windows\SysWOW64\Cocopa32.dll	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Pgpecj32.dll	Kgiiiidd.exe
File opened for modification	C:\Windows\SysWOW64\Opadhb32.exe	Oigllh32.exe
File created	C:\Windows\SysWOW64\Lmpkadnm.exe	Kmkbfeab.exe
File opened for modification	C:\Windows\SysWOW64\Felbnn32.exe	Ebnfbcbc.exe
File created	C:\Windows\SysWOW64\Fpbmfn32.exe	Emdajb32.exe
File created	C:\Windows\SysWOW64\Pjinodke.dll	Ahgcjddh.exe
File created	C:\Windows\SysWOW64\Aaafckfg.dll	Ekefmc32.exe
File opened for modification	C:\Windows\SysWOW64\Poaqemao.exe	Pgflqkdd.exe
File created	C:\Windows\SysWOW64\Mbbiec32.dll	Akccap32.exe
File created	C:\Windows\SysWOW64\Lghnikdd.dll	Oiihahme.exe
File created	C:\Windows\SysWOW64\Lfipab32.dll	Emjgim32.exe
File created	C:\Windows\SysWOW64\Bdifpa32.dll	Gfhndpol.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11572	11472	WerFault.exe	693

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eemnff32.dll"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nlihle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cibmlmeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbhijepa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qfbobf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jobfelii.dll"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fajnfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocamjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqcjepfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Higjaoci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flhkmbmp.dll"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flakaffp.dll"	Fpjcgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboeco32.dll"	Glbjggof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqmmqg32.dll"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmjlphl.dll"	Adfgdpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkllnbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Inkjhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocopdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Impliekg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eciplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmigpf32.dll"	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ebnfbcbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ahchda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjpda32.dll"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmiogmig.dll"	Fmkgkapm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ehdmlhcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqopkcbn.dll"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnocia32.dll"	Mqimikfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jphkkpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhidngmn.dll"	Efhlhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Opadhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpdhj32.dll"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjmdlh32.dll"	Hfcnpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iljekoej.dll"	Ejfeng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Djfcaohp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fimodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbikhdcm.dll"	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fkllnbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgbbckh.dll"	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cglgjeci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ickglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojajin32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 5092	3052	NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe	88
PID 3052 wrote to memory of 5092	3052	NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe	88
PID 3052 wrote to memory of 5092	3052	NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe	88
PID 5092 wrote to memory of 4288	5092	Dmefhako.exe	89
PID 5092 wrote to memory of 4288	5092	Dmefhako.exe	89
PID 5092 wrote to memory of 4288	5092	Dmefhako.exe	89
PID 4288 wrote to memory of 4408	4288	Ddonekbl.exe	90
PID 4288 wrote to memory of 4408	4288	Ddonekbl.exe	90
PID 4288 wrote to memory of 4408	4288	Ddonekbl.exe	90
PID 4408 wrote to memory of 4960	4408	Dkifae32.exe	92
PID 4408 wrote to memory of 4960	4408	Dkifae32.exe	92
PID 4408 wrote to memory of 4960	4408	Dkifae32.exe	92
PID 4960 wrote to memory of 1148	4960	Ddakjkqi.exe	93
PID 4960 wrote to memory of 1148	4960	Ddakjkqi.exe	93
PID 4960 wrote to memory of 1148	4960	Ddakjkqi.exe	93
PID 1148 wrote to memory of 3912	1148	Daekdooc.exe	94
PID 1148 wrote to memory of 3912	1148	Daekdooc.exe	94
PID 1148 wrote to memory of 3912	1148	Daekdooc.exe	94
PID 3912 wrote to memory of 3792	3912	Dgbdlf32.exe	95
PID 3912 wrote to memory of 3792	3912	Dgbdlf32.exe	95
PID 3912 wrote to memory of 3792	3912	Dgbdlf32.exe	95
PID 3792 wrote to memory of 3508	3792	Dahhio32.exe	96
PID 3792 wrote to memory of 3508	3792	Dahhio32.exe	96
PID 3792 wrote to memory of 3508	3792	Dahhio32.exe	96
PID 3508 wrote to memory of 3228	3508	Egdqae32.exe	97
PID 3508 wrote to memory of 3228	3508	Egdqae32.exe	97
PID 3508 wrote to memory of 3228	3508	Egdqae32.exe	97
PID 3228 wrote to memory of 3908	3228	Eajeon32.exe	98
PID 3228 wrote to memory of 3908	3228	Eajeon32.exe	98
PID 3228 wrote to memory of 3908	3228	Eajeon32.exe	98
PID 3908 wrote to memory of 1004	3908	Ehdmlhcj.exe	99
PID 3908 wrote to memory of 1004	3908	Ehdmlhcj.exe	99
PID 3908 wrote to memory of 1004	3908	Ehdmlhcj.exe	99
PID 1004 wrote to memory of 3096	1004	Eonehbjg.exe	100
PID 1004 wrote to memory of 3096	1004	Eonehbjg.exe	100
PID 1004 wrote to memory of 3096	1004	Eonehbjg.exe	100
PID 3096 wrote to memory of 1388	3096	Ekefmc32.exe	101
PID 3096 wrote to memory of 1388	3096	Ekefmc32.exe	101
PID 3096 wrote to memory of 1388	3096	Ekefmc32.exe	101
PID 1388 wrote to memory of 1540	1388	Ehiffh32.exe	102
PID 1388 wrote to memory of 1540	1388	Ehiffh32.exe	102
PID 1388 wrote to memory of 1540	1388	Ehiffh32.exe	102
PID 1540 wrote to memory of 3104	1540	Eaakpm32.exe	103
PID 1540 wrote to memory of 3104	1540	Eaakpm32.exe	103
PID 1540 wrote to memory of 3104	1540	Eaakpm32.exe	103
PID 3104 wrote to memory of 3292	3104	Emhldnkj.exe	104
PID 3104 wrote to memory of 3292	3104	Emhldnkj.exe	104
PID 3104 wrote to memory of 3292	3104	Emhldnkj.exe	104
PID 3292 wrote to memory of 1060	3292	Fdbdah32.exe	105
PID 3292 wrote to memory of 1060	3292	Fdbdah32.exe	105
PID 3292 wrote to memory of 1060	3292	Fdbdah32.exe	105
PID 1060 wrote to memory of 4552	1060	Fkllnbjc.exe	106
PID 1060 wrote to memory of 4552	1060	Fkllnbjc.exe	106
PID 1060 wrote to memory of 4552	1060	Fkllnbjc.exe	106
PID 4552 wrote to memory of 2632	4552	Fafdkmap.exe	109
PID 4552 wrote to memory of 2632	4552	Fafdkmap.exe	109
PID 4552 wrote to memory of 2632	4552	Fafdkmap.exe	109
PID 2632 wrote to memory of 1072	2632	Fddqghpd.exe	107
PID 2632 wrote to memory of 1072	2632	Fddqghpd.exe	107
PID 2632 wrote to memory of 1072	2632	Fddqghpd.exe	107
PID 1072 wrote to memory of 4212	1072	Fgbmccpg.exe	108
PID 1072 wrote to memory of 4212	1072	Fgbmccpg.exe	108
PID 1072 wrote to memory of 4212	1072	Fgbmccpg.exe	108
PID 4212 wrote to memory of 3212	4212	Fdfmlhna.exe	110

C:\Users\Admin\AppData\Local\Temp\NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.94ca53ff975bc7917bfdbc759bcb1cd0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\Dmefhako.exe
  C:\Windows\system32\Dmefhako.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\Ddonekbl.exe
    C:\Windows\system32\Ddonekbl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\SysWOW64\Dkifae32.exe
      C:\Windows\system32\Dkifae32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632

C:\Windows\SysWOW64\Fgbmccpg.exe
C:\Windows\system32\Fgbmccpg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\Fdfmlhna.exe
  C:\Windows\system32\Fdfmlhna.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\Fajnfl32.exe
    C:\Windows\system32\Fajnfl32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3212
  - - C:\Windows\SysWOW64\Fkcboack.exe
      C:\Windows\system32\Fkcboack.exe
      4⤵
      Executes dropped EXE
      PID:4140
    - - C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        5⤵
        Executes dropped EXE
        
        PID:5088
      - C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        6⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        7⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        9⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        11⤵
        Executes dropped EXE
        
        PID:3848

C:\Windows\SysWOW64\Ghpendjj.exe
C:\Windows\system32\Ghpendjj.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432
- C:\Windows\SysWOW64\Ghbbcd32.exe
  C:\Windows\system32\Ghbbcd32.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- - C:\Windows\SysWOW64\Hnoklk32.exe
    C:\Windows\system32\Hnoklk32.exe
    3⤵
    - Executes dropped EXE
    PID:2704
  - - C:\Windows\SysWOW64\Hghoeqmp.exe
      C:\Windows\system32\Hghoeqmp.exe
      4⤵
      Executes dropped EXE
      PID:3152
    - - C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        6⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        7⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        8⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        10⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        11⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        12⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        14⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        15⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        16⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        19⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        20⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        21⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        22⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        23⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        24⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        25⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        26⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        27⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        29⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        32⤵
        Executes dropped EXE
        
        PID:324
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        33⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        34⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1844
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        36⤵
        Drops file in System32 directory
        
        PID:1416
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        37⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        38⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        39⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        40⤵
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        41⤵
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        42⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        43⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        44⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        45⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        46⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        48⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        49⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        50⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        51⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        52⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        53⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        54⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        55⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        56⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        57⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        58⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        59⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        60⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        61⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        62⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        63⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        64⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5248
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        66⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        67⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        68⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        69⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        72⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        73⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        74⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        75⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        76⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        77⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        78⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        79⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        80⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        81⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        83⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        84⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        85⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        86⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        87⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        89⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        90⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        92⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        93⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        94⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        95⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        96⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        97⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        98⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        99⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        100⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        101⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        102⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        103⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        104⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        105⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        107⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        108⤵
        Drops file in System32 directory
        
        PID:6520
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        109⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        110⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        111⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        112⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        113⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        114⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        115⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        116⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        117⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        118⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        119⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        120⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        121⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        122⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        123⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        124⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        125⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        126⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        128⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        129⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        130⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        131⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        132⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        133⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        134⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        135⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        136⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        138⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        140⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        141⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        142⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        143⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        144⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        145⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        147⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        148⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        149⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        152⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        153⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        154⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        155⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        156⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        157⤵
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        158⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        159⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:716
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        161⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        162⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        163⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        164⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        165⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        166⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        167⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        168⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        169⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        170⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        172⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        173⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        174⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        175⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        177⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        178⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        179⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        180⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        181⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        182⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        183⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        184⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        185⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        186⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8188
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        188⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        189⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        190⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        191⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        192⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        193⤵
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        194⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        195⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        196⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        197⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        199⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        200⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        201⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        202⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        203⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        204⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        205⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        206⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        207⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        208⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        209⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        210⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        211⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        212⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        213⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        214⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        215⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        216⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        217⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        218⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        219⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        220⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        221⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        222⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        223⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        224⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        225⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        226⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        227⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        228⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        229⤵
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        230⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        232⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        233⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        234⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        235⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        236⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        237⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        238⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        239⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        240⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        241⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        242⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        243⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        244⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        245⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        247⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        248⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        249⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        250⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        251⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        252⤵
        Drops file in System32 directory
        
        PID:9080
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        253⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        254⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        255⤵
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        256⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        257⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        258⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        259⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        260⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        261⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        262⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        263⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        264⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8812
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        266⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        268⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        269⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        270⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        271⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        272⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        273⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        274⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        275⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        276⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        277⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        278⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        279⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        282⤵
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        283⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        284⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        285⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        286⤵
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        287⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        288⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        289⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        290⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5004
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        292⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        293⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        295⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        296⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        297⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        299⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        300⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        301⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        302⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        303⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        304⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        305⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        306⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        307⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        308⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        309⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        310⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        311⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        312⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        313⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        314⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        315⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        316⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        317⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        318⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        319⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        320⤵
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9400
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        322⤵
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        324⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        325⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        326⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        327⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        328⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9812
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        330⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        331⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        332⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        333⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        334⤵
        Drops file in System32 directory
        
        PID:10076
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        335⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        336⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        337⤵
        
        PID:9228

C:\Windows\SysWOW64\Fbgihaji.exe
C:\Windows\system32\Fbgihaji.exe
1⤵
PID:9280
- C:\Windows\SysWOW64\Ffceip32.exe
  C:\Windows\system32\Ffceip32.exe
  2⤵
  PID:9360
- - C:\Windows\SysWOW64\Fiaael32.exe
    C:\Windows\system32\Fiaael32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:9432
  - - C:\Windows\SysWOW64\Fmmmfj32.exe
      C:\Windows\system32\Fmmmfj32.exe
      4⤵
      PID:3280
    - - C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
      - C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        6⤵
        Drops file in System32 directory
        
        PID:9652
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        8⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        9⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        10⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        11⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        12⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        14⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        15⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        16⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        17⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        18⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        19⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        20⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        21⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        22⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        23⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        24⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        25⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        26⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        27⤵
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3792
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        29⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        30⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        31⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        32⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        33⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        34⤵
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        35⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        36⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        37⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        38⤵
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        39⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        41⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        42⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        43⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        44⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        45⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        46⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4916
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        48⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        49⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        50⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        52⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        53⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        54⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        55⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        56⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        57⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4320
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10080
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        60⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        61⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        62⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        63⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        64⤵
        Modifies registry class
        
        PID:1700
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        65⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        66⤵
        Modifies registry class
        
        PID:10296
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        67⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        68⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        69⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        70⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        71⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        72⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10588
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        74⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        75⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        76⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10756
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        78⤵
        Modifies registry class
        
        PID:10800
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        79⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        80⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        81⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        82⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        83⤵
        Modifies registry class
        
        PID:11000
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11052
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11092
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        86⤵
        Modifies registry class
        
        PID:11136
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        87⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        88⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        89⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        90⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        91⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10328
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        93⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10472
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        95⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        96⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        97⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        98⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        99⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        100⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        101⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        102⤵
        Modifies registry class
        
        PID:10988
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11048
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        104⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        105⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        106⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        108⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        109⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        110⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        111⤵
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        112⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        113⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        114⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        115⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        116⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        117⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        118⤵
        Modifies registry class
        
        PID:10980
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11016
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        120⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        121⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        122⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        123⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:916
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        126⤵
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        127⤵
        Modifies registry class
        
        PID:10572
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        128⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        129⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        130⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        131⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        132⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        133⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        134⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        135⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        136⤵
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        137⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3784
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        139⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        140⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        141⤵
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        142⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        143⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        144⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        145⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        146⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        147⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10516
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        149⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        150⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        151⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        152⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        153⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        154⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        155⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        156⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        157⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        158⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        159⤵
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        160⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        161⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        162⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        163⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        164⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        166⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        167⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        168⤵
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        169⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        170⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        171⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        172⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        173⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        174⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        175⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        176⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10960
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        178⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        179⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        180⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        181⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        182⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        183⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        184⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        185⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        186⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        187⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        188⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        189⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        190⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        191⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        192⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        194⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        195⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        196⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        197⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        198⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        199⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        200⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        201⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        202⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        203⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        204⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        205⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        206⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        208⤵
        
        PID:5992

C:\Windows\SysWOW64\Cnaaib32.exe
C:\Windows\system32\Cnaaib32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5552
- C:\Windows\SysWOW64\Cponen32.exe
  C:\Windows\system32\Cponen32.exe
  2⤵
  - Modifies registry class
  PID:6140
- - C:\Windows\SysWOW64\Chfegk32.exe
    C:\Windows\system32\Chfegk32.exe
    3⤵
    PID:5964
  - - C:\Windows\SysWOW64\Ckebcg32.exe
      C:\Windows\system32\Ckebcg32.exe
      4⤵
      PID:5248
    - - C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        5⤵
        
        PID:5848
      - C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        6⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        8⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        10⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        11⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        12⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        13⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        14⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        15⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        16⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        17⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        18⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        19⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        20⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11472 -s 220
        21⤵
        Program crash
        
        PID:11572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 11472 -ip 11472
1⤵
PID:11504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afghneoo.exe

Filesize
111KB

MD5
922bb28e4849a4f42956c771a87e59c2

SHA1
c9077e2ef310138ca2bcb7a327eed4fd7907f205

SHA256
d2947f214be2c20ea92a8630dc5b2b8caec4f37719328688c8044a390e63b7e0

SHA512
eda7afff587d4aab03bb458fb75823ee825c55e735fed577d595e3242c150a72d1e05903f6e27484f30698613f20c81894580e4b92c7c4c0d1955898cb67e70d

Download Submit
C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
111KB

MD5
95bf06567c6d99b45775caee5e81b5f1

SHA1
e53192d6ebc12e1a3c6bc311581321e65016b982

SHA256
943c0da351a9f524518c7e16465ede2eb4e38b1eadd22815e13f10f26cbdf9af

SHA512
109548364355a31611051fe2955c17eece1f6ff0eb100e507fff46338ca07dfbb25c84212d100df2655c0a15d3cdf3ee93ba4e666957e6ec773bb6e546fa73f6

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
111KB

MD5
0f8ac69fe1f5a24910f4c9aee46af1aa

SHA1
b4177f71709aa7b2b7c3052cdc4b87bec82a6245

SHA256
a2f1cc78c40b60815cade23672e16ef24cadf6f2ba7e695a7f357b1a895bafe5

SHA512
221529aba33ea4c0ec3d3438a583354c07eb21d082616baab0b6a25449f220dc27c6f9b1c5ed5c4744e271f6765c1e7cf5800f585860a89f8199b9b6d3bf1770

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
111KB

MD5
f6f603fdcf02bac54a6977c8028cc3b0

SHA1
6d8a24619efc96682097d8c4eab19b02b286dda0

SHA256
162efcc52e0c1bd7e799358c856a297907463ab2aaecd8d33c87893de8d8890d

SHA512
0a3020f1337fdaa610ffd01c1ceef8e3505cf40d796c3092b3d826cd97c6480b3698ba80bacc676ee35fff7ef862d8ca2c4d06647ea6837d171feb53cf861855

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
111KB

MD5
f6f603fdcf02bac54a6977c8028cc3b0

SHA1
6d8a24619efc96682097d8c4eab19b02b286dda0

SHA256
162efcc52e0c1bd7e799358c856a297907463ab2aaecd8d33c87893de8d8890d

SHA512
0a3020f1337fdaa610ffd01c1ceef8e3505cf40d796c3092b3d826cd97c6480b3698ba80bacc676ee35fff7ef862d8ca2c4d06647ea6837d171feb53cf861855

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
111KB

MD5
1bf5038983e14d94c78622067112f7f4

SHA1
de2c75c38477bd86ab0d644859388367d7242c3f

SHA256
42ea4282f27e0a7b63203df81832c24804445901b05379de1c7c7feb8f2395e0

SHA512
a49c84743a1320a46e978cd07d8db5b4d395668c84e0284f30fd23c15748b31f42f9e0139688b50b9edc1162569a11e8693dd1e03678b809dd314f28c2918490

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
111KB

MD5
1bf5038983e14d94c78622067112f7f4

SHA1
de2c75c38477bd86ab0d644859388367d7242c3f

SHA256
42ea4282f27e0a7b63203df81832c24804445901b05379de1c7c7feb8f2395e0

SHA512
a49c84743a1320a46e978cd07d8db5b4d395668c84e0284f30fd23c15748b31f42f9e0139688b50b9edc1162569a11e8693dd1e03678b809dd314f28c2918490

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
111KB

MD5
92dd01f72e36bd96f6af95392d52cce0

SHA1
2349cd57648899d294eed9eb14cb9b763cee6510

SHA256
0e7094e2ed6196ed666ad4cd7ad92b5dd57cff4479f430d781c20d77d0984b95

SHA512
c5efcfb3c33d06981d160fe4d6826d0d3aa94ca13178012a4874fbbcd50736f1af4e53989309e4bca850861f50a7701da425a111d5fee0692e9720d7bcad6b02

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
111KB

MD5
92dd01f72e36bd96f6af95392d52cce0

SHA1
2349cd57648899d294eed9eb14cb9b763cee6510

SHA256
0e7094e2ed6196ed666ad4cd7ad92b5dd57cff4479f430d781c20d77d0984b95

SHA512
c5efcfb3c33d06981d160fe4d6826d0d3aa94ca13178012a4874fbbcd50736f1af4e53989309e4bca850861f50a7701da425a111d5fee0692e9720d7bcad6b02

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
111KB

MD5
ec443255a1ae7d0651ac68ae91d90fa1

SHA1
0b115d5a233c7f0eeea2e110aef12cb93be4ad2d

SHA256
c6991de3a77f64ad8979e8287b052ad545240860ca73acc15a6cc58b4bcd31e9

SHA512
00934ad93af113f4107dcef8eeb452e80fec12fff7180616e61b84989bccb79b6f751fdeecf0e508a256827d5c73f5e387c71a440a018cc0410b160ede13e359

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
111KB

MD5
ec443255a1ae7d0651ac68ae91d90fa1

SHA1
0b115d5a233c7f0eeea2e110aef12cb93be4ad2d

SHA256
c6991de3a77f64ad8979e8287b052ad545240860ca73acc15a6cc58b4bcd31e9

SHA512
00934ad93af113f4107dcef8eeb452e80fec12fff7180616e61b84989bccb79b6f751fdeecf0e508a256827d5c73f5e387c71a440a018cc0410b160ede13e359

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
111KB

MD5
410354bb6977f2ab63ac79e99a63a44f

SHA1
25346f27234b7979a17bd844aa8b2e83d400d963

SHA256
5600284456290d73318c22d63b6f43dc8d3a08f22b380166fae3ffca4de819af

SHA512
44a33a70fe8f303f34f409a84e97442cd65bf1fa6cd27bd732b8d64679e3676f33bfd5bd2faba6f8fc2d6b0abd2fa64a529e859261ebb897676ad938be82c35c

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
111KB

MD5
410354bb6977f2ab63ac79e99a63a44f

SHA1
25346f27234b7979a17bd844aa8b2e83d400d963

SHA256
5600284456290d73318c22d63b6f43dc8d3a08f22b380166fae3ffca4de819af

SHA512
44a33a70fe8f303f34f409a84e97442cd65bf1fa6cd27bd732b8d64679e3676f33bfd5bd2faba6f8fc2d6b0abd2fa64a529e859261ebb897676ad938be82c35c

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
111KB

MD5
f03aefd0f9e361ebdc2b475d70381bf0

SHA1
8dd9217f8fc55ec36161a9710e0fb0ccf5fdadd8

SHA256
44a6eeb2504c0b57d9c1b449d80b78f4779af2959888610761c6c97151c7f35d

SHA512
9a29e36a803d07d337e1db5e7f5b3189c361afba89841c337e64917535b9afb4737ebc8fca9ace0ae2cfffa355476f737d81af890325a4b900c2ca243ec519d7

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
111KB

MD5
f03aefd0f9e361ebdc2b475d70381bf0

SHA1
8dd9217f8fc55ec36161a9710e0fb0ccf5fdadd8

SHA256
44a6eeb2504c0b57d9c1b449d80b78f4779af2959888610761c6c97151c7f35d

SHA512
9a29e36a803d07d337e1db5e7f5b3189c361afba89841c337e64917535b9afb4737ebc8fca9ace0ae2cfffa355476f737d81af890325a4b900c2ca243ec519d7

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
111KB

MD5
809c220b798f02e99bf6e776bdcd0f80

SHA1
093bb323a08811c46a850bc1eb591fef7e310187

SHA256
8d089ca975669ae311ee4343818c29ff273c5ce82af677edcf83016113830636

SHA512
36d4fd31a26f4dba19bc621d61a39536cbec04eaff8f38ed8ea4561b487370e666f55ec5a611cff7342efe41e69836ec748bb5c35c725ca916f83fc40d914fa2

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
111KB

MD5
809c220b798f02e99bf6e776bdcd0f80

SHA1
093bb323a08811c46a850bc1eb591fef7e310187

SHA256
8d089ca975669ae311ee4343818c29ff273c5ce82af677edcf83016113830636

SHA512
36d4fd31a26f4dba19bc621d61a39536cbec04eaff8f38ed8ea4561b487370e666f55ec5a611cff7342efe41e69836ec748bb5c35c725ca916f83fc40d914fa2

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
111KB

MD5
3c4f4c04b00a5f7d4bcce3fa941a9778

SHA1
8ce09bac9a94d62cdcffa7c74068b3b71dcfe007

SHA256
88c1de4ceaab9e9951f2358ea4ffd59110ad09907bff7dd7c6b39103efd5b3f2

SHA512
cc1495317b23082c79ca4b0322417def7b4d2131ea030e9e9fc0eef7a21700940c66c846d81460c69506f958c43a90995635be38cfb5f094133e70fdc6b08c79

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
111KB

MD5
3c4f4c04b00a5f7d4bcce3fa941a9778

SHA1
8ce09bac9a94d62cdcffa7c74068b3b71dcfe007

SHA256
88c1de4ceaab9e9951f2358ea4ffd59110ad09907bff7dd7c6b39103efd5b3f2

SHA512
cc1495317b23082c79ca4b0322417def7b4d2131ea030e9e9fc0eef7a21700940c66c846d81460c69506f958c43a90995635be38cfb5f094133e70fdc6b08c79

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
111KB

MD5
f7c4b6602a2a0af701d5be3a21f54f2d

SHA1
223fcd9a44e93a7619a6135adc8f69151ec73098

SHA256
bacf78b40316d5df3a375c8337d71454363a35d40dd6ccd35eb4e6738e3d96c8

SHA512
7f3e6a121394452262561be0e17f1df8822d7f4a3209e8b3c375bd80b0ef33751153d2e2f28327dd7a3c27e0d80df7cc4e9feba899b67946d7fb328f9b8976c0

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
111KB

MD5
f7c4b6602a2a0af701d5be3a21f54f2d

SHA1
223fcd9a44e93a7619a6135adc8f69151ec73098

SHA256
bacf78b40316d5df3a375c8337d71454363a35d40dd6ccd35eb4e6738e3d96c8

SHA512
7f3e6a121394452262561be0e17f1df8822d7f4a3209e8b3c375bd80b0ef33751153d2e2f28327dd7a3c27e0d80df7cc4e9feba899b67946d7fb328f9b8976c0

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
111KB

MD5
f7c4b6602a2a0af701d5be3a21f54f2d

SHA1
223fcd9a44e93a7619a6135adc8f69151ec73098

SHA256
bacf78b40316d5df3a375c8337d71454363a35d40dd6ccd35eb4e6738e3d96c8

SHA512
7f3e6a121394452262561be0e17f1df8822d7f4a3209e8b3c375bd80b0ef33751153d2e2f28327dd7a3c27e0d80df7cc4e9feba899b67946d7fb328f9b8976c0

Download Submit
C:\Windows\SysWOW64\Egdqae32.exe

Filesize
111KB

MD5
6e0b6672968eba577e3db9942b912a3d

SHA1
b592664a656568ac8de8b5e7136cfc4f2f8f0cc5

SHA256
76fe6f5f87c69b97c4c78363669778abc90debda0fbe63cb8c78528cca8ac7f1

SHA512
72d29d90b92a6df89fe0b1d90b172677e206380ee495607c2f10c996d3020b381533b497432be372615d5e472a2fb94c5303ed59e377d3401c1c980ef63f019a

Download Submit
C:\Windows\SysWOW64\Egdqae32.exe

Filesize
111KB

MD5
6e0b6672968eba577e3db9942b912a3d

SHA1
b592664a656568ac8de8b5e7136cfc4f2f8f0cc5

SHA256
76fe6f5f87c69b97c4c78363669778abc90debda0fbe63cb8c78528cca8ac7f1

SHA512
72d29d90b92a6df89fe0b1d90b172677e206380ee495607c2f10c996d3020b381533b497432be372615d5e472a2fb94c5303ed59e377d3401c1c980ef63f019a

Download Submit
C:\Windows\SysWOW64\Ehdmlhcj.exe

Filesize
111KB

MD5
c42a2ab22871842647291e13dd5d726c

SHA1
69debc6d965b3c913a1ad32f59fe5b76a128fdae

SHA256
9befd64287119a2546d1683a7dfce31d47c33104d935e85be979f0e36dd68203

SHA512
2a322c90399642a0b534162794f018af1930bcd8dd0f6ad926f23b17af25baab1abe6ef7d4fd36c8efc32c303fbdd0845e82c84e517ea47d4123eb2cd5abae0f

Download Submit
C:\Windows\SysWOW64\Ehdmlhcj.exe

Filesize
111KB

MD5
c42a2ab22871842647291e13dd5d726c

SHA1
69debc6d965b3c913a1ad32f59fe5b76a128fdae

SHA256
9befd64287119a2546d1683a7dfce31d47c33104d935e85be979f0e36dd68203

SHA512
2a322c90399642a0b534162794f018af1930bcd8dd0f6ad926f23b17af25baab1abe6ef7d4fd36c8efc32c303fbdd0845e82c84e517ea47d4123eb2cd5abae0f

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
111KB

MD5
8405a1272f9ecf814792b194eb2fb93b

SHA1
c897460d325631a8e32538a2f15b7d2df98ea299

SHA256
373b81c969547fecfca51e9fb0647d89337c190ed054dde399d3c48698ac9d80

SHA512
2f366f215a44898007aaf6479c8c209828af39fb93a6880c46fd86775cd53f183a9ebdc077545fbf21da23e98b083c193ae9535eeff72a2f4fcae66d8007d36e

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
111KB

MD5
8405a1272f9ecf814792b194eb2fb93b

SHA1
c897460d325631a8e32538a2f15b7d2df98ea299

SHA256
373b81c969547fecfca51e9fb0647d89337c190ed054dde399d3c48698ac9d80

SHA512
2f366f215a44898007aaf6479c8c209828af39fb93a6880c46fd86775cd53f183a9ebdc077545fbf21da23e98b083c193ae9535eeff72a2f4fcae66d8007d36e

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
111KB

MD5
de05c5d42c34ae3fac47305a72bc4368

SHA1
9974acb663cf7ed06e77626de6c72391edcce90e

SHA256
19d5cb2b2f7331eeb6311477072289c1bbcd16c2fe9cb961659cc952579c2102

SHA512
31ece884c62048cc514bc76e40a5309f4d07015a9245bf9cf55bbf9e84035ae6259f8206167b5c819503f6808a39f3526105176f0156a4e08b2035866c327197

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
111KB

MD5
de05c5d42c34ae3fac47305a72bc4368

SHA1
9974acb663cf7ed06e77626de6c72391edcce90e

SHA256
19d5cb2b2f7331eeb6311477072289c1bbcd16c2fe9cb961659cc952579c2102

SHA512
31ece884c62048cc514bc76e40a5309f4d07015a9245bf9cf55bbf9e84035ae6259f8206167b5c819503f6808a39f3526105176f0156a4e08b2035866c327197

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
111KB

MD5
d5f36f30333e38582d5bc8e8bbc38c9b

SHA1
145034abfaaa5f41cd0d43c87fafcd68c67022d4

SHA256
27a02328c069e0329b8f830e81c2bac922e62ad0435fb94214c12e43cc833d32

SHA512
ee9be405fbb0b72b3e976b48ad3d6131adbbb8b5b1702de9e8481923269438d2855899322f6da21e38e0e93b7ab09d0370bff94b0757cc0e9dea4811fe2e5e0e

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
111KB

MD5
d5f36f30333e38582d5bc8e8bbc38c9b

SHA1
145034abfaaa5f41cd0d43c87fafcd68c67022d4

SHA256
27a02328c069e0329b8f830e81c2bac922e62ad0435fb94214c12e43cc833d32

SHA512
ee9be405fbb0b72b3e976b48ad3d6131adbbb8b5b1702de9e8481923269438d2855899322f6da21e38e0e93b7ab09d0370bff94b0757cc0e9dea4811fe2e5e0e

Download Submit
C:\Windows\SysWOW64\Eonehbjg.exe

Filesize
111KB

MD5
b5ad46aabea033af03bfc59b1c221a16

SHA1
402828e522e7b089558e7e3ddfd05e47d3c76a88

SHA256
4f6f0dcb8ccbfd05c463cc7795f8ef06021436c098467de585c48b417b33013f

SHA512
f9e41e1b36b59fc029bc1a686a51efdb5a0368e6224fb52d1eba676644f45a4accd76a0da4c36f40c3721d06eace310a1fa17abaa29f71879d88588590c6c7ee

Download Submit
C:\Windows\SysWOW64\Eonehbjg.exe

Filesize
111KB

MD5
b5ad46aabea033af03bfc59b1c221a16

SHA1
402828e522e7b089558e7e3ddfd05e47d3c76a88

SHA256
4f6f0dcb8ccbfd05c463cc7795f8ef06021436c098467de585c48b417b33013f

SHA512
f9e41e1b36b59fc029bc1a686a51efdb5a0368e6224fb52d1eba676644f45a4accd76a0da4c36f40c3721d06eace310a1fa17abaa29f71879d88588590c6c7ee

Download Submit
C:\Windows\SysWOW64\Fafdkmap.exe

Filesize
111KB

MD5
83914bd919c6e74b239efea7639ad6bb

SHA1
8c7fd3091b0d747d539adfc933f7c924255e27d2

SHA256
2220482c84214ad80991838290e7be7971f71fabae27fc31ce69d9cb349291a5

SHA512
72440b21710ac3e58be1b4ab47070ed84cbd6ad2dcc72975a15759f57140ded28af25b1c13faff2ba6a1b316e78265a8e0dd4d0d1fbd8bf1a666400efc540085

Download Submit
C:\Windows\SysWOW64\Fafdkmap.exe

Filesize
111KB

MD5
83914bd919c6e74b239efea7639ad6bb

SHA1
8c7fd3091b0d747d539adfc933f7c924255e27d2

SHA256
2220482c84214ad80991838290e7be7971f71fabae27fc31ce69d9cb349291a5

SHA512
72440b21710ac3e58be1b4ab47070ed84cbd6ad2dcc72975a15759f57140ded28af25b1c13faff2ba6a1b316e78265a8e0dd4d0d1fbd8bf1a666400efc540085

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
111KB

MD5
71388a6e42d639c6babffc585605b6b5

SHA1
20a5d73222081d9bbb7bc8585bf057dc627f785f

SHA256
28ed2261e6d20f58113111c99789011a04d435df08a7186d59ba15ed578cbc48

SHA512
4cf191596f0cf663ceb2784331796670e347ca33beaa00756d63b3ddcea80528bddb9594459c955f71d3871703ff0e64266a097f4bd6132ca37230130df6740a

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
111KB

MD5
71388a6e42d639c6babffc585605b6b5

SHA1
20a5d73222081d9bbb7bc8585bf057dc627f785f

SHA256
28ed2261e6d20f58113111c99789011a04d435df08a7186d59ba15ed578cbc48

SHA512
4cf191596f0cf663ceb2784331796670e347ca33beaa00756d63b3ddcea80528bddb9594459c955f71d3871703ff0e64266a097f4bd6132ca37230130df6740a

Download Submit
C:\Windows\SysWOW64\Fdbdah32.exe

Filesize
111KB

MD5
085f1bc11c635f1cb17cad919d7af62f

SHA1
72eb9b8846a0c08afda49d379eef92ce87bd91f0

SHA256
6a5acd4c342ef3d09c07a3b373e899d4211f55d47c946263b0f2a5a54fa8a104

SHA512
ce4599407de3dd526f24e367467cc6c67884d20d230225c05b16d34c1746c9a08717e50ec9704deb23f945ca029bd8526fef73e7aa1d8d19f628f1d998950953

Download Submit
C:\Windows\SysWOW64\Fdbdah32.exe

Filesize
111KB

MD5
085f1bc11c635f1cb17cad919d7af62f

SHA1
72eb9b8846a0c08afda49d379eef92ce87bd91f0

SHA256
6a5acd4c342ef3d09c07a3b373e899d4211f55d47c946263b0f2a5a54fa8a104

SHA512
ce4599407de3dd526f24e367467cc6c67884d20d230225c05b16d34c1746c9a08717e50ec9704deb23f945ca029bd8526fef73e7aa1d8d19f628f1d998950953

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
111KB

MD5
77db93fa2208761f1e1b8254b57c48e2

SHA1
69f0f43eb69064d72eea2933e88a4115b728ee67

SHA256
686e60e2efa8594e467a2264448d92fb8af8a1bb8e87f0d38f148ba67c843a84

SHA512
26812019057cf85790077854e94e29e59e97030706b76390bd0d8d1e63e7a850c9b9d74b6b79ccc6551efc70e0fc7342aa828e39c4152ae15084e81e87c373a3

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
111KB

MD5
77db93fa2208761f1e1b8254b57c48e2

SHA1
69f0f43eb69064d72eea2933e88a4115b728ee67

SHA256
686e60e2efa8594e467a2264448d92fb8af8a1bb8e87f0d38f148ba67c843a84

SHA512
26812019057cf85790077854e94e29e59e97030706b76390bd0d8d1e63e7a850c9b9d74b6b79ccc6551efc70e0fc7342aa828e39c4152ae15084e81e87c373a3

Download Submit
C:\Windows\SysWOW64\Fdfmlhna.exe

Filesize
111KB

MD5
4418917d2f6e9e52035f2f46dfa6017c

SHA1
897909732c8024fa8d54e84041dd3696f61f9742

SHA256
c85a400d28626a826af802d286d138298906120d94da588b5f9c72742075b148

SHA512
38c07bf95dc0465a504db8826a3df05182b1b731a4b484612d6138390c9517073e71f785a891f711a496ef9c9725ef953be2a2e2b6bed2f2ff72f7e3228b0ed8

Download Submit
C:\Windows\SysWOW64\Fdfmlhna.exe

Filesize
111KB

MD5
4418917d2f6e9e52035f2f46dfa6017c

SHA1
897909732c8024fa8d54e84041dd3696f61f9742

SHA256
c85a400d28626a826af802d286d138298906120d94da588b5f9c72742075b148

SHA512
38c07bf95dc0465a504db8826a3df05182b1b731a4b484612d6138390c9517073e71f785a891f711a496ef9c9725ef953be2a2e2b6bed2f2ff72f7e3228b0ed8

Download Submit
C:\Windows\SysWOW64\Fehfljca.exe

Filesize
111KB

MD5
55da719602f8c435358af663a440b86f

SHA1
fee785b9dda86d049b943984ae268ca1367fcfce

SHA256
103f2588eaf68437955b9afd623312181582bd6a99f0487845c61d6c2e0d5520

SHA512
41c1fe3cc4e8edca717318e347c4c3527103fd46a769da6825b355b892c8aab33bd58e7ae52814dd678053f9a6eea22057dc70caf0638c869c9d3665fa0290d4

Download Submit
C:\Windows\SysWOW64\Fehfljca.exe

Filesize
111KB

MD5
55da719602f8c435358af663a440b86f

SHA1
fee785b9dda86d049b943984ae268ca1367fcfce

SHA256
103f2588eaf68437955b9afd623312181582bd6a99f0487845c61d6c2e0d5520

SHA512
41c1fe3cc4e8edca717318e347c4c3527103fd46a769da6825b355b892c8aab33bd58e7ae52814dd678053f9a6eea22057dc70caf0638c869c9d3665fa0290d4

Download Submit
C:\Windows\SysWOW64\Fgbmccpg.exe

Filesize
111KB

MD5
0e50c79556c49415a910c1d96ab17a1c

SHA1
171d3be8fcc931657597fc04d23377ad2754dfde

SHA256
48bf85ba7e4bcf895ef41b0d26acfef843c37710a9cea6360a6f4d2971ff30aa

SHA512
f3203b8684808ab911d1053f2faedfc9bc94cfdba2ecc4a100182ac5eaeea4e12e1107356343c2949cf031bdc0324318faf3f812c0e8461e8d9195fd3769c350

Download Submit
C:\Windows\SysWOW64\Fgbmccpg.exe

Filesize
111KB

MD5
0e50c79556c49415a910c1d96ab17a1c

SHA1
171d3be8fcc931657597fc04d23377ad2754dfde

SHA256
48bf85ba7e4bcf895ef41b0d26acfef843c37710a9cea6360a6f4d2971ff30aa

SHA512
f3203b8684808ab911d1053f2faedfc9bc94cfdba2ecc4a100182ac5eaeea4e12e1107356343c2949cf031bdc0324318faf3f812c0e8461e8d9195fd3769c350

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
111KB

MD5
a8959c4a45730d82fcb1a564fad11bb7

SHA1
49298e54ded8bb4c77eccae791dd69c6eed28f7c

SHA256
f787b0de37a807c4a9d1e31c4b652a20ea968e2b2df5cc7c55d68cd5014d1254

SHA512
64e666fa28ecd5cb0c15260330adf23a351dca1f4b33f5deda3c64933cb8bbbe6d982da4319380b40ab4e29475130dde658fdd66004190ba8807a1bb046a1ac5

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
111KB

MD5
a8959c4a45730d82fcb1a564fad11bb7

SHA1
49298e54ded8bb4c77eccae791dd69c6eed28f7c

SHA256
f787b0de37a807c4a9d1e31c4b652a20ea968e2b2df5cc7c55d68cd5014d1254

SHA512
64e666fa28ecd5cb0c15260330adf23a351dca1f4b33f5deda3c64933cb8bbbe6d982da4319380b40ab4e29475130dde658fdd66004190ba8807a1bb046a1ac5

Download Submit
C:\Windows\SysWOW64\Fkllnbjc.exe

Filesize
111KB

MD5
17f7eb66e36a9a841d11193a0ec33acc

SHA1
5bf4046ea7c88e5b97eeb8df9e3de1d9b7bae76a

SHA256
aedf6f0aa365d6012e2b974cb4c6480e316e613cb744c53041330b47bc531d68

SHA512
4ceb74ad599bb08cd838de0e3de8a79291f3f24be6121a6b868a51afd7bdfcf5980a97345064d78a983d8904c3adb9cb1ae4d92295f605dc06d5e09c2c395bb1

Download Submit
C:\Windows\SysWOW64\Fkllnbjc.exe

Filesize
111KB

MD5
17f7eb66e36a9a841d11193a0ec33acc

SHA1
5bf4046ea7c88e5b97eeb8df9e3de1d9b7bae76a

SHA256
aedf6f0aa365d6012e2b974cb4c6480e316e613cb744c53041330b47bc531d68

SHA512
4ceb74ad599bb08cd838de0e3de8a79291f3f24be6121a6b868a51afd7bdfcf5980a97345064d78a983d8904c3adb9cb1ae4d92295f605dc06d5e09c2c395bb1

Download Submit
C:\Windows\SysWOW64\Foqkdp32.exe

Filesize
111KB

MD5
f93a126d13ccb30550b82da6c96fbec8

SHA1
f074a37f4cf59c540d1d965fbf1a95420986fa5c

SHA256
e2fc88a8cac64a433fe476168f5aadf4810955e03fd331b8b7d20bf8c065e0a1

SHA512
3127e263e09f01e7a18c9716d8956ca051448608cf2178c4db406d27b8a7dfbc4a9760a9b0b72df23b9e0dc8f551f9362df972816349cf4f3f8f6c9d67f7c219

Download Submit
C:\Windows\SysWOW64\Foqkdp32.exe

Filesize
111KB

MD5
f93a126d13ccb30550b82da6c96fbec8

SHA1
f074a37f4cf59c540d1d965fbf1a95420986fa5c

SHA256
e2fc88a8cac64a433fe476168f5aadf4810955e03fd331b8b7d20bf8c065e0a1

SHA512
3127e263e09f01e7a18c9716d8956ca051448608cf2178c4db406d27b8a7dfbc4a9760a9b0b72df23b9e0dc8f551f9362df972816349cf4f3f8f6c9d67f7c219

Download Submit
C:\Windows\SysWOW64\Foqkdp32.exe

Filesize
111KB

MD5
f93a126d13ccb30550b82da6c96fbec8

SHA1
f074a37f4cf59c540d1d965fbf1a95420986fa5c

SHA256
e2fc88a8cac64a433fe476168f5aadf4810955e03fd331b8b7d20bf8c065e0a1

SHA512
3127e263e09f01e7a18c9716d8956ca051448608cf2178c4db406d27b8a7dfbc4a9760a9b0b72df23b9e0dc8f551f9362df972816349cf4f3f8f6c9d67f7c219

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
111KB

MD5
1238308c9d8e1c7054581d7d9be10090

SHA1
f971b7f22d49e040f16639e3245d1750ac6564ee

SHA256
5704122b9d1ad19c5110aa68c0a1b9ddcb0e3efbd9182d7d388213be939ffd75

SHA512
778d4cda7d93e3879b9183c44e183b4145460eee6676ad29b4110a8b8649ef1c2c1eda9b59f3cb6d373807bed8f6b1631341232e81a7eeed0479b39112a87123

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
111KB

MD5
1238308c9d8e1c7054581d7d9be10090

SHA1
f971b7f22d49e040f16639e3245d1750ac6564ee

SHA256
5704122b9d1ad19c5110aa68c0a1b9ddcb0e3efbd9182d7d388213be939ffd75

SHA512
778d4cda7d93e3879b9183c44e183b4145460eee6676ad29b4110a8b8649ef1c2c1eda9b59f3cb6d373807bed8f6b1631341232e81a7eeed0479b39112a87123

Download Submit
C:\Windows\SysWOW64\Gekcaj32.exe

Filesize
111KB

MD5
ec3ec03e9fd4f2e8fcb169e39fba9b75

SHA1
d4c770f6c03223c4aef663509284e84fedabb815

SHA256
20f897d7758e18fad237fe7bbd8354cc2711bb8c7922daeb95f508a2bb8e50db

SHA512
fbae1331c283217c555d530cec5ba8acc6ef89d848fb866c0898d81b2a6d7a7563d8a320c58c936544bfb51e34178934642db683bf66362b824710edbc03a6da

Download Submit
C:\Windows\SysWOW64\Gekcaj32.exe

Filesize
111KB

MD5
ec3ec03e9fd4f2e8fcb169e39fba9b75

SHA1
d4c770f6c03223c4aef663509284e84fedabb815

SHA256
20f897d7758e18fad237fe7bbd8354cc2711bb8c7922daeb95f508a2bb8e50db

SHA512
fbae1331c283217c555d530cec5ba8acc6ef89d848fb866c0898d81b2a6d7a7563d8a320c58c936544bfb51e34178934642db683bf66362b824710edbc03a6da

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
111KB

MD5
e2bcb0bcaa43484024e390489ed75658

SHA1
794fb9a77dc18e66eacd1d6af4065f0cdb6f9c09

SHA256
17a1ee2a73595735f9e4fdf6253096e7112218690ab668fe75deb63e072db694

SHA512
c9d9e962a99afc1da32e136dfbe678ff6a67995fbb1059f3b0851113e960a12409f2f4e2f0b6fdfc258836e45d2302cb19207b05a505ab51128448c647223169

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
111KB

MD5
e2bcb0bcaa43484024e390489ed75658

SHA1
794fb9a77dc18e66eacd1d6af4065f0cdb6f9c09

SHA256
17a1ee2a73595735f9e4fdf6253096e7112218690ab668fe75deb63e072db694

SHA512
c9d9e962a99afc1da32e136dfbe678ff6a67995fbb1059f3b0851113e960a12409f2f4e2f0b6fdfc258836e45d2302cb19207b05a505ab51128448c647223169

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
111KB

MD5
7acb0176d233ff7a4695db079a64c940

SHA1
3bf712b50116e61679c419c22d0223f123017501

SHA256
78247e09667eec401168c0dff6d49bd39f10acdce32e4e6b078e4716d672cc2c

SHA512
6e912124e6111a58325cf7390ea4adf035cf8bcfcf3f116b421fa95b3ed4cd857aa0978596981adda588404531fc214c715380b64fdb5f34741e4d02d2fc3e05

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
111KB

MD5
7acb0176d233ff7a4695db079a64c940

SHA1
3bf712b50116e61679c419c22d0223f123017501

SHA256
78247e09667eec401168c0dff6d49bd39f10acdce32e4e6b078e4716d672cc2c

SHA512
6e912124e6111a58325cf7390ea4adf035cf8bcfcf3f116b421fa95b3ed4cd857aa0978596981adda588404531fc214c715380b64fdb5f34741e4d02d2fc3e05

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
111KB

MD5
a0a47485e5669017e0d9b212334bddcd

SHA1
05193932adb17cd5c5b8bc0a40aef9391bce6188

SHA256
a8389ab421fe8020db2f3d8f2bfa81b2370c507a6c4a03e54fa52a294437eb21

SHA512
9f28d6e3e9dbf2d02b47c9118cbb440f4fdc58d816fa2d6368f6ac83ee2f42ed1bb62a331a3df81c553cbaa32afab3f5a041bbfc5d86e8bce1029391e96db4a0

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
111KB

MD5
a0a47485e5669017e0d9b212334bddcd

SHA1
05193932adb17cd5c5b8bc0a40aef9391bce6188

SHA256
a8389ab421fe8020db2f3d8f2bfa81b2370c507a6c4a03e54fa52a294437eb21

SHA512
9f28d6e3e9dbf2d02b47c9118cbb440f4fdc58d816fa2d6368f6ac83ee2f42ed1bb62a331a3df81c553cbaa32afab3f5a041bbfc5d86e8bce1029391e96db4a0

Download Submit
C:\Windows\SysWOW64\Gkjhoq32.exe

Filesize
111KB

MD5
e767d82f4fb2f97c4e1abdeb04d7bf16

SHA1
4d097ef93fcbe07d142dc1e8179abd4db3735e2d

SHA256
454101e2feab601b36ec854299097339e3e7e7cbfe3b30feb6717e857d931465

SHA512
7eb47bf2a697f5790152d606ee1a45c4893bd04df7ec6a2b53b957f60f2e8da56918a795d27e129afe42047231a5c773bd60e4e9f3074c8158409db8119f29c5

Download Submit
C:\Windows\SysWOW64\Gkjhoq32.exe

Filesize
111KB

MD5
e767d82f4fb2f97c4e1abdeb04d7bf16

SHA1
4d097ef93fcbe07d142dc1e8179abd4db3735e2d

SHA256
454101e2feab601b36ec854299097339e3e7e7cbfe3b30feb6717e857d931465

SHA512
7eb47bf2a697f5790152d606ee1a45c4893bd04df7ec6a2b53b957f60f2e8da56918a795d27e129afe42047231a5c773bd60e4e9f3074c8158409db8119f29c5

Download Submit
C:\Windows\SysWOW64\Gkleeplq.exe

Filesize
111KB

MD5
4d0cd3432ebbdc583d7e5f4d757ebc44

SHA1
fece9260fb5e2cc9eed5a22ff98d7a38bcc7a629

SHA256
f0f053c572d2aee91a1f20477411ea4c8b851719d002032b9850fdc0437bbdb9

SHA512
227244844fed911913c708e54b956780fe233723f574f506f0b374e0f7d0873beafa18e9772a07829dc65e08eb27509cc570be18303452d87a3c46db8957b767

Download Submit
C:\Windows\SysWOW64\Gkleeplq.exe

Filesize
111KB

MD5
4d0cd3432ebbdc583d7e5f4d757ebc44

SHA1
fece9260fb5e2cc9eed5a22ff98d7a38bcc7a629

SHA256
f0f053c572d2aee91a1f20477411ea4c8b851719d002032b9850fdc0437bbdb9

SHA512
227244844fed911913c708e54b956780fe233723f574f506f0b374e0f7d0873beafa18e9772a07829dc65e08eb27509cc570be18303452d87a3c46db8957b767

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
111KB

MD5
de1ce59990807934c9280afa5fa1057f

SHA1
d0593cc7a26caf12c92a7926b15a2e409716272b

SHA256
23ff9caf711dfd0388a0a563f766220f1753bd0b839723920e9d965d9d230942

SHA512
a87accdfcd93399fcca79732addcb11b9e445045a9427614099b2ca989715db8d9ae0eab40a5aeeef1377aa37c3334804fd913b1c9fee2d92eaca7fad84ca7de

Download Submit
C:\Windows\SysWOW64\Lqhdbm32.exe

Filesize
111KB

MD5
a0c87252f073efbdcd728c2df681ecb4

SHA1
39b6d459eeda2abe66418b33501f1c59ced77862

SHA256
cda3b8331bba7ffc3f9500b72d7eace84c821daee4db55a042c0f2b7a688b675

SHA512
c1e3bc2f6ef78d4580224d5f90dc9a751a7e2dbfca5a16255c09cafd864762c158697b700792fe939df0ed58bb0153b61eb630029a0df14995e23c44a0222511

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
111KB

MD5
821504d20d7fa726a2f4fc99b301ddf4

SHA1
e80d6b42a2b54173db794584930ea947906d0546

SHA256
0ce5d0dd653b32dd7e1295e4c45570c97177abde30c772a5059aeafc69636cd1

SHA512
f7644d00d9b5616e35521cdaa010f4f5d0a01f44cf3b38a44a941b679813d07801c08baf88333fd481d854fc550ddc513884bf295ccdbc9cea70d63caa208b59

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
111KB

MD5
83f1665f3a26bf86bb09de58ea95904c

SHA1
ec1c085efab2efdfc67ca0285e683829fd16694a

SHA256
174e087271572f8f3578dc31953b3895b2ed2615e7e2d51c57872f8545c779b4

SHA512
fb49d335a573a7d275f7a6650ac1771ba45a666f74f3248f14ccd6ebd2015e0b781c7a1e2d8a18c1ef94943e11e04760df40cd762afde9caf9fca4f4b52e92f9

Download Submit
C:\Windows\SysWOW64\Mnpabe32.exe

Filesize
111KB

MD5
d883b2ae0f255d1b74f394e349e65bcd

SHA1
4651d3b4bdde7845ccb2b2fadabc05d33f37cbc5

SHA256
6ee1e6c598182940b87756d4ddf48bf034646c31760e032fcdfcdc687d0cfdd1

SHA512
7c023e121b7dec740c06aa3f4e9453c5e86f1a7c381ac347eea87a1d30883e2c18635381e4db8dab2af5b71a9d04e30ed95fa5e30c5a89766f4ff92cb9fc4974

Download Submit
C:\Windows\SysWOW64\Njinmf32.exe

Filesize
111KB

MD5
76a759a93e905c1ae53c3d78e65773c5

SHA1
85f67e0eed8301f80113b22fff3e87f3f9084a53

SHA256
0f1b458f85fb466b7f97232d3e558d8e7742dbc68952d5224f8b32ba7bb3e4ee

SHA512
ca0ecff2435fb62a52298dde19b89afad76e56d237a759687d0d9b686b1a416b44b9c80a7a8d74b53872a3922626ed3e4d6a1d1d39231838298606a074b7a5b7

Download Submit
C:\Windows\SysWOW64\Nlkgmh32.exe

Filesize
111KB

MD5
726d2158541f6e252186d55927e93b9e

SHA1
019588c6f87e89cc39c401ba197ccec47d8f3008

SHA256
9bef900464af4b292fe352e446b97063800da0100d147c215c5cb9378e30d74e

SHA512
759310528255daf6c828e56dff978792fd6ac65ba0c894acbe2cff2457cba2c574842286864ac5ce9680a28a4d30e5dbeddd5e62db3202d93d538ecd703e4dfb

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
111KB

MD5
9889084e37eda3ad6711241f93124225

SHA1
78d3a3eff81d8988ce3d6c1c567e420da903c969

SHA256
97a44d7c5a99dea20b4018e8c5be8281eac8958205d0bff46375131115c8a2da

SHA512
61fc51c42170f37da2125fc4b2bf892d323483b7dd941176a628fc039088f34b1405ed4b29bb3e335716592e6d8594a8d4d4abbf6a58ba2bfe1b0915d6f74c5d

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
111KB

MD5
46379ec49753fb9e2a0e5175cae55cad

SHA1
e5e075c2c8cf49a8385d24792b2c2c8623a4ce9f

SHA256
b0e0ef4c33534fff8dc7dea17b11f29068e6b0903bf6903582bc526eb487b2ce

SHA512
cc229cfa2565affda163d1e28ab4021245719d6a09ca7ea84558a0313bdaac11a9d732ee11002d64412353c0eb5298628c973143d088148c8bb9bb5e617d346c

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
111KB

MD5
3c3229e4f981b2013beb32c8a8096175

SHA1
78f2fe4028d2d7c8f1d484d997f4ba29c466f10b

SHA256
ba3a50f29223e72e7eae7bb9afc884f773859c6d024b922467dff8ab086241a9

SHA512
bd0d39c1351e16d8628539bc1cd0e075da38e4a0a9a14cee73ae653d756c17dde71633229ea49aab0bbba791d88214aa38b242677c17d34abf8f301d6aa7ae2c

Download Submit
C:\Windows\SysWOW64\Ohmoom32.dll

Filesize
7KB

MD5
7bdb6f64339039c9c4f25ef19dd59d33

SHA1
aada711bd1679feefc3764f05debdd54ca891e9a

SHA256
b7deb427a5f87e778cdfa8af5507f049abafd9ccba6918dcc5b2b4b0d3de7256

SHA512
fb7e228ff52fb4f7e4b5866be5fa60a55d0d222408756a61340b596f0a01f6568b85af5052da52c24d998a3e1b8fa015e72eeeae52f3a58119423ae93feb1b86

Download Submit
C:\Windows\SysWOW64\Omjpeo32.exe

Filesize
111KB

MD5
ebf6ca3d7864158d88335bcb8f7b1286

SHA1
c6ed7c080af0e079b4dd87aa3f80a28a84342e59

SHA256
ce7679e13baabbb1c7ecd45ba4ad26e0801e2fcd39544485d82209888af417b9

SHA512
fe9f68ada5ca4cddf37ce137da08414a99e6bd62a3b0a67cdb48bde7f03a76b080ea664e81b26461a9722e3f70a9df2fd39f3e717b324659e09142aa19fdc116

Download Submit
C:\Windows\SysWOW64\Pejkmk32.exe

Filesize
111KB

MD5
bc585489c6419010067818cd976ad0c2

SHA1
0401b32c55b9d257b0d8c288708e567fe2021e6b

SHA256
4eea8960e777107bdfbb8320ed18f11389a916d4879da8d810eab0a3af10c3a3

SHA512
acfd328d02ad1c10e40aaaee1abb017c82604ec2f4294bf32c59a14f613ffeff609d8d09c65a4dabb4784720b38228df56a0d158e232b709b81d37f475fae725

Download Submit
C:\Windows\SysWOW64\Qeodhjmo.exe

Filesize
111KB

MD5
2a3523fdf5d8b46c18b6adc7ae0a15d9

SHA1
4f80b9d347d8135895e63293dce6638d0a1eda79

SHA256
8353f7fe686bc8fce580ba8a01737904f25ad400c3c55492709314b03b079d48

SHA512
d4c7bb7bff7c8c9df7a21988d9840fcd152b4959972004bc15475411aa3f791878f16d407f79acb459bf54e9e3b06d7c90e50cc5c1278eedd3dec5bd20527bb4

Download Submit
memory/224-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/324-440-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/760-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/812-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/864-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/868-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1004-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1060-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1064-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1072-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1148-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1432-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1540-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1600-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1648-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1780-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2128-207-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2588-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2632-156-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2704-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2868-232-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3052-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3088-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3096-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3104-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3152-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3212-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3228-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3292-132-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3440-204-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3464-362-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3648-301-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3772-296-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3784-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3792-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3800-225-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3848-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3908-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3912-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3956-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4140-187-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4212-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4248-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4288-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4320-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4408-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4416-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4532-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4552-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4584-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4692-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4712-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4732-332-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4840-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4956-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4960-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5072-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5088-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5092-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads