459f6ff8048801d564be52502b8169ad6e87bd15c8db033c517f737d6a418e28

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0de26304c1360c0267e1855b326efa20.exe
Size

91KB
MD5

0de26304c1360c0267e1855b326efa20
SHA1

fddcfa2fc799886c751e1eac7b7980fd04cd5cfe
SHA256

459f6ff8048801d564be52502b8169ad6e87bd15c8db033c517f737d6a418e28
SHA512

a034f79693cee350bc7b77d76216bd929b62336bb6622a5bc78b7ce1dc192cdc5ae7397eba7c798be2b78a5f5469d25248492bca7b78037e737a02cb3eed661f
SSDEEP

1536:3GGRuvG4+jrss60vQ4LPeJ/troXz0FGxiv0cKKKMpWZB4:rR4p+jOA6trI0F5v7KKKBZB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Komhll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diffglam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddhomdje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbpbed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glhimp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmbegqjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlnbgddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cancekeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpjmph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdbfodfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mockmala.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Napjdpcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcibca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mibijk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinmcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkofdbkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfmolc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dckoia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hqghqpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdopjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpkknmgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccmgiaig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mminhceb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecjke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqpapacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpdboimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nchjdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okedcjcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcmfnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkfkng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mockmala.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjpijpdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhicpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjmmepfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqkiok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhbfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nibbqicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eghkjdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ockdmmoj.exe

Executes dropped EXE 64 IoCs

pid	Process
3304	Cjinkg32.exe
5100	Cenahpha.exe
4844	Cfpnph32.exe
4976	Cdcoim32.exe
2108	Cnicfe32.exe
2296	Cagobalc.exe
2028	Cfdhkhjj.exe
5052	Cajlhqjp.exe
2704	Cjbpaf32.exe
1216	Ddjejl32.exe
2252	Dobfld32.exe
4384	Delnin32.exe
1100	Dmjocp32.exe
4084	Dddhpjof.exe
4288	Dknpmdfc.exe
4772	Dahhio32.exe
2944	Ehapfiem.exe
3268	Edhakj32.exe
1624	Eonehbjg.exe
1332	Ehfjah32.exe
1340	Emcbio32.exe
3620	Eejjjl32.exe
4248	Ekgbccni.exe
4436	Eaakpm32.exe
644	Eoekia32.exe
2068	Fgppmd32.exe
4132	Foghnabl.exe
4820	Fojedapj.exe
604	Fedmqk32.exe
4156	Fkqeib32.exe
3348	Fefjfked.exe
1776	Fkcboack.exe
1140	Famjkl32.exe
3820	Foqkdp32.exe
2476	Gdncmghi.exe
3224	Gochjpho.exe
2348	Gempgj32.exe
1720	Gepmlimi.exe
3044	Ggqida32.exe
1412	Gohaeo32.exe
4752	Hnagak32.exe
2096	Hdlpneli.exe
988	Hbpphi32.exe
2492	Hdnldd32.exe
4044	Hbbmmi32.exe
636	Hdpiid32.exe
2836	Hkjafn32.exe
2940	Hbdjchgn.exe
1968	Hdbfodfa.exe
1852	Iohjlmeg.exe
1612	Ifbbig32.exe
4796	Inmgmijo.exe
704	Ikcdlmgf.exe
4852	Iijaka32.exe
2000	Jodjhkkj.exe
5076	Jfnbdecg.exe
3296	Joffnk32.exe
2040	Jgakbm32.exe
2024	Jnkcogno.exe
4676	Jeekkafl.exe
4032	Jbileede.exe
4792	Jehhaaci.exe
1908	Jkaqnk32.exe
1044	Jghabl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cmflbf32.exe	Ccmgiaig.exe
File created	C:\Windows\SysWOW64\Lippqp32.dll	Fpimlfke.exe
File created	C:\Windows\SysWOW64\Aanfno32.dll	Iondqhpl.exe
File opened for modification	C:\Windows\SysWOW64\Biiobo32.exe	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Nlphicca.dll	Fojedapj.exe
File created	C:\Windows\SysWOW64\Lfjfecno.exe	Lckiihok.exe
File created	C:\Windows\SysWOW64\Lihcbd32.dll	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Chdialdl.exe	Bajqda32.exe
File opened for modification	C:\Windows\SysWOW64\Ibcaknbi.exe	Ibaeen32.exe
File created	C:\Windows\SysWOW64\Hhjhdagb.dll	Hpnoncim.exe
File opened for modification	C:\Windows\SysWOW64\Ekajec32.exe	Ehbnigjj.exe
File created	C:\Windows\SysWOW64\Mbddol32.dll	Cgklmacf.exe
File created	C:\Windows\SysWOW64\Obhmcdfq.dll	Dpopbepi.exe
File opened for modification	C:\Windows\SysWOW64\Mifljdjo.exe	Mnphmkji.exe
File created	C:\Windows\SysWOW64\Bcflijmh.dll	Lgepom32.exe
File created	C:\Windows\SysWOW64\Objkmkjj.exe	Ommceclc.exe
File opened for modification	C:\Windows\SysWOW64\Okfbgiij.exe	Odljjo32.exe
File created	C:\Windows\SysWOW64\Cfmidc32.dll	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Bpkajf32.dll	Ohiemobf.exe
File opened for modification	C:\Windows\SysWOW64\Cfbcke32.exe	Cohkokgj.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Ieccbbkn.exe	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Jlojif32.dll	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Cancekeo.exe	Cigkdmel.exe
File opened for modification	C:\Windows\SysWOW64\Mblkhq32.exe	Mlbbkfoq.exe
File opened for modification	C:\Windows\SysWOW64\Aiplmq32.exe	Abfdpfaj.exe
File opened for modification	C:\Windows\SysWOW64\Hcjmhk32.exe	Hnmeodjc.exe
File opened for modification	C:\Windows\SysWOW64\Cbbnpg32.exe	Ckhecmcf.exe
File opened for modification	C:\Windows\SysWOW64\Afpjel32.exe	Qmgelf32.exe
File created	C:\Windows\SysWOW64\Eknphfld.dll	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Kdkoef32.exe	Kbjbnnfg.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Egdagc32.dll	Jcanll32.exe
File created	C:\Windows\SysWOW64\Fqibbo32.dll	Jinboekc.exe
File opened for modification	C:\Windows\SysWOW64\Qodeajbg.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Anhaoj32.dll	Fbplml32.exe
File created	C:\Windows\SysWOW64\Cdmoafdb.exe	Cancekeo.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Klbgfc32.exe
File created	C:\Windows\SysWOW64\Dchhia32.dll	Clpgkcdj.exe
File opened for modification	C:\Windows\SysWOW64\Chglab32.exe	Camddhoi.exe
File opened for modification	C:\Windows\SysWOW64\Niniei32.exe	Nbcqiope.exe
File opened for modification	C:\Windows\SysWOW64\Qkipkani.exe	Qemhbj32.exe
File created	C:\Windows\SysWOW64\Nmqmbmdf.dll	Efgemb32.exe
File created	C:\Windows\SysWOW64\Jlgfga32.dll	Keifdpif.exe
File created	C:\Windows\SysWOW64\Dgdncplk.exe	Dcibca32.exe
File created	C:\Windows\SysWOW64\Cadpqeqg.dll	Iencmm32.exe
File created	C:\Windows\SysWOW64\Jbileede.exe	Jeekkafl.exe
File created	C:\Windows\SysWOW64\Amjbbfgo.exe	Afpjel32.exe
File created	C:\Windows\SysWOW64\Bmladm32.exe	Bkmeha32.exe
File opened for modification	C:\Windows\SysWOW64\Chnbbqpn.exe	Cnindhpg.exe
File created	C:\Windows\SysWOW64\Qkipkani.exe	Qemhbj32.exe
File created	C:\Windows\SysWOW64\Jpnakk32.exe	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Ihejacdm.dll	Mminhceb.exe
File opened for modification	C:\Windows\SysWOW64\Dpckjfgg.exe	Dmdonkgc.exe
File created	C:\Windows\SysWOW64\Kamqij32.dll	Dmdonkgc.exe
File created	C:\Windows\SysWOW64\Ldipha32.exe	Lgepom32.exe
File created	C:\Windows\SysWOW64\Edbiniff.exe	Egohdegl.exe
File opened for modification	C:\Windows\SysWOW64\Aealll32.exe	Abcppq32.exe
File created	C:\Windows\SysWOW64\Lmeffoid.dll	Nlleaeff.exe
File created	C:\Windows\SysWOW64\Mnhgglaj.dll	Aidehpea.exe
File opened for modification	C:\Windows\SysWOW64\Gempgj32.exe	Gochjpho.exe
File created	C:\Windows\SysWOW64\Leadnm32.exe	Loglacfo.exe
File opened for modification	C:\Windows\SysWOW64\Ogpepl32.exe	Opemca32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5628	7288	WerFault.exe	898

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lflgmqhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdickcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoekia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhfedil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpckjfgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmnqjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kefjdppe.dll"	Mlifnphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Minqeaad.dll"	Lgpoihnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpkknmgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Noaeqjpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Joffnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pokhnl32.dll"	Lejnmncd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hobipl32.dll"	Oehlkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ginacp32.dll"	Adikdfna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khbdikip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopemh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjaleemj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhfaddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eldafjjc.dll"	Cefoni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhjibgnp.dll"	Hnagak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihpcinld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnfooe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjfmcmai.dll"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anobgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alelqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fooclapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkgcdmh.dll"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algpao32.dll"	Jbileede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Moipoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klekfinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcllpfj.dll"	Jfnbdecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fohfbpgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcjmhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpnbog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maoifh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhbfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfmlqhcc.dll"	Klpakj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlkgmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emcbio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkmokh.dll"	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klekfinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphnbpql.dll"	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajbfciej.dll"	Apggckbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iccpniqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dabhdinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieccbbkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpghkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcanll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3304	4860	NEAS.0de26304c1360c0267e1855b326efa20.exe	85
PID 4860 wrote to memory of 3304	4860	NEAS.0de26304c1360c0267e1855b326efa20.exe	85
PID 4860 wrote to memory of 3304	4860	NEAS.0de26304c1360c0267e1855b326efa20.exe	85
PID 3304 wrote to memory of 5100	3304	Cjinkg32.exe	86
PID 3304 wrote to memory of 5100	3304	Cjinkg32.exe	86
PID 3304 wrote to memory of 5100	3304	Cjinkg32.exe	86
PID 5100 wrote to memory of 4844	5100	Cenahpha.exe	87
PID 5100 wrote to memory of 4844	5100	Cenahpha.exe	87
PID 5100 wrote to memory of 4844	5100	Cenahpha.exe	87
PID 4844 wrote to memory of 4976	4844	Cfpnph32.exe	89
PID 4844 wrote to memory of 4976	4844	Cfpnph32.exe	89
PID 4844 wrote to memory of 4976	4844	Cfpnph32.exe	89
PID 4976 wrote to memory of 2108	4976	Cdcoim32.exe	90
PID 4976 wrote to memory of 2108	4976	Cdcoim32.exe	90
PID 4976 wrote to memory of 2108	4976	Cdcoim32.exe	90
PID 2108 wrote to memory of 2296	2108	Cnicfe32.exe	91
PID 2108 wrote to memory of 2296	2108	Cnicfe32.exe	91
PID 2108 wrote to memory of 2296	2108	Cnicfe32.exe	91
PID 2296 wrote to memory of 2028	2296	Cagobalc.exe	92
PID 2296 wrote to memory of 2028	2296	Cagobalc.exe	92
PID 2296 wrote to memory of 2028	2296	Cagobalc.exe	92
PID 2028 wrote to memory of 5052	2028	Cfdhkhjj.exe	93
PID 2028 wrote to memory of 5052	2028	Cfdhkhjj.exe	93
PID 2028 wrote to memory of 5052	2028	Cfdhkhjj.exe	93
PID 5052 wrote to memory of 2704	5052	Cajlhqjp.exe	94
PID 5052 wrote to memory of 2704	5052	Cajlhqjp.exe	94
PID 5052 wrote to memory of 2704	5052	Cajlhqjp.exe	94
PID 2704 wrote to memory of 1216	2704	Cjbpaf32.exe	95
PID 2704 wrote to memory of 1216	2704	Cjbpaf32.exe	95
PID 2704 wrote to memory of 1216	2704	Cjbpaf32.exe	95
PID 1216 wrote to memory of 2252	1216	Ddjejl32.exe	96
PID 1216 wrote to memory of 2252	1216	Ddjejl32.exe	96
PID 1216 wrote to memory of 2252	1216	Ddjejl32.exe	96
PID 2252 wrote to memory of 4384	2252	Dobfld32.exe	97
PID 2252 wrote to memory of 4384	2252	Dobfld32.exe	97
PID 2252 wrote to memory of 4384	2252	Dobfld32.exe	97
PID 4384 wrote to memory of 1100	4384	Delnin32.exe	98
PID 4384 wrote to memory of 1100	4384	Delnin32.exe	98
PID 4384 wrote to memory of 1100	4384	Delnin32.exe	98
PID 1100 wrote to memory of 4084	1100	Dmjocp32.exe	99
PID 1100 wrote to memory of 4084	1100	Dmjocp32.exe	99
PID 1100 wrote to memory of 4084	1100	Dmjocp32.exe	99
PID 4084 wrote to memory of 4288	4084	Dddhpjof.exe	101
PID 4084 wrote to memory of 4288	4084	Dddhpjof.exe	101
PID 4084 wrote to memory of 4288	4084	Dddhpjof.exe	101
PID 4288 wrote to memory of 4772	4288	Dknpmdfc.exe	100
PID 4288 wrote to memory of 4772	4288	Dknpmdfc.exe	100
PID 4288 wrote to memory of 4772	4288	Dknpmdfc.exe	100
PID 4772 wrote to memory of 2944	4772	Dahhio32.exe	102
PID 4772 wrote to memory of 2944	4772	Dahhio32.exe	102
PID 4772 wrote to memory of 2944	4772	Dahhio32.exe	102
PID 2944 wrote to memory of 3268	2944	Ehapfiem.exe	103
PID 2944 wrote to memory of 3268	2944	Ehapfiem.exe	103
PID 2944 wrote to memory of 3268	2944	Ehapfiem.exe	103
PID 3268 wrote to memory of 1624	3268	Edhakj32.exe	104
PID 3268 wrote to memory of 1624	3268	Edhakj32.exe	104
PID 3268 wrote to memory of 1624	3268	Edhakj32.exe	104
PID 1624 wrote to memory of 1332	1624	Eonehbjg.exe	105
PID 1624 wrote to memory of 1332	1624	Eonehbjg.exe	105
PID 1624 wrote to memory of 1332	1624	Eonehbjg.exe	105
PID 1332 wrote to memory of 1340	1332	Ehfjah32.exe	106
PID 1332 wrote to memory of 1340	1332	Ehfjah32.exe	106
PID 1332 wrote to memory of 1340	1332	Ehfjah32.exe	106
PID 1340 wrote to memory of 3620	1340	Emcbio32.exe	107

C:\Users\Admin\AppData\Local\Temp\NEAS.0de26304c1360c0267e1855b326efa20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0de26304c1360c0267e1855b326efa20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\Cjinkg32.exe
  C:\Windows\system32\Cjinkg32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\Cenahpha.exe
    C:\Windows\system32\Cenahpha.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\Cfpnph32.exe
      C:\Windows\system32\Cfpnph32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4288

C:\Windows\SysWOW64\Dahhio32.exe
C:\Windows\system32\Dahhio32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\Ehapfiem.exe
  C:\Windows\system32\Ehapfiem.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\Edhakj32.exe
    C:\Windows\system32\Edhakj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\Eonehbjg.exe
      C:\Windows\system32\Eonehbjg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
      - C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        7⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        8⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        9⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:644
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        11⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        12⤵
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4820
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        14⤵
        Executes dropped EXE
        
        PID:604
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        15⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        16⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        17⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        18⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        19⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        20⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3224
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        22⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        23⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        25⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        27⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        28⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        29⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        30⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        31⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        32⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        33⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        35⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        36⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        37⤵
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        38⤵
        Executes dropped EXE
        
        PID:704
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        39⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        40⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        43⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        44⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        47⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        48⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        49⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        50⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1764
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        52⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4040
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        54⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        55⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        56⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        57⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        58⤵
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        59⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        60⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        61⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        62⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        63⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        64⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        65⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        66⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        67⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        68⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        69⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        70⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        71⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        72⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        73⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        75⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        76⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        77⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        78⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        81⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        82⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        83⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        84⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        85⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        86⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        87⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        88⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        89⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        94⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        95⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        96⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        97⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        98⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        99⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        100⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        101⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        102⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        103⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        104⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        105⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        107⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        108⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        109⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        110⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        111⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        112⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        113⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        114⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        115⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        116⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        117⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        118⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        119⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        120⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        122⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        123⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        124⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        125⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        126⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        127⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        128⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        129⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        130⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        131⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        133⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        135⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        137⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        138⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        140⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        141⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        142⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        143⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        144⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        145⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        146⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        147⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        148⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        149⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        150⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        151⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        152⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        153⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        154⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        155⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        156⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        157⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        158⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        159⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        160⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        161⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        162⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        163⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        164⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        165⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        166⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        167⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        168⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        169⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        170⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        171⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        172⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        173⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        174⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        175⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        176⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        177⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        178⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        180⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        181⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        182⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        183⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        185⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        186⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        187⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        188⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        189⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        190⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        191⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        192⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        193⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        194⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        195⤵
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        196⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        198⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        199⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        200⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        201⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        202⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        203⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        204⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8128
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        206⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        207⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        208⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        209⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        210⤵
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        211⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        212⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        213⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        214⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        215⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        216⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        217⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        218⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        219⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        220⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        221⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        222⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        223⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        224⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        225⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        226⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        227⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        228⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        229⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        231⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        232⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        233⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        234⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        235⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        236⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        237⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        238⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        239⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        240⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        241⤵
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        242⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        243⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        244⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        245⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        246⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        247⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        249⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        250⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        251⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        252⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        253⤵
        Drops file in System32 directory
        
        PID:8584
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        254⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        255⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        256⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        257⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        258⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        259⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        260⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        261⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        262⤵
        Drops file in System32 directory
        
        PID:9012
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        263⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        264⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        265⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        266⤵
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        267⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        268⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        269⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        270⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        271⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        272⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        273⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        274⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        275⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        276⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        277⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        278⤵
        Drops file in System32 directory
        
        PID:796
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        279⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        280⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        281⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        282⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        283⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        284⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        285⤵
        Drops file in System32 directory
        
        PID:8440
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        286⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        287⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        288⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        289⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        290⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        291⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        292⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        293⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        294⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        295⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        205⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        138⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        139⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        140⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        141⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        142⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        143⤵
        
        PID:6632
- - C:\Windows\SysWOW64\Ipjoja32.exe
    C:\Windows\system32\Ipjoja32.exe
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\Imnocf32.exe
      C:\Windows\system32\Imnocf32.exe
      4⤵
      PID:2164
    - - C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        5⤵
        
        PID:8236
      - C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        6⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        8⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        9⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        10⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        11⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        12⤵
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        13⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        14⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        15⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        16⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        17⤵
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        18⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5088
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        20⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        21⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        22⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        23⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        24⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        25⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        26⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4132
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        28⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        29⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        30⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        31⤵
        Modifies registry class
        
        PID:1776
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        32⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        33⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        34⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        35⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        36⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        37⤵
        
        PID:4636

C:\Windows\SysWOW64\Gimqajgh.exe
C:\Windows\system32\Gimqajgh.exe
1⤵
PID:980
- C:\Windows\SysWOW64\Hedafk32.exe
  C:\Windows\system32\Hedafk32.exe
  2⤵
  PID:9200
- - C:\Windows\SysWOW64\Hlnjbedi.exe
    C:\Windows\system32\Hlnjbedi.exe
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\Holfoqcm.exe
      C:\Windows\system32\Holfoqcm.exe
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        5⤵
        
        PID:2108
      - C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        6⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        7⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        8⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        9⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        10⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        11⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        12⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        13⤵
        Drops file in System32 directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        14⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        15⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        16⤵
        
        PID:2944

C:\Windows\SysWOW64\Lqojclne.exe
C:\Windows\system32\Lqojclne.exe
1⤵
PID:8432
- C:\Windows\SysWOW64\Lflbkcll.exe
  C:\Windows\system32\Lflbkcll.exe
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\Mqafhl32.exe
    C:\Windows\system32\Mqafhl32.exe
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\Mcpcdg32.exe
      C:\Windows\system32\Mcpcdg32.exe
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        5⤵
        
        PID:640
      - C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        6⤵
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        7⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        8⤵
        
        PID:704
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        10⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        11⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        12⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        13⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        14⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        15⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        16⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        17⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        20⤵
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        21⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        22⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        23⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        24⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        25⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        26⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        27⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        28⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        29⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        30⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        31⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        32⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        33⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        35⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        36⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        37⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        38⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8716
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        40⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        41⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        43⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        44⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        45⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        46⤵
        Drops file in System32 directory
        
        PID:1928
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        47⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        48⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        49⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        50⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        51⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        52⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        53⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        54⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        55⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        56⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        57⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        58⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        59⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        60⤵
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        61⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        62⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        63⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        64⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        65⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        66⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        67⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        68⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        69⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        70⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        71⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        72⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        73⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        75⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        76⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        77⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        78⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        79⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        80⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        81⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        82⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        83⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        84⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        85⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        86⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        88⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        89⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        90⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        91⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        92⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        93⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        94⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        95⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        96⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2028
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        98⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        99⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        100⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        102⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        103⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        104⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        105⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        106⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        107⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        108⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        109⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        110⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        111⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        112⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        113⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        114⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        115⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        116⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        117⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        118⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9764
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9808
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        121⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        122⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        123⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        124⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        125⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        127⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        128⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        129⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        130⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9324
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        132⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        133⤵
        Modifies registry class
        
        PID:9424
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        134⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        135⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        136⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        137⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        138⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        139⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        140⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        141⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        142⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        143⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        144⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        145⤵
        Modifies registry class
        
        PID:10204
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        146⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        147⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        148⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        149⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        151⤵
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        152⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        153⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        154⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        155⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        157⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        158⤵
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        159⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        160⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        161⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        163⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        164⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        165⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        166⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        168⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        169⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        171⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        172⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        173⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        174⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        175⤵
        Drops file in System32 directory
        
        PID:1488
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        176⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        177⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10248
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        179⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        180⤵
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        181⤵
        Modifies registry class
        
        PID:10380
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        182⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        183⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        184⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        185⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        186⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        187⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        188⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        189⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        190⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        191⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        192⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        193⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        194⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        195⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        196⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        197⤵
        
        PID:11124

C:\Windows\SysWOW64\Mpapnfhg.exe
C:\Windows\system32\Mpapnfhg.exe
1⤵
PID:11172
- C:\Windows\SysWOW64\Mlhqcgnk.exe
  C:\Windows\system32\Mlhqcgnk.exe
  2⤵
  PID:11220
- - C:\Windows\SysWOW64\Mcaipa32.exe
    C:\Windows\system32\Mcaipa32.exe
    3⤵
    PID:11260
  - - C:\Windows\SysWOW64\Mqhfoebo.exe
      C:\Windows\system32\Mqhfoebo.exe
      4⤵
      PID:10324
    - - C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        5⤵
        
        PID:10412
      - C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        6⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        7⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        8⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        9⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        10⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        11⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        12⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        13⤵
        Drops file in System32 directory
        
        PID:10924
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        14⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        15⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        16⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        17⤵
        
        PID:6200

C:\Windows\SysWOW64\Pjaleemj.exe
C:\Windows\system32\Pjaleemj.exe
1⤵
- Modifies registry class
PID:6276
- C:\Windows\SysWOW64\Pidlqb32.exe
  C:\Windows\system32\Pidlqb32.exe
  2⤵
  PID:10320
- - C:\Windows\SysWOW64\Pakdbp32.exe
    C:\Windows\system32\Pakdbp32.exe
    3⤵
    PID:7132
  - - C:\Windows\SysWOW64\Pblajhje.exe
      C:\Windows\system32\Pblajhje.exe
      4⤵
      PID:2996
    - - C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10464
      - C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        6⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        7⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        8⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        9⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        10⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        11⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        12⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        13⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        14⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        15⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        16⤵
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        17⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        18⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        19⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        20⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        21⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        22⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        23⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        24⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        25⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        26⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        28⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        29⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        30⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        31⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        32⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        33⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        34⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        36⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        37⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        38⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        39⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        40⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        41⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        42⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        43⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        45⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        46⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        47⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        48⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        49⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        50⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        51⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        52⤵
        Drops file in System32 directory
        
        PID:11068
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        53⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        55⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        56⤵
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        57⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        58⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        59⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        60⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        61⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        63⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        64⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        65⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        68⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        70⤵
        Drops file in System32 directory
        
        PID:10684
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        71⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        72⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        73⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        75⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        76⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        77⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        78⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        79⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        80⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        81⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Hkjohi32.exe
        
        C:\Windows\system32\Hkjohi32.exe
        82⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        83⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11348
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        85⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Hnkhjdle.exe
        
        C:\Windows\system32\Hnkhjdle.exe
        86⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        87⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        88⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        89⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Hnmeodjc.exe
        
        C:\Windows\system32\Hnmeodjc.exe
        90⤵
        Drops file in System32 directory
        
        PID:11604
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        91⤵
        Modifies registry class
        
        PID:11648
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        92⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        93⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        94⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        95⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        96⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        97⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        98⤵
        Drops file in System32 directory
        
        PID:11940
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        99⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        100⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        101⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        102⤵
        Modifies registry class
        
        PID:12108
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        103⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        104⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12232
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        106⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        107⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        108⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        109⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        110⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        111⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        112⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        113⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        114⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        115⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        116⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        117⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        118⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12072
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        120⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        121⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        122⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        123⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        124⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11540
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        126⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        127⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        128⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        129⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        130⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        131⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        132⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        133⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        134⤵
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        135⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        136⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        137⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        138⤵
        Modifies registry class
        
        PID:11364
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        139⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        140⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        141⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        142⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        143⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        144⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        145⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        146⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        147⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        148⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        149⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Moalil32.exe
        
        C:\Windows\system32\Moalil32.exe
        150⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        151⤵
        Modifies registry class
        
        PID:12480
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        152⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        153⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Mcoepkdo.exe
        
        C:\Windows\system32\Mcoepkdo.exe
        154⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        155⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        156⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        157⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        158⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        159⤵
        Modifies registry class
        
        PID:12836
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        160⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        161⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        162⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        163⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        164⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        165⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        166⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        167⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        168⤵
        Modifies registry class
        
        PID:13308
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        169⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        170⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        171⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        172⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        173⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        174⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        175⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        176⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        177⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        178⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        179⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        180⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        181⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        182⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        183⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13116
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13184
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        186⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        187⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        188⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        189⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        190⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        191⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        192⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        194⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        195⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        196⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        197⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        198⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        199⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        200⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        201⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        202⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        204⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        205⤵
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        206⤵
        Drops file in System32 directory
        
        PID:12444
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        207⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        208⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        209⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        210⤵
        
        PID:7968

C:\Windows\SysWOW64\Clijablo.exe
C:\Windows\system32\Clijablo.exe
1⤵
PID:7876
- C:\Windows\SysWOW64\Ddqbbo32.exe
  C:\Windows\system32\Ddqbbo32.exe
  2⤵
  PID:7312
- - C:\Windows\SysWOW64\Dinjjf32.exe
    C:\Windows\system32\Dinjjf32.exe
    3⤵
    PID:13140
  - - C:\Windows\SysWOW64\Dbfoclai.exe
      C:\Windows\system32\Dbfoclai.exe
      4⤵
      PID:13252
    - - C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        5⤵
        
        PID:7288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 408
        6⤵
        Program crash
        
        PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7288 -ip 7288
1⤵
PID:12476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adfnofpd.exe

Filesize
91KB

MD5
3fc84862177e031529bb67bcbeb1fc90

SHA1
c3c557f71eb7a5cc0d371077d69a1d09dc1a3ed4

SHA256
6e2e1bb3822ea00ab05b3a735c597cab0631d4e82606046af1abe7e6fef14717

SHA512
cffbaef10e018054c5b5e2439f2faa0cbfe082c5be6b2a53b8f701950d7c98a707385b9acd43ae86a98618fc069fff571feddb37c2cdf0877d9f0f9594fef9e6

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
91KB

MD5
7e7b164b1f8e633f315b4d52acc9e67e

SHA1
bd2019f71d853e8392fc57540ff29f8229918b89

SHA256
cdb69b0f6c173b3183697e8e9d0e517a4b4a19f786c05f632fdf24cd52c4a90a

SHA512
1c6f00d2509046335c8dd82e197a1a6b4a456be9d3116151d43b3b94cb09344463b80cabdf84457a9c3ffcd39842258a573045988412c34eb2f1c26bacc64155

Download Submit
C:\Windows\SysWOW64\Bhpfqcln.exe

Filesize
91KB

MD5
fbec77581f3f2e37acea0adb492c8828

SHA1
c10c0b3cda4151abbb2a1d233f41e0dba1cc345a

SHA256
cf67640921cb1772e4a1ed04626d75b4aacf65654a4ca1b2625e328b1f22a4ea

SHA512
37b3d5d909cb8e132a43e553533075321b2c87ddc00937640aec7c3e367c57e9929052e84db87ca65bac1d0ed5355369298f79fcf56563de5a83b4e7234909d3

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
91KB

MD5
c47c39c70dfe815cb0007078adaed33d

SHA1
411d9c0c0a7994878b246d06ac336c7480872e00

SHA256
24cf1a30a2976ce69d315e4b867f410ce36c45ca9801eb9288a518db9c9c4ca9

SHA512
d550b12b077b04da63e5fe62256396d49913d7f740662434ca799e0c4cb02fe83361f147998286225139c700f1b4d7668c9b3cbed6667775cca479da02199825

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
91KB

MD5
c47c39c70dfe815cb0007078adaed33d

SHA1
411d9c0c0a7994878b246d06ac336c7480872e00

SHA256
24cf1a30a2976ce69d315e4b867f410ce36c45ca9801eb9288a518db9c9c4ca9

SHA512
d550b12b077b04da63e5fe62256396d49913d7f740662434ca799e0c4cb02fe83361f147998286225139c700f1b4d7668c9b3cbed6667775cca479da02199825

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
91KB

MD5
621b94dec4f381134ebdf356791cc2a9

SHA1
fe0393a7c7e0a9d655d025359c2916ded364f212

SHA256
91613be6ee2a6d24c8e4a236bb37e682296a4b5c14c035ad7507a3af30ec5427

SHA512
3b3b82114e406dfa153fe9c5aa76ac3867298d5d009552132bfe62523a5174d0c706ae47dc3bb04ce9e3924ed96a35998178580a5b55b5a119103689d2c9f6ed

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
91KB

MD5
621b94dec4f381134ebdf356791cc2a9

SHA1
fe0393a7c7e0a9d655d025359c2916ded364f212

SHA256
91613be6ee2a6d24c8e4a236bb37e682296a4b5c14c035ad7507a3af30ec5427

SHA512
3b3b82114e406dfa153fe9c5aa76ac3867298d5d009552132bfe62523a5174d0c706ae47dc3bb04ce9e3924ed96a35998178580a5b55b5a119103689d2c9f6ed

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
91KB

MD5
588c5860f78559ed86a5dfef1d2e259c

SHA1
be26eadbbda1a04012ab3a9600637b467747014d

SHA256
a646c41f57c14468c04619071efb08c14fb1bea839bc1b5eca76b81624837999

SHA512
cdf3b64f0a80034b5ea480a5038f3049761a85657a9e78bf20a92aa44cf68842e52a83becd46485833364b168adbd89950f92d3ac5bd7d9df57d50efdeb7309f

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
91KB

MD5
588c5860f78559ed86a5dfef1d2e259c

SHA1
be26eadbbda1a04012ab3a9600637b467747014d

SHA256
a646c41f57c14468c04619071efb08c14fb1bea839bc1b5eca76b81624837999

SHA512
cdf3b64f0a80034b5ea480a5038f3049761a85657a9e78bf20a92aa44cf68842e52a83becd46485833364b168adbd89950f92d3ac5bd7d9df57d50efdeb7309f

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
91KB

MD5
d173e7a38f6b2a87231589af903ca3bd

SHA1
b4d53325db800e8825648cd5b8a712cdd4ec784b

SHA256
e72a4ed74fd942ac5ed651f92a76753b50ba5933027b705769e2cbb632c0c27c

SHA512
76659b824cdf1f1c1e7fb13f676716899cceef9d1fdd3ae892200e5ba6430267ef2807b50d1cf00a2324e39651a2a7d5d85a409de6586ddf3db8eba7a3ca5444

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
91KB

MD5
d173e7a38f6b2a87231589af903ca3bd

SHA1
b4d53325db800e8825648cd5b8a712cdd4ec784b

SHA256
e72a4ed74fd942ac5ed651f92a76753b50ba5933027b705769e2cbb632c0c27c

SHA512
76659b824cdf1f1c1e7fb13f676716899cceef9d1fdd3ae892200e5ba6430267ef2807b50d1cf00a2324e39651a2a7d5d85a409de6586ddf3db8eba7a3ca5444

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
91KB

MD5
8eb1859b7a98da732096db56a40f8c8d

SHA1
c5ac678e8a4cfa08ef650c2de1f083bd463af6bb

SHA256
7f3aaa4dfbef0d286429f16529b4604d555ba3220c25dd574b7d06886382eb9c

SHA512
9877c28ae666b0b2df45fc8b9876fc03e0e87afcc003c7427eb772a9f7b32454781ac39a92492ac56dab32e9e5606092035fc86790bc36ebb98bf297be9295e3

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
91KB

MD5
8eb1859b7a98da732096db56a40f8c8d

SHA1
c5ac678e8a4cfa08ef650c2de1f083bd463af6bb

SHA256
7f3aaa4dfbef0d286429f16529b4604d555ba3220c25dd574b7d06886382eb9c

SHA512
9877c28ae666b0b2df45fc8b9876fc03e0e87afcc003c7427eb772a9f7b32454781ac39a92492ac56dab32e9e5606092035fc86790bc36ebb98bf297be9295e3

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
91KB

MD5
c64ec9e22219a5f5c115321de45c14af

SHA1
fcd8ae5e67e5ddc75fd6f52eb811941a846fb7b2

SHA256
cf1c23fe2aaf3e27c37d3a5d2ca6f68c4282734b572824ac2658db8e20d9a085

SHA512
ed14620e455679ff6a1f2f0f4f39d1cdd1d481d5359e219ddce86d8e6dd6529a4ec7c0d53c70a1d9e1720dbc774fcb09ade42a238f7144346ba6176aeb625ccc

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
91KB

MD5
c64ec9e22219a5f5c115321de45c14af

SHA1
fcd8ae5e67e5ddc75fd6f52eb811941a846fb7b2

SHA256
cf1c23fe2aaf3e27c37d3a5d2ca6f68c4282734b572824ac2658db8e20d9a085

SHA512
ed14620e455679ff6a1f2f0f4f39d1cdd1d481d5359e219ddce86d8e6dd6529a4ec7c0d53c70a1d9e1720dbc774fcb09ade42a238f7144346ba6176aeb625ccc

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
91KB

MD5
c109309290c8537d35185a8f2e45d2d6

SHA1
ca5b32e4187ee46302270700f0b3520c4ac71624

SHA256
95fa31022a223192dea7b2b718204530ea4f6c2a66df446c1ce262f9f7bb10c1

SHA512
97fe7864ab45d7f1316442c2980a40e2f93405f686aa289438d8f5979b3a777fb8ae88ebdc91c7b9b02ce511a074c9d18734764844d281894c5ca6e1c143da74

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
91KB

MD5
c109309290c8537d35185a8f2e45d2d6

SHA1
ca5b32e4187ee46302270700f0b3520c4ac71624

SHA256
95fa31022a223192dea7b2b718204530ea4f6c2a66df446c1ce262f9f7bb10c1

SHA512
97fe7864ab45d7f1316442c2980a40e2f93405f686aa289438d8f5979b3a777fb8ae88ebdc91c7b9b02ce511a074c9d18734764844d281894c5ca6e1c143da74

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
91KB

MD5
777cd4367def13b9fb33366853e71717

SHA1
2395341293a31473e63f889e66ad8e629ef3d00a

SHA256
02ff8924fc69c2063c31f735359ae4d06c748fb63bf926b2bd492917eafd1963

SHA512
099c257ba17a9c69ff92ba3cb3a8638eec62979bcf213ed8a053487aadaf830699fed2bbe7b19eac5e04dceb82aaf3fae64a7df99a337e361fc0bb95cd060137

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
91KB

MD5
777cd4367def13b9fb33366853e71717

SHA1
2395341293a31473e63f889e66ad8e629ef3d00a

SHA256
02ff8924fc69c2063c31f735359ae4d06c748fb63bf926b2bd492917eafd1963

SHA512
099c257ba17a9c69ff92ba3cb3a8638eec62979bcf213ed8a053487aadaf830699fed2bbe7b19eac5e04dceb82aaf3fae64a7df99a337e361fc0bb95cd060137

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
91KB

MD5
f7e87ccde33176af1f266cd67c31abc9

SHA1
c433d4f115b8432ec0dc566e254c163d86112a25

SHA256
801e9d5d840eefba83c0d27d8e6cfb82215b35685a7736eccec0a14cb654a6f5

SHA512
d0d3a59493a47817cf1a03679003d8940a694f3e469c620b4504b4383472b7d551dc87a9f9cb94ae15f64ed6eb776d807a1002b5078ef3b55df9287e26caf316

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
91KB

MD5
f7e87ccde33176af1f266cd67c31abc9

SHA1
c433d4f115b8432ec0dc566e254c163d86112a25

SHA256
801e9d5d840eefba83c0d27d8e6cfb82215b35685a7736eccec0a14cb654a6f5

SHA512
d0d3a59493a47817cf1a03679003d8940a694f3e469c620b4504b4383472b7d551dc87a9f9cb94ae15f64ed6eb776d807a1002b5078ef3b55df9287e26caf316

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
91KB

MD5
c9cfb599b09d143cf6024c34c5d408da

SHA1
93d352c3aaebd6c9ab72cc928088bc3852050ccf

SHA256
85b975919ab05917add50ba13df4a78359c7980567d43bbf5587d83341714f27

SHA512
16d2954e2050a6de9e3e7b875b08ac46ca058e613b8c9034a701ae17e7ca49f60820da39774b6310a9977cf8dc601c8058fb646822f1b955cf5cd32193aabd46

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
91KB

MD5
c9cfb599b09d143cf6024c34c5d408da

SHA1
93d352c3aaebd6c9ab72cc928088bc3852050ccf

SHA256
85b975919ab05917add50ba13df4a78359c7980567d43bbf5587d83341714f27

SHA512
16d2954e2050a6de9e3e7b875b08ac46ca058e613b8c9034a701ae17e7ca49f60820da39774b6310a9977cf8dc601c8058fb646822f1b955cf5cd32193aabd46

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
91KB

MD5
884b8ef2ab18e3436e4a85b355b1f2c7

SHA1
988527c192f2dd3665f1df8fb8b6b57bd4fc41df

SHA256
178e6db8dd7e6c0acebf01992a06f130e5d5916f4eba1db6996f888ed96142d9

SHA512
8c09a1726079cc8f0fae01dd2d696daf8257482f7b8c301081517d30ca5a0a7339461aef005c3bd560bc21bbaa76d54ae96ed4e6ea959389cd2f6d20bab7c1e6

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
91KB

MD5
884b8ef2ab18e3436e4a85b355b1f2c7

SHA1
988527c192f2dd3665f1df8fb8b6b57bd4fc41df

SHA256
178e6db8dd7e6c0acebf01992a06f130e5d5916f4eba1db6996f888ed96142d9

SHA512
8c09a1726079cc8f0fae01dd2d696daf8257482f7b8c301081517d30ca5a0a7339461aef005c3bd560bc21bbaa76d54ae96ed4e6ea959389cd2f6d20bab7c1e6

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
91KB

MD5
456b4aae85568d364fb9e515b1f191d6

SHA1
b6b594b09296b3005e4eb601f11232d32a849b05

SHA256
f1a2240200f8de1af88a48236e0dfff4218f01abef1a590b3f5a5626a5d086ad

SHA512
fe130cd821e04881092688435b73117f09f8ab525eb4f3ea39f7af673fc65c468530f714c72b1c8f05c1bf46e5b6a52a462172f4344bc1b23bafe836c3ba4d3a

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
91KB

MD5
456b4aae85568d364fb9e515b1f191d6

SHA1
b6b594b09296b3005e4eb601f11232d32a849b05

SHA256
f1a2240200f8de1af88a48236e0dfff4218f01abef1a590b3f5a5626a5d086ad

SHA512
fe130cd821e04881092688435b73117f09f8ab525eb4f3ea39f7af673fc65c468530f714c72b1c8f05c1bf46e5b6a52a462172f4344bc1b23bafe836c3ba4d3a

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
91KB

MD5
87b6983ac137b93c98ee5a1085cd3db2

SHA1
5727e391b78a460f04cabffef85ddc616cdd258e

SHA256
aae65ba786240c2adfaa027b960149b4b4ea5379ac90f2fb296af2cb4690a837

SHA512
a806189c3857e0a848819ad820bed1617fec932494f284a6d238330e25569e60ed4168c807bcabf19bd5b7e0b381f5b5d83bb92f899117153ad914d37a14d2ce

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
91KB

MD5
87b6983ac137b93c98ee5a1085cd3db2

SHA1
5727e391b78a460f04cabffef85ddc616cdd258e

SHA256
aae65ba786240c2adfaa027b960149b4b4ea5379ac90f2fb296af2cb4690a837

SHA512
a806189c3857e0a848819ad820bed1617fec932494f284a6d238330e25569e60ed4168c807bcabf19bd5b7e0b381f5b5d83bb92f899117153ad914d37a14d2ce

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
91KB

MD5
bb5ba75a8051649cd1df4b8405cd66bf

SHA1
e601f4d6ba5d81d89ae87257fe591469209d2abb

SHA256
6670875cd808a46aae6a574ec417b45070d2787b22d9e103a2c78d21502da604

SHA512
06752b4da9c04abf2df3d3ced6b40465e5202f18bfc8f825eabaa83ab31f945a75625b07bc004afb4c4a16f3c7e2b336b41f3681eddabe2bd10e5517d6e37685

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
91KB

MD5
bb5ba75a8051649cd1df4b8405cd66bf

SHA1
e601f4d6ba5d81d89ae87257fe591469209d2abb

SHA256
6670875cd808a46aae6a574ec417b45070d2787b22d9e103a2c78d21502da604

SHA512
06752b4da9c04abf2df3d3ced6b40465e5202f18bfc8f825eabaa83ab31f945a75625b07bc004afb4c4a16f3c7e2b336b41f3681eddabe2bd10e5517d6e37685

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
91KB

MD5
07e30d898f8c7a58673d8abacb0dc6d0

SHA1
b1d47fd1076dc23954e4c2f73a61125922a07c78

SHA256
1209de013bf270762b8b5358eaa5593895f6d6443e49b88af277ca2ea12ab4b6

SHA512
8a8b75d382685adc346a19b02a51af7d9b988fb6c51495a0ce24b76923cea7de8d0c3b4b0322869305bcb0c4c3507d4126976e178c869564685e6cd9e16abe8b

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
91KB

MD5
07e30d898f8c7a58673d8abacb0dc6d0

SHA1
b1d47fd1076dc23954e4c2f73a61125922a07c78

SHA256
1209de013bf270762b8b5358eaa5593895f6d6443e49b88af277ca2ea12ab4b6

SHA512
8a8b75d382685adc346a19b02a51af7d9b988fb6c51495a0ce24b76923cea7de8d0c3b4b0322869305bcb0c4c3507d4126976e178c869564685e6cd9e16abe8b

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
91KB

MD5
ea06b9a69fd7fcfb4fd0fd419dae97ef

SHA1
e689adade75e9d8215105bc7543bd4cf177c1cb4

SHA256
319bfe43b09eab97759ea4847d731b2f41c77f986cfccc15740e2992db2b543a

SHA512
2a013e5fa45ac20ffaf6c64c25328a2fb6c01a9593b460257b6b7ca00e39819cdb184baeb10fb9763ef9ba4e32e944cbccefc6a9df44976c23ac23a0e540176c

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
91KB

MD5
ea06b9a69fd7fcfb4fd0fd419dae97ef

SHA1
e689adade75e9d8215105bc7543bd4cf177c1cb4

SHA256
319bfe43b09eab97759ea4847d731b2f41c77f986cfccc15740e2992db2b543a

SHA512
2a013e5fa45ac20ffaf6c64c25328a2fb6c01a9593b460257b6b7ca00e39819cdb184baeb10fb9763ef9ba4e32e944cbccefc6a9df44976c23ac23a0e540176c

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
91KB

MD5
44bfae54627fcaf5197261d10a1df349

SHA1
2570a29df6066b04b59c3541ff619be7d08664a6

SHA256
fb5ca2e283d3ba6fbddd6078db0e87a5321e7f2ed0735e2a7ca307c892544a75

SHA512
67a99f1ecf4813d6730c250967f4c49cffa79762e6251cbd4a7e84f2189b9e6e2cd21a8319b793a15e2de9127515d3de43503ce7a9d1c40612a0b38f6282b333

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
91KB

MD5
44bfae54627fcaf5197261d10a1df349

SHA1
2570a29df6066b04b59c3541ff619be7d08664a6

SHA256
fb5ca2e283d3ba6fbddd6078db0e87a5321e7f2ed0735e2a7ca307c892544a75

SHA512
67a99f1ecf4813d6730c250967f4c49cffa79762e6251cbd4a7e84f2189b9e6e2cd21a8319b793a15e2de9127515d3de43503ce7a9d1c40612a0b38f6282b333

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
91KB

MD5
06a53b953f2ce64837edb20f39ffa24a

SHA1
be4c05ecba4fe689f85bb91cc801fbcd3a2181e4

SHA256
6a3a5488ed970c237f92ed92d4632b5fa94ffc4a101afcd249142d69a8cdc263

SHA512
0375aa73e42906133c34e82fcd011a9f808c68fd540147b472828bfee5c66a3af76421802aa7779d53ab857c79c778f48c6665b72d7e2ced70a3c50041e27c4b

Download Submit
C:\Windows\SysWOW64\Edhakj32.exe

Filesize
91KB

MD5
21ab3ce33354a5ca05fd089cdd90c425

SHA1
ef9aee950d3cd7fcd4a4d89fcca02d14cf41d5c5

SHA256
f593b8a9a5e602a0b15f622834db4b8963d91a8c36f7599f0ec5501cbf1d6828

SHA512
5d7855d48ff6f473cc267509638398a6424816ce79e6ed3fdb1ff384f1ff317c68341f4b754d08e9eb0887f696ebb558a65bf630f9ae8de7e753ec7b387df3a0

Download Submit
C:\Windows\SysWOW64\Edhakj32.exe

Filesize
91KB

MD5
21ab3ce33354a5ca05fd089cdd90c425

SHA1
ef9aee950d3cd7fcd4a4d89fcca02d14cf41d5c5

SHA256
f593b8a9a5e602a0b15f622834db4b8963d91a8c36f7599f0ec5501cbf1d6828

SHA512
5d7855d48ff6f473cc267509638398a6424816ce79e6ed3fdb1ff384f1ff317c68341f4b754d08e9eb0887f696ebb558a65bf630f9ae8de7e753ec7b387df3a0

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
91KB

MD5
d07072815c195428f430668a9918aa23

SHA1
ea7070434d90952665a21d9e4ce126cbb77a2598

SHA256
393aaba017a8e6c8225c35b00e1b14a09455d1398c3502b35e7b6225c3dadc75

SHA512
99b001e19eedb960f2528e70637625c6a81e354bd6955884d981748c3b6161a579322660e7a6588e57cc4a03e07862f1787b00dfa13f26efe5ae0123354108f7

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
91KB

MD5
d07072815c195428f430668a9918aa23

SHA1
ea7070434d90952665a21d9e4ce126cbb77a2598

SHA256
393aaba017a8e6c8225c35b00e1b14a09455d1398c3502b35e7b6225c3dadc75

SHA512
99b001e19eedb960f2528e70637625c6a81e354bd6955884d981748c3b6161a579322660e7a6588e57cc4a03e07862f1787b00dfa13f26efe5ae0123354108f7

Download Submit
C:\Windows\SysWOW64\Ehapfiem.exe

Filesize
91KB

MD5
ea573f11f580b659289813a39d12556f

SHA1
aae887018ff540bd8e656c6d778b9df16498055b

SHA256
a64ee57fcb3edf1bbe8f897425a1f82008051e9674bb4ef202b3010b34206bcf

SHA512
a6f2b8e65e9756c52299ac5436a366a31dd1af3cb34e0ae0d008510e9c5dc402b5b902b0ea5664374000b7130b26ccf0811d430b215dc9b63a403a20a17a4f29

Download Submit
C:\Windows\SysWOW64\Ehapfiem.exe

Filesize
91KB

MD5
ea573f11f580b659289813a39d12556f

SHA1
aae887018ff540bd8e656c6d778b9df16498055b

SHA256
a64ee57fcb3edf1bbe8f897425a1f82008051e9674bb4ef202b3010b34206bcf

SHA512
a6f2b8e65e9756c52299ac5436a366a31dd1af3cb34e0ae0d008510e9c5dc402b5b902b0ea5664374000b7130b26ccf0811d430b215dc9b63a403a20a17a4f29

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
91KB

MD5
ad14c5e659196349be72b4a627390f18

SHA1
1e9beffd2731efd4b65ada9ab52ea3d1d3f53cf8

SHA256
8e53536894e41c639a9d61ccd8e74664d7e7d878e155ed5623daf89f64167a28

SHA512
46914850c6a377c818f50fe33ee6c72a0c6571f901c01a65dc9bf6fc2cca1c40b0db7c28a8cfc6eea2ef59400583c83415ea42d9461b494cf5f33b7c363767d2

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
91KB

MD5
ad14c5e659196349be72b4a627390f18

SHA1
1e9beffd2731efd4b65ada9ab52ea3d1d3f53cf8

SHA256
8e53536894e41c639a9d61ccd8e74664d7e7d878e155ed5623daf89f64167a28

SHA512
46914850c6a377c818f50fe33ee6c72a0c6571f901c01a65dc9bf6fc2cca1c40b0db7c28a8cfc6eea2ef59400583c83415ea42d9461b494cf5f33b7c363767d2

Download Submit
C:\Windows\SysWOW64\Ekgbccni.exe

Filesize
91KB

MD5
00ba8d5d79ea943cfbd36654e289c1b5

SHA1
70923d7f0af0d504fffe00c4efc2e096dda6ce77

SHA256
ef13192a2d1fe92ad5fabf1e53361a066a7b35ffe77d578482ad881b4347380a

SHA512
51d51782a37863bf78240f5e96ed2c5f2eb08e68ae5cdd4e5e7bf4a43ef970b48b5e589a9dd7b3b926739ec53ba222393eb7f2d1420d476207a4ab8fb770163c

Download Submit
C:\Windows\SysWOW64\Ekgbccni.exe

Filesize
91KB

MD5
00ba8d5d79ea943cfbd36654e289c1b5

SHA1
70923d7f0af0d504fffe00c4efc2e096dda6ce77

SHA256
ef13192a2d1fe92ad5fabf1e53361a066a7b35ffe77d578482ad881b4347380a

SHA512
51d51782a37863bf78240f5e96ed2c5f2eb08e68ae5cdd4e5e7bf4a43ef970b48b5e589a9dd7b3b926739ec53ba222393eb7f2d1420d476207a4ab8fb770163c

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
91KB

MD5
7390c731cfb521bc7d16d55e4fab028d

SHA1
5d3763468a46a021eea3478c448919169de22d9d

SHA256
271d05fbdc53470dee064901409187cb116ecc027e8f5330715208e3568fa677

SHA512
d4a51f4345171378bd9714adbb295644749f2fa2983822c795ea598387c7bc1060fa742d94c0e707764357ff1ea1ec760fd2de06d83271ad264061dacf34e5cb

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
91KB

MD5
7390c731cfb521bc7d16d55e4fab028d

SHA1
5d3763468a46a021eea3478c448919169de22d9d

SHA256
271d05fbdc53470dee064901409187cb116ecc027e8f5330715208e3568fa677

SHA512
d4a51f4345171378bd9714adbb295644749f2fa2983822c795ea598387c7bc1060fa742d94c0e707764357ff1ea1ec760fd2de06d83271ad264061dacf34e5cb

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
91KB

MD5
d9d5c091e5273008831effa9093450cf

SHA1
c4ba3e54c32120d431c22a1bef4943b55e002423

SHA256
ba14c6bc16cb8beda403bee58dbeb88bcd5ddcb381b202d1fd9f68ee2de2961c

SHA512
476adfaaf965abc5dabbcba868ce1a5c2ac849bf8ca429a5204b0d9dc223d3f7b7d95b2d3a9b44af83c7e4c5db435e7d594124c2423d0571989f4adc98c3bd5a

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
91KB

MD5
d9d5c091e5273008831effa9093450cf

SHA1
c4ba3e54c32120d431c22a1bef4943b55e002423

SHA256
ba14c6bc16cb8beda403bee58dbeb88bcd5ddcb381b202d1fd9f68ee2de2961c

SHA512
476adfaaf965abc5dabbcba868ce1a5c2ac849bf8ca429a5204b0d9dc223d3f7b7d95b2d3a9b44af83c7e4c5db435e7d594124c2423d0571989f4adc98c3bd5a

Download Submit
C:\Windows\SysWOW64\Eonehbjg.exe

Filesize
91KB

MD5
d472be37127b142ebd3c33f12978f2f2

SHA1
f06684b39015d10d15cd5c15913d300777a34d0c

SHA256
193fe6c46c61fc6d08d9e49a7ea0671741193124b308bcc4b0a2804d1cf20943

SHA512
6c94ed7316c7767543c02367c06c1fb836a05624c3439cac555326a2799a78e9f305e993276133675f4e38fdbd3a24c3b6c4f435206157a3854080817d8030fd

Download Submit
C:\Windows\SysWOW64\Eonehbjg.exe

Filesize
91KB

MD5
d472be37127b142ebd3c33f12978f2f2

SHA1
f06684b39015d10d15cd5c15913d300777a34d0c

SHA256
193fe6c46c61fc6d08d9e49a7ea0671741193124b308bcc4b0a2804d1cf20943

SHA512
6c94ed7316c7767543c02367c06c1fb836a05624c3439cac555326a2799a78e9f305e993276133675f4e38fdbd3a24c3b6c4f435206157a3854080817d8030fd

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
91KB

MD5
6278a28a284e1c2067b19372692d5edb

SHA1
feb06930be372fe365db96e396cb9fc6588c8520

SHA256
300873cad51e0b75f3f412939f6dd56b69b8029496937605067ef3d56f1b24c4

SHA512
2a9026659669633b47a3025a35ef531315d92b21bc86f72e312ed9f830c4eaed62446aeb3bff3b95219573657028d611de6ef86a27be2787ff5a5315a297d6a0

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
91KB

MD5
6278a28a284e1c2067b19372692d5edb

SHA1
feb06930be372fe365db96e396cb9fc6588c8520

SHA256
300873cad51e0b75f3f412939f6dd56b69b8029496937605067ef3d56f1b24c4

SHA512
2a9026659669633b47a3025a35ef531315d92b21bc86f72e312ed9f830c4eaed62446aeb3bff3b95219573657028d611de6ef86a27be2787ff5a5315a297d6a0

Download Submit
C:\Windows\SysWOW64\Fefjfked.exe

Filesize
91KB

MD5
8e650883e67b9eb5fa38f120fb415dcb

SHA1
f822827bfca20ef4793ac39ea9d452f1012260bc

SHA256
02aec29d717e760c6b3a2a36290247be726212941abee41b231717bee2520dbf

SHA512
133b208f719c40c0b6de08a9936d7185bf142e157e4656a72b46786b0bfb69aa9ef0e0997673b8bd83fdc924c11a9f6364f8f95e9f66100177db686b621c0e61

Download Submit
C:\Windows\SysWOW64\Fefjfked.exe

Filesize
91KB

MD5
8e650883e67b9eb5fa38f120fb415dcb

SHA1
f822827bfca20ef4793ac39ea9d452f1012260bc

SHA256
02aec29d717e760c6b3a2a36290247be726212941abee41b231717bee2520dbf

SHA512
133b208f719c40c0b6de08a9936d7185bf142e157e4656a72b46786b0bfb69aa9ef0e0997673b8bd83fdc924c11a9f6364f8f95e9f66100177db686b621c0e61

Download Submit
C:\Windows\SysWOW64\Fgppmd32.exe

Filesize
91KB

MD5
b163ff48398735bf0017e81082cf72c9

SHA1
b199f82b2c74dac052757a25e1affe10c21cbc07

SHA256
c7b8789ce493fbc96bf19c829b09424fec0756c8b048d5ba40264aab2fffa502

SHA512
8057176e11d07c9a736be0c39b398ed21d16ac1b45889d8f4bf33ec8cf1fdd938b03be4ced527463d60a1ed5548dc7e4c3e5aa1e5b6259077815b490030b8e15

Download Submit
C:\Windows\SysWOW64\Fgppmd32.exe

Filesize
91KB

MD5
b163ff48398735bf0017e81082cf72c9

SHA1
b199f82b2c74dac052757a25e1affe10c21cbc07

SHA256
c7b8789ce493fbc96bf19c829b09424fec0756c8b048d5ba40264aab2fffa502

SHA512
8057176e11d07c9a736be0c39b398ed21d16ac1b45889d8f4bf33ec8cf1fdd938b03be4ced527463d60a1ed5548dc7e4c3e5aa1e5b6259077815b490030b8e15

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
91KB

MD5
957b8cd8c7a32386f4f783eb37ab6282

SHA1
a212ff5a25ff0dce33c5afe610b06151f0fd4e59

SHA256
3e52d5dfcee905811d08feaae605e38ffce09b3edd06ed127b45dd59e914f2a5

SHA512
f245caa5ff18c981dad68be9fd94f8abaabd219c09d4b4e8441c74648924de197d44b01722fae2a4e259c3b75233261dbee8f6e44bf6e7959f908cc4fb0f6109

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
91KB

MD5
957b8cd8c7a32386f4f783eb37ab6282

SHA1
a212ff5a25ff0dce33c5afe610b06151f0fd4e59

SHA256
3e52d5dfcee905811d08feaae605e38ffce09b3edd06ed127b45dd59e914f2a5

SHA512
f245caa5ff18c981dad68be9fd94f8abaabd219c09d4b4e8441c74648924de197d44b01722fae2a4e259c3b75233261dbee8f6e44bf6e7959f908cc4fb0f6109

Download Submit
C:\Windows\SysWOW64\Fkqeib32.exe

Filesize
91KB

MD5
198cc42c12e5e79da95df2e36154ff6e

SHA1
cbe5e5786e1e46c86f4b8d083547553c923068bd

SHA256
1d8d5dd1acf1b479539991156d086f82330ffcbe46555554e800f321e01c86da

SHA512
c3bce984b9e4659db053404c5c9da9471ab248b841c6771f713e116886cabbe36b7be1322c827b7807c0464f1f94bf254a65dfaa29bfe2fb746c5a8fb7dd1d29

Download Submit
C:\Windows\SysWOW64\Fkqeib32.exe

Filesize
91KB

MD5
198cc42c12e5e79da95df2e36154ff6e

SHA1
cbe5e5786e1e46c86f4b8d083547553c923068bd

SHA256
1d8d5dd1acf1b479539991156d086f82330ffcbe46555554e800f321e01c86da

SHA512
c3bce984b9e4659db053404c5c9da9471ab248b841c6771f713e116886cabbe36b7be1322c827b7807c0464f1f94bf254a65dfaa29bfe2fb746c5a8fb7dd1d29

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
91KB

MD5
3371e78951c3c14a84e6f3d7e8aa8388

SHA1
0d76c9e6fa8ba5c80c60c6ba8baf43ec9c243a95

SHA256
270ac46a7c4ba2f183a6bd112d1bcb192434e353ac4cb560222d3560a76d37d0

SHA512
cd2a1e17446e69d5117eb769f09386001879c343433f406e7d056e4324d5427bf6f04a95775ecb9bc42b3d9f8478516fe7f4ccea235cf7426891d510a4203fec

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
91KB

MD5
3371e78951c3c14a84e6f3d7e8aa8388

SHA1
0d76c9e6fa8ba5c80c60c6ba8baf43ec9c243a95

SHA256
270ac46a7c4ba2f183a6bd112d1bcb192434e353ac4cb560222d3560a76d37d0

SHA512
cd2a1e17446e69d5117eb769f09386001879c343433f406e7d056e4324d5427bf6f04a95775ecb9bc42b3d9f8478516fe7f4ccea235cf7426891d510a4203fec

Download Submit
C:\Windows\SysWOW64\Fojedapj.exe

Filesize
91KB

MD5
0923b8e67fc906624a8f835f35fed5ca

SHA1
08fb57e61682629395902479d181dfa1d47e6c63

SHA256
d768314bcb1355fbd1429898a346c95255d6b999ed87e906720ba3cb3c5d1168

SHA512
df5209cd9bc18c607e6c4896240af71c1c6f75885ef4d6db8d3aed76fc22b07c45ee6ca579d1b5ebbfa2f8a3f06760754a08145845fe2cf721e13878050b1361

Download Submit
C:\Windows\SysWOW64\Fojedapj.exe

Filesize
91KB

MD5
0923b8e67fc906624a8f835f35fed5ca

SHA1
08fb57e61682629395902479d181dfa1d47e6c63

SHA256
d768314bcb1355fbd1429898a346c95255d6b999ed87e906720ba3cb3c5d1168

SHA512
df5209cd9bc18c607e6c4896240af71c1c6f75885ef4d6db8d3aed76fc22b07c45ee6ca579d1b5ebbfa2f8a3f06760754a08145845fe2cf721e13878050b1361

Download Submit
C:\Windows\SysWOW64\Hnagak32.exe

Filesize
91KB

MD5
b76d1d8a4ec172049edf890fec21e8ec

SHA1
082da403dc6b8981d23b3b1705ff412ef6ee56aa

SHA256
15def33f9dde3acd80178e1d323eecff913496f31f0b902f3a6fdf50f85e748d

SHA512
a857fc6b8a296b9ba00468073abcaeaa132ec193a4e004509ca6a1555552e017f7fb06eea696b833767116947e145603b40982dff7f42188629f0221a18b1761

Download Submit
C:\Windows\SysWOW64\Jimldogg.exe

Filesize
91KB

MD5
a0f3be6d7ab46231cbea33d07283ed98

SHA1
a9d2dc668275ed9d1135b6f16cb378acde2a0659

SHA256
9d77bae2134406e1d7138496bb1c7ec22d7490d03fc01d34b2eeb95afc23a269

SHA512
b6a6864d42716dd13b7ce43b82f6c105286cd0bcc2ec74a30b6c8efb9a6fbfd32dc0b6c9cdab47c69209fa761d61f209b57264fd66e8f6f280677c7321eea92b

Download Submit
C:\Windows\SysWOW64\Kbbhqn32.exe

Filesize
91KB

MD5
b90e8aedfc9286b576476a9299185960

SHA1
64d1555f09923ed57085a6d1fbec206b7a859ed7

SHA256
014f664f93084be5efbb6df983a3153460950e844d85d134c7b563bfeeb6f080

SHA512
4b66359e6119bcbeead07f3535c9875b8cf49332ea2d7d222908917b784d1a935f661862ac2931939ad690682a29a6d0506f46db52a90b114efff725f33c4a0b

Download Submit
C:\Windows\SysWOW64\Kbnlim32.exe

Filesize
91KB

MD5
cf2d867fdcd7bd3541583daab056f708

SHA1
e00f7abf6f2d79e0cec8a03421b0a9c2879ea615

SHA256
dfa7848ab77305e657b8dfacf6ea9683759175988e1634cc1566dcef4e949ad5

SHA512
f82867b4168f25db89b3fc1204bf24225fe62da67b64f5a04915142e98e27ccb0d29a87998b1cb676d5637368b9bcca349a8623f8c24fc812d08ee16ccd41850

Download Submit
C:\Windows\SysWOW64\Lldfjh32.exe

Filesize
91KB

MD5
fb6aa8217f121ae77e4727dbd06dce5f

SHA1
955d7f583ac6aadb274d8ecf303cc30a11c52812

SHA256
f34caf0bbccb4e160a7ff0f1999608543a72f081b5fce56277e081d8b9375e17

SHA512
82905852b9369e9a27b2395d797a56e0b08cc15b856bb8333a4015b972d5cb7a9b0b9d62ee508a592d977db091d7bca313af37bf78878a336c29c005c3d4bc01

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
91KB

MD5
b46f16d6484919ad0f9186b3c016cffc

SHA1
805628dca27dc53e8f7badb5f9908ae129414a93

SHA256
597fa01363dd90cff0cadba6b9270d8c9477ebee155b73d33a9b379729d3fa54

SHA512
6f22326decdf116ca892adaced68d340f1e326903cc5f00765b259660d7901552a0d1ea7747c0398f231b69dbf450a2052f7506bc015e8aa6dcde8c20a44c6a9

Download Submit
C:\Windows\SysWOW64\Mniallpq.exe

Filesize
91KB

MD5
a3206a0e307e56deea894976b413fdcd

SHA1
c809a2e77321a70b2baa3cc95fc9ccac0db3b973

SHA256
2bbe35eeed322a2ad776c0e26a06aca4741d505aed1f8f25604e2d297ea0db60

SHA512
580cefecc95433439fcff7f6b2d670edc1207cf169d528987b9a030c6285cb9be9327992bcf000dd29293b0f79ecedcf859b00eecab41fd127e30b8a4def4965

Download Submit
C:\Windows\SysWOW64\Nhdlao32.exe

Filesize
91KB

MD5
4e096ef0c3471e6ecc80866adb527914

SHA1
9793676dc6de7691b5e276d86f3fcd5cf1a5db5b

SHA256
cb97eb6ab2d53d124fd3e9f01f946310d629ad22a2d0e50b366d900da844b1fb

SHA512
71f33b28900d2792c560e8e4f335566f20d12d864a85b3d4341db8d7e8754c005b900b3b9961610c6339af0f6f4467d6f6979aaa3ca5ec3dfecb19345aaf1c33

Download Submit
C:\Windows\SysWOW64\Nlnbgddc.exe

Filesize
91KB

MD5
65757f9cc3d02420e1571f1ab51e558c

SHA1
e476c3de5b831fb1e4f59a2729bfceaf3cab93c4

SHA256
c51aa6a0250de2086f04732748c3db862d3bdd4bb9aa3c680c094222adee1a60

SHA512
085ec16f02a81b29c72306ae16cee693d5e7a847c491113e6e4685163d20fd280be285db20b4397079207d5afa1d2e371c9ccde491cfef25b7ed4e2a5c7d8143

Download Submit
C:\Windows\SysWOW64\Oeokal32.exe

Filesize
91KB

MD5
6f96f081c57a1eb3d33c7ff7e8d537ee

SHA1
385bf2c87cef4adf734a825feb676cda956b7ff4

SHA256
fdd7bd08722edae047db24e5630a884d5f4423d25ec6c4155936bf923a73d4e1

SHA512
6b02e10204220bd62072240ad487eedfa2368553e72b06749e0da2cabb127ab0e6c7a45c609779a5349bb425635cdbf6ec8e93a303b9b52911dea768d53197f0

Download Submit
C:\Windows\SysWOW64\Opogbbig.exe

Filesize
91KB

MD5
54ccc6daccf38d38c90131eb4334720f

SHA1
a945d8077c3bd9234bb852727f71db3a19e7da8a

SHA256
a49193c2fe3bbb91e51f030e4b0396a7b986655138b61e53326c1b89f3864c0a

SHA512
cb00b37c6a8ba534b7fb69233d12779f06805b90bb0a79563585bcbb679613e463f7a3074038b7a1fc4b360f837c7bf8fa066405db9bf29c19b19dcf08ee015b

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
91KB

MD5
8696955d78f7d43f2b5c5e97a1e312b0

SHA1
e4190ead69cd66a0a5b6bbcf049049c23953eab9

SHA256
3e5ae6642102b1194c3138f9bed0dfd3047473209a8860cb090d58cd2a42b2da

SHA512
3c2bb2e5b862fc46c8597811316c0fb0a5349ca9da4cd5cb34ceac488d2344f899c55c1513880105589d774ea3f0069c5a2a263aa5bdcbf136287da98425f603

Download Submit
C:\Windows\SysWOW64\Poliea32.exe

Filesize
91KB

MD5
37acc3ac96bdc3d80a9fa7b15c2c45b0

SHA1
7e8f192f3edb258f844dc49dd787b1e652fc8e27

SHA256
6bb45c2ef93f75f20e5557a70870905ec3f111961ca90a4377a0a72baa7fd29a

SHA512
65a45fea2598c5e9883a562428d371f27480cda4d8b6e531555abd6e65ed1379e5621f25310c1172ac667c8f69a451d8a348c6b2ddc74960f8f314cd4eb9d78d

Download Submit
C:\Windows\SysWOW64\Ponfka32.exe

Filesize
64KB

MD5
763b13fb3d14eea5d3a992774b23ec2f

SHA1
604dd975c3bf572df47baf02f82e17792678c8d8

SHA256
1312a73bf5424b3cc12f493f7681db86ae208872a6b31430f7a6bb35bdbb29b0

SHA512
da35b18783f36b2d6e79488d4815ed340b33f786eb97ff71ba64a939fb86b2527ac06023c5e8c6a127e822c883c94e0a44462907341d062d3cae85c6f4c452b1

Download Submit
C:\Windows\SysWOW64\Qdbdcg32.exe

Filesize
91KB

MD5
adff3e2a75ca1c85f08e9844fb568216

SHA1
704eb4803484db8bea70068e0ab022cb772c57da

SHA256
5986bbca00d5043e14c57da461abfbce59d6f399772d81089eb88efb00cb3191

SHA512
6eb5ea762379ddfa6dfcfffecd9550a58eff295f746636c5c3f6970104817c05b94f4a9c11c4c66912ff99f031c6c173cd0744a3497cea3b084dcd20061eaa75

Download Submit
memory/604-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/636-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/704-387-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/988-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1100-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1140-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1340-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1412-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1612-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1720-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1852-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1908-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2000-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2024-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2028-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2040-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2096-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2108-40-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2252-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2296-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2348-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2476-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2492-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2704-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2836-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2940-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2944-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3044-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3224-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3268-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3296-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3304-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3348-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3620-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3820-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4032-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4044-338-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4084-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4132-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4156-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4248-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4288-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4384-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4676-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4752-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4772-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4792-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4796-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4820-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4852-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4860-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4976-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5052-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5076-405-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5100-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads