8537e0499b7c344a5da127c33890fd878fd57ab0db07b032179245de5bc1de31

Analysis

max time kernel
0s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

491aaaacb94b00db4bd64f6748b8d7a0.exe
Size

91KB
MD5

491aaaacb94b00db4bd64f6748b8d7a0
SHA1

84ba4c153fa23aeef9ae976f2b6e9fc709cd00fb
SHA256

8537e0499b7c344a5da127c33890fd878fd57ab0db07b032179245de5bc1de31
SHA512

8693c94027bf2ccd74d4a5550b5fdb83695c668f45c834fe96e0467c90b1573ecf8155e9e42e4f9645ccff624306b778df880f2989c57e8fc14364bb80fe13cb
SSDEEP

1536:FCqDT1ajQ3naakmJUTSvCggIFkn7KGKYE6BXw5e+ZnfH:FCqDTEsJUevCgFqn7KGKYXindf

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	491aaaacb94b00db4bd64f6748b8d7a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkhoae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkhoae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	491aaaacb94b00db4bd64f6748b8d7a0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbbgnpgl.exe

Executes dropped EXE 6 IoCs

pid	Process
3836	Pjhbgb32.exe
1588	Pabkdmpi.exe
4712	Pcagphom.exe
4508	Pkhoae32.exe
3300	Pbbgnpgl.exe
4360	Peqcjkfp.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pabkdmpi.exe	Pjhbgb32.exe
File opened for modification	C:\Windows\SysWOW64\Pjhbgb32.exe	491aaaacb94b00db4bd64f6748b8d7a0.exe
File created	C:\Windows\SysWOW64\Fgcqbd32.dll	Pjhbgb32.exe
File created	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Jcfhgi32.dll	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Gfniiokn.dll	Pcagphom.exe
File created	C:\Windows\SysWOW64\Pbbgnpgl.exe	Pkhoae32.exe
File created	C:\Windows\SysWOW64\Kgllfjld.dll	Pkhoae32.exe
File opened for modification	C:\Windows\SysWOW64\Peqcjkfp.exe	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Pabkdmpi.exe	Pjhbgb32.exe
File created	C:\Windows\SysWOW64\Pkhoae32.exe	Pcagphom.exe
File created	C:\Windows\SysWOW64\Pkjnpq32.dll	Pbbgnpgl.exe
File opened for modification	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Acjoke32.dll	491aaaacb94b00db4bd64f6748b8d7a0.exe
File opened for modification	C:\Windows\SysWOW64\Pkhoae32.exe	Pcagphom.exe
File opened for modification	C:\Windows\SysWOW64\Pbbgnpgl.exe	Pkhoae32.exe
File created	C:\Windows\SysWOW64\Peqcjkfp.exe	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Pjhbgb32.exe	491aaaacb94b00db4bd64f6748b8d7a0.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11868	11632	WerFault.exe	251

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	491aaaacb94b00db4bd64f6748b8d7a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	491aaaacb94b00db4bd64f6748b8d7a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfniiokn.dll"	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcagphom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	491aaaacb94b00db4bd64f6748b8d7a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkhoae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkjnpq32.dll"	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	491aaaacb94b00db4bd64f6748b8d7a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acjoke32.dll"	491aaaacb94b00db4bd64f6748b8d7a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	491aaaacb94b00db4bd64f6748b8d7a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcqbd32.dll"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfhgi32.dll"	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkhoae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pkhoae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbbgnpgl.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3836	3164	491aaaacb94b00db4bd64f6748b8d7a0.exe	485
PID 3164 wrote to memory of 3836	3164	491aaaacb94b00db4bd64f6748b8d7a0.exe	485
PID 3164 wrote to memory of 3836	3164	491aaaacb94b00db4bd64f6748b8d7a0.exe	485
PID 3836 wrote to memory of 1588	3836	Pjhbgb32.exe	484
PID 3836 wrote to memory of 1588	3836	Pjhbgb32.exe	484
PID 3836 wrote to memory of 1588	3836	Pjhbgb32.exe	484
PID 1588 wrote to memory of 4712	1588	Pabkdmpi.exe	483
PID 1588 wrote to memory of 4712	1588	Pabkdmpi.exe	483
PID 1588 wrote to memory of 4712	1588	Pabkdmpi.exe	483
PID 4712 wrote to memory of 4508	4712	Pcagphom.exe	482
PID 4712 wrote to memory of 4508	4712	Pcagphom.exe	482
PID 4712 wrote to memory of 4508	4712	Pcagphom.exe	482
PID 4508 wrote to memory of 3300	4508	Pkhoae32.exe	481
PID 4508 wrote to memory of 3300	4508	Pkhoae32.exe	481
PID 4508 wrote to memory of 3300	4508	Pkhoae32.exe	481
PID 3300 wrote to memory of 4360	3300	Pbbgnpgl.exe	480
PID 3300 wrote to memory of 4360	3300	Pbbgnpgl.exe	480
PID 3300 wrote to memory of 4360	3300	Pbbgnpgl.exe	480

C:\Users\Admin\AppData\Local\Temp\491aaaacb94b00db4bd64f6748b8d7a0.exe
"C:\Users\Admin\AppData\Local\Temp\491aaaacb94b00db4bd64f6748b8d7a0.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\Pjhbgb32.exe
  C:\Windows\system32\Pjhbgb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3836

C:\Windows\SysWOW64\Pgopffec.exe
C:\Windows\system32\Pgopffec.exe
1⤵
PID:2952
- C:\Windows\SysWOW64\Pkjlge32.exe
  C:\Windows\system32\Pkjlge32.exe
  2⤵
  PID:4716

C:\Windows\SysWOW64\Qchmagie.exe
C:\Windows\system32\Qchmagie.exe
1⤵
PID:1516
- C:\Windows\SysWOW64\Qloebdig.exe
  C:\Windows\system32\Qloebdig.exe
  2⤵
  PID:2252

C:\Windows\SysWOW64\Abbpem32.exe
C:\Windows\system32\Abbpem32.exe
1⤵
PID:864
- C:\Windows\SysWOW64\Ahoimd32.exe
  C:\Windows\system32\Ahoimd32.exe
  2⤵
  PID:4768

C:\Windows\SysWOW64\Bhdbhcck.exe
C:\Windows\system32\Bhdbhcck.exe
1⤵
PID:1148
- C:\Windows\SysWOW64\Bjbndobo.exe
  C:\Windows\system32\Bjbndobo.exe
  2⤵
  PID:1008

C:\Windows\SysWOW64\Behbag32.exe
C:\Windows\system32\Behbag32.exe
1⤵
PID:4908
- C:\Windows\SysWOW64\Bdkcmdhp.exe
  C:\Windows\system32\Bdkcmdhp.exe
  2⤵
  PID:3512

C:\Windows\SysWOW64\Bjdkjo32.exe
C:\Windows\system32\Bjdkjo32.exe
1⤵
PID:1448
- C:\Windows\SysWOW64\Bopgjmhe.exe
  C:\Windows\system32\Bopgjmhe.exe
  2⤵
  PID:856

C:\Windows\SysWOW64\Baocghgi.exe
C:\Windows\system32\Baocghgi.exe
1⤵
PID:2680
- C:\Windows\SysWOW64\Bejogg32.exe
  C:\Windows\system32\Bejogg32.exe
  2⤵
  PID:4560
- - C:\Windows\SysWOW64\Bhikcb32.exe
    C:\Windows\system32\Bhikcb32.exe
    3⤵
    PID:3608

C:\Windows\SysWOW64\Bdolhc32.exe
C:\Windows\system32\Bdolhc32.exe
1⤵
PID:2360
- C:\Windows\SysWOW64\Blfdia32.exe
  C:\Windows\system32\Blfdia32.exe
  2⤵
  PID:4184

C:\Windows\SysWOW64\Bkidenlg.exe
C:\Windows\system32\Bkidenlg.exe
1⤵
PID:3592
- C:\Windows\SysWOW64\Cbqlfkmi.exe
  C:\Windows\system32\Cbqlfkmi.exe
  2⤵
  PID:592

C:\Windows\SysWOW64\Ceoibflm.exe
C:\Windows\system32\Ceoibflm.exe
1⤵
PID:3852
- C:\Windows\SysWOW64\Cdainc32.exe
  C:\Windows\system32\Cdainc32.exe
  2⤵
  PID:4964

C:\Windows\SysWOW64\Cogmkl32.exe
C:\Windows\system32\Cogmkl32.exe
1⤵
PID:4852
- C:\Windows\SysWOW64\Cbcilkjg.exe
  C:\Windows\system32\Cbcilkjg.exe
  2⤵
  PID:4828

C:\Windows\SysWOW64\Cknnpm32.exe
C:\Windows\system32\Cknnpm32.exe
1⤵
PID:3288
- C:\Windows\SysWOW64\Cbefaj32.exe
  C:\Windows\system32\Cbefaj32.exe
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\Cecbmf32.exe
    C:\Windows\system32\Cecbmf32.exe
    3⤵
    PID:5132
  - - C:\Windows\SysWOW64\Chbnia32.exe
      C:\Windows\system32\Chbnia32.exe
      4⤵
      PID:5172

C:\Windows\SysWOW64\Clnjjpod.exe
C:\Windows\system32\Clnjjpod.exe
1⤵
PID:5216
- C:\Windows\SysWOW64\Colffknh.exe
  C:\Windows\system32\Colffknh.exe
  2⤵
  PID:5268

C:\Windows\SysWOW64\Cajcbgml.exe
C:\Windows\system32\Cajcbgml.exe
1⤵
PID:5312
- C:\Windows\SysWOW64\Cdiooblp.exe
  C:\Windows\system32\Cdiooblp.exe
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\Clpgpp32.exe
    C:\Windows\system32\Clpgpp32.exe
    3⤵
    PID:5392

C:\Windows\SysWOW64\Conclk32.exe
C:\Windows\system32\Conclk32.exe
1⤵
PID:5432
- C:\Windows\SysWOW64\Camphf32.exe
  C:\Windows\system32\Camphf32.exe
  2⤵
  PID:5468

C:\Windows\SysWOW64\Cehkhecb.exe
C:\Windows\system32\Cehkhecb.exe
1⤵
PID:5512
- C:\Windows\SysWOW64\Chghdqbf.exe
  C:\Windows\system32\Chghdqbf.exe
  2⤵
  PID:5548
- - C:\Windows\SysWOW64\Ckedalaj.exe
    C:\Windows\system32\Ckedalaj.exe
    3⤵
    PID:5588

C:\Windows\SysWOW64\Dbllbibl.exe
C:\Windows\system32\Dbllbibl.exe
1⤵
PID:5632
- C:\Windows\SysWOW64\Dekhneap.exe
  C:\Windows\system32\Dekhneap.exe
  2⤵
  PID:5672
- - C:\Windows\SysWOW64\Dhidjpqc.exe
    C:\Windows\system32\Dhidjpqc.exe
    3⤵
    PID:5716
  - - C:\Windows\SysWOW64\Dkgqfl32.exe
      C:\Windows\system32\Dkgqfl32.exe
      4⤵
      PID:5760

C:\Windows\SysWOW64\Dboigi32.exe
C:\Windows\system32\Dboigi32.exe
1⤵
PID:5804
- C:\Windows\SysWOW64\Ddpeoafg.exe
  C:\Windows\system32\Ddpeoafg.exe
  2⤵
  PID:5848
- - C:\Windows\SysWOW64\Dlgmpogj.exe
    C:\Windows\system32\Dlgmpogj.exe
    3⤵
    PID:5892

C:\Windows\SysWOW64\Doeiljfn.exe
C:\Windows\system32\Doeiljfn.exe
1⤵
PID:5936
- C:\Windows\SysWOW64\Dbaemi32.exe
  C:\Windows\system32\Dbaemi32.exe
  2⤵
  PID:5980

C:\Windows\SysWOW64\Deoaid32.exe
C:\Windows\system32\Deoaid32.exe
1⤵
PID:6020
- C:\Windows\SysWOW64\Dhnnep32.exe
  C:\Windows\system32\Dhnnep32.exe
  2⤵
  PID:6064

C:\Windows\SysWOW64\Dlijfneg.exe
C:\Windows\system32\Dlijfneg.exe
1⤵
PID:6104
- C:\Windows\SysWOW64\Dohfbj32.exe
  C:\Windows\system32\Dohfbj32.exe
  2⤵
  PID:5140

C:\Windows\SysWOW64\Dccbbhld.exe
C:\Windows\system32\Dccbbhld.exe
1⤵
PID:5200
- C:\Windows\SysWOW64\Deanodkh.exe
  C:\Windows\system32\Deanodkh.exe
  2⤵
  PID:5252

C:\Windows\SysWOW64\Dddojq32.exe
C:\Windows\system32\Dddojq32.exe
1⤵
PID:5336
- C:\Windows\SysWOW64\Dllfkn32.exe
  C:\Windows\system32\Dllfkn32.exe
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\Dojcgi32.exe
    C:\Windows\system32\Dojcgi32.exe
    3⤵
    PID:5504

C:\Windows\SysWOW64\Dedkdcie.exe
C:\Windows\system32\Dedkdcie.exe
1⤵
PID:5260
- C:\Windows\SysWOW64\Ddgkpp32.exe
  C:\Windows\system32\Ddgkpp32.exe
  2⤵
  PID:5704

C:\Windows\SysWOW64\Dhbgqohi.exe
C:\Windows\system32\Dhbgqohi.exe
1⤵
PID:5496
- C:\Windows\SysWOW64\Ekacmjgl.exe
  C:\Windows\system32\Ekacmjgl.exe
  2⤵
  PID:5832

C:\Windows\SysWOW64\Eolpmi32.exe
C:\Windows\system32\Eolpmi32.exe
1⤵
PID:5904
- C:\Windows\SysWOW64\Eaklidoi.exe
  C:\Windows\system32\Eaklidoi.exe
  2⤵
  PID:5972

C:\Windows\SysWOW64\Edihepnm.exe
C:\Windows\system32\Edihepnm.exe
1⤵
PID:6044
- C:\Windows\SysWOW64\Ehedfo32.exe
  C:\Windows\system32\Ehedfo32.exe
  2⤵
  PID:6092

C:\Windows\SysWOW64\Ekcpbj32.exe
C:\Windows\system32\Ekcpbj32.exe
1⤵
PID:5156
- C:\Windows\SysWOW64\Eoolbinc.exe
  C:\Windows\system32\Eoolbinc.exe
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\Eamhodmf.exe
    C:\Windows\system32\Eamhodmf.exe
    3⤵
    PID:5480

C:\Windows\SysWOW64\Edkdkplj.exe
C:\Windows\system32\Edkdkplj.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\Ehgqln32.exe
  C:\Windows\system32\Ehgqln32.exe
  2⤵
  PID:5680

C:\Windows\SysWOW64\Eekaebcm.exe
C:\Windows\system32\Eekaebcm.exe
1⤵
PID:6124
- C:\Windows\SysWOW64\Ednaqo32.exe
  C:\Windows\system32\Ednaqo32.exe
  2⤵
  PID:5244

C:\Windows\SysWOW64\Ekhjmiad.exe
C:\Windows\system32\Ekhjmiad.exe
1⤵
PID:5640
- C:\Windows\SysWOW64\Eocenh32.exe
  C:\Windows\system32\Eocenh32.exe
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\Ekjfcipa.exe
    C:\Windows\system32\Ekjfcipa.exe
    3⤵
    PID:6028

C:\Windows\SysWOW64\Ehimanbq.exe
C:\Windows\system32\Ehimanbq.exe
1⤵
PID:5388

C:\Windows\SysWOW64\Ecandfpd.exe
C:\Windows\system32\Ecandfpd.exe
1⤵
PID:5228
- C:\Windows\SysWOW64\Eepjpb32.exe
  C:\Windows\system32\Eepjpb32.exe
  2⤵
  PID:5508

C:\Windows\SysWOW64\Fljcmlfd.exe
C:\Windows\system32\Fljcmlfd.exe
1⤵
PID:5424
- C:\Windows\SysWOW64\Fohoigfh.exe
  C:\Windows\system32\Fohoigfh.exe
  2⤵
  PID:5888

C:\Windows\SysWOW64\Febgea32.exe
C:\Windows\system32\Febgea32.exe
1⤵
PID:5308
- C:\Windows\SysWOW64\Fdegandp.exe
  C:\Windows\system32\Fdegandp.exe
  2⤵
  PID:5712

C:\Windows\SysWOW64\Fhqcam32.exe
C:\Windows\system32\Fhqcam32.exe
1⤵
PID:6164
- C:\Windows\SysWOW64\Fkopnh32.exe
  C:\Windows\system32\Fkopnh32.exe
  2⤵
  PID:6208

C:\Windows\SysWOW64\Fojlngce.exe
C:\Windows\system32\Fojlngce.exe
1⤵
PID:6252
- C:\Windows\SysWOW64\Faihkbci.exe
  C:\Windows\system32\Faihkbci.exe
  2⤵
  PID:6300

C:\Windows\SysWOW64\Flnlhk32.exe
C:\Windows\system32\Flnlhk32.exe
1⤵
PID:6460
- C:\Windows\SysWOW64\Fomhdg32.exe
  C:\Windows\system32\Fomhdg32.exe
  2⤵
  PID:6508

C:\Windows\SysWOW64\Fchddejl.exe
C:\Windows\system32\Fchddejl.exe
1⤵
PID:6552
- C:\Windows\SysWOW64\Ffgqqaip.exe
  C:\Windows\system32\Ffgqqaip.exe
  2⤵
  PID:6596

C:\Windows\SysWOW64\Fdialn32.exe
C:\Windows\system32\Fdialn32.exe
1⤵
PID:6640
- C:\Windows\SysWOW64\Flqimk32.exe
  C:\Windows\system32\Flqimk32.exe
  2⤵
  PID:6680

C:\Windows\SysWOW64\Fkciihgg.exe
C:\Windows\system32\Fkciihgg.exe
1⤵
PID:6728
- C:\Windows\SysWOW64\Fooeif32.exe
  C:\Windows\system32\Fooeif32.exe
  2⤵
  PID:6768

C:\Windows\SysWOW64\Fbnafb32.exe
C:\Windows\system32\Fbnafb32.exe
1⤵
PID:6816
- C:\Windows\SysWOW64\Ffimfqgm.exe
  C:\Windows\system32\Ffimfqgm.exe
  2⤵
  PID:6860

C:\Windows\SysWOW64\Fhgjblfq.exe
C:\Windows\system32\Fhgjblfq.exe
1⤵
PID:6940
- C:\Windows\SysWOW64\Fkffog32.exe
  C:\Windows\system32\Fkffog32.exe
  2⤵
  PID:6984

C:\Windows\SysWOW64\Fcmnpe32.exe
C:\Windows\system32\Fcmnpe32.exe
1⤵
PID:7024
- C:\Windows\SysWOW64\Ffkjlp32.exe
  C:\Windows\system32\Ffkjlp32.exe
  2⤵
  PID:7064
- - C:\Windows\SysWOW64\Fhjfhl32.exe
    C:\Windows\system32\Fhjfhl32.exe
    3⤵
    PID:7108

C:\Windows\SysWOW64\Gkhbdg32.exe
C:\Windows\system32\Gkhbdg32.exe
1⤵
PID:7152
- C:\Windows\SysWOW64\Gcojed32.exe
  C:\Windows\system32\Gcojed32.exe
  2⤵
  PID:6156

C:\Windows\SysWOW64\Gbbkaako.exe
C:\Windows\system32\Gbbkaako.exe
1⤵
PID:6244
- C:\Windows\SysWOW64\Gdqgmmjb.exe
  C:\Windows\system32\Gdqgmmjb.exe
  2⤵
  PID:6284

C:\Windows\SysWOW64\Glhonj32.exe
C:\Windows\system32\Glhonj32.exe
1⤵
PID:6372
- C:\Windows\SysWOW64\Gkkojgao.exe
  C:\Windows\system32\Gkkojgao.exe
  2⤵
  PID:6448
- - C:\Windows\SysWOW64\Gbdgfa32.exe
    C:\Windows\system32\Gbdgfa32.exe
    3⤵
    PID:6516

C:\Windows\SysWOW64\Gfpcgpae.exe
C:\Windows\system32\Gfpcgpae.exe
1⤵
PID:6564
- C:\Windows\SysWOW64\Ghopckpi.exe
  C:\Windows\system32\Ghopckpi.exe
  2⤵
  PID:6624
- - C:\Windows\SysWOW64\Gkmlofol.exe
    C:\Windows\system32\Gkmlofol.exe
    3⤵
    PID:6692

C:\Windows\SysWOW64\Gcddpdpo.exe
C:\Windows\system32\Gcddpdpo.exe
1⤵
PID:6780
- C:\Windows\SysWOW64\Gbgdlq32.exe
  C:\Windows\system32\Gbgdlq32.exe
  2⤵
  PID:6844
- - C:\Windows\SysWOW64\Gcfqfc32.exe
    C:\Windows\system32\Gcfqfc32.exe
    3⤵
    PID:6932

C:\Windows\SysWOW64\Gbiaapdf.exe
C:\Windows\system32\Gbiaapdf.exe
1⤵
PID:7008
- C:\Windows\SysWOW64\Gdhmnlcj.exe
  C:\Windows\system32\Gdhmnlcj.exe
  2⤵
  PID:7084

C:\Windows\SysWOW64\Gmoeoidl.exe
C:\Windows\system32\Gmoeoidl.exe
1⤵
PID:7132
- C:\Windows\SysWOW64\Gkaejf32.exe
  C:\Windows\system32\Gkaejf32.exe
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\Gcimkc32.exe
    C:\Windows\system32\Gcimkc32.exe
    3⤵
    PID:3928

C:\Windows\SysWOW64\Gfgjgo32.exe
C:\Windows\system32\Gfgjgo32.exe
1⤵
PID:6408
- C:\Windows\SysWOW64\Hiefcj32.exe
  C:\Windows\system32\Hiefcj32.exe
  2⤵
  PID:6528

C:\Windows\SysWOW64\Hmabdibj.exe
C:\Windows\system32\Hmabdibj.exe
1⤵
PID:6628
- C:\Windows\SysWOW64\Hopnqdan.exe
  C:\Windows\system32\Hopnqdan.exe
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\Hbnjmp32.exe
    C:\Windows\system32\Hbnjmp32.exe
    3⤵
    PID:6364

C:\Windows\SysWOW64\Hfifmnij.exe
C:\Windows\system32\Hfifmnij.exe
1⤵
PID:6976
- C:\Windows\SysWOW64\Hihbijhn.exe
  C:\Windows\system32\Hihbijhn.exe
  2⤵
  PID:7060

C:\Windows\SysWOW64\Hkfoeega.exe
C:\Windows\system32\Hkfoeega.exe
1⤵
PID:4504
- C:\Windows\SysWOW64\Hcmgfbhd.exe
  C:\Windows\system32\Hcmgfbhd.exe
  2⤵
  PID:6264

C:\Windows\SysWOW64\Hijooifk.exe
C:\Windows\system32\Hijooifk.exe
1⤵
PID:6636
- C:\Windows\SysWOW64\Hkikkeeo.exe
  C:\Windows\system32\Hkikkeeo.exe
  2⤵
  PID:6836
- - C:\Windows\SysWOW64\Hcpclbfa.exe
    C:\Windows\system32\Hcpclbfa.exe
    3⤵
    PID:7072

C:\Windows\SysWOW64\Hbbdholl.exe
C:\Windows\system32\Hbbdholl.exe
1⤵
PID:6280
- C:\Windows\SysWOW64\Heapdjlp.exe
  C:\Windows\system32\Heapdjlp.exe
  2⤵
  PID:6432

C:\Windows\SysWOW64\Hmhhehlb.exe
C:\Windows\system32\Hmhhehlb.exe
1⤵
PID:6716
- C:\Windows\SysWOW64\Hcbpab32.exe
  C:\Windows\system32\Hcbpab32.exe
  2⤵
  PID:7044

C:\Windows\SysWOW64\Hbeqmoji.exe
C:\Windows\system32\Hbeqmoji.exe
1⤵
PID:6452
- C:\Windows\SysWOW64\Hecmijim.exe
  C:\Windows\system32\Hecmijim.exe
  2⤵
  PID:6804
- - C:\Windows\SysWOW64\Hmjdjgjo.exe
    C:\Windows\system32\Hmjdjgjo.exe
    3⤵
    PID:6292

C:\Windows\SysWOW64\Hkmefd32.exe
C:\Windows\system32\Hkmefd32.exe
1⤵
PID:6752
- C:\Windows\SysWOW64\Hcdmga32.exe
  C:\Windows\system32\Hcdmga32.exe
  2⤵
  PID:6708

C:\Windows\SysWOW64\Hfcicmqp.exe
C:\Windows\system32\Hfcicmqp.exe
1⤵
PID:7176
- C:\Windows\SysWOW64\Iefioj32.exe
  C:\Windows\system32\Iefioj32.exe
  2⤵
  PID:7220

C:\Windows\SysWOW64\Immapg32.exe
C:\Windows\system32\Immapg32.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\Ikpaldog.exe
  C:\Windows\system32\Ikpaldog.exe
  2⤵
  PID:7300

C:\Windows\SysWOW64\Ifefimom.exe
C:\Windows\system32\Ifefimom.exe
1⤵
PID:7388
- C:\Windows\SysWOW64\Iicbehnq.exe
  C:\Windows\system32\Iicbehnq.exe
  2⤵
  PID:7436

C:\Windows\SysWOW64\Imoneg32.exe
C:\Windows\system32\Imoneg32.exe
1⤵
PID:7476
- C:\Windows\SysWOW64\Icifbang.exe
  C:\Windows\system32\Icifbang.exe
  2⤵
  PID:7516
- - C:\Windows\SysWOW64\Iblfnn32.exe
    C:\Windows\system32\Iblfnn32.exe
    3⤵
    PID:7560

C:\Windows\SysWOW64\Iejcji32.exe
C:\Windows\system32\Iejcji32.exe
1⤵
PID:7604
- C:\Windows\SysWOW64\Imakkfdg.exe
  C:\Windows\system32\Imakkfdg.exe
  2⤵
  PID:7644

C:\Windows\SysWOW64\Ickchq32.exe
C:\Windows\system32\Ickchq32.exe
1⤵
PID:7720
- C:\Windows\SysWOW64\Ifjodl32.exe
  C:\Windows\system32\Ifjodl32.exe
  2⤵
  PID:7772

C:\Windows\SysWOW64\Iemppiab.exe
C:\Windows\system32\Iemppiab.exe
1⤵
PID:7808
- C:\Windows\SysWOW64\Imdgqfbd.exe
  C:\Windows\system32\Imdgqfbd.exe
  2⤵
  PID:7856
- - C:\Windows\SysWOW64\Ipbdmaah.exe
    C:\Windows\system32\Ipbdmaah.exe
    3⤵
    PID:7904

C:\Windows\SysWOW64\Icnpmp32.exe
C:\Windows\system32\Icnpmp32.exe
1⤵
PID:7940
- C:\Windows\SysWOW64\Ifllil32.exe
  C:\Windows\system32\Ifllil32.exe
  2⤵
  PID:7984

C:\Windows\SysWOW64\Imfdff32.exe
C:\Windows\system32\Imfdff32.exe
1⤵
PID:8024
- C:\Windows\SysWOW64\Ilidbbgl.exe
  C:\Windows\system32\Ilidbbgl.exe
  2⤵
  PID:8064

C:\Windows\SysWOW64\Icplcpgo.exe
C:\Windows\system32\Icplcpgo.exe
1⤵
PID:8100
- C:\Windows\SysWOW64\Ibcmom32.exe
  C:\Windows\system32\Ibcmom32.exe
  2⤵
  PID:8144

C:\Windows\SysWOW64\Jeaikh32.exe
C:\Windows\system32\Jeaikh32.exe
1⤵
PID:6676
- C:\Windows\SysWOW64\Jmhale32.exe
  C:\Windows\system32\Jmhale32.exe
  2⤵
  PID:7204
- - C:\Windows\SysWOW64\Jpgmha32.exe
    C:\Windows\system32\Jpgmha32.exe
    3⤵
    PID:6948
  - - C:\Windows\SysWOW64\Jfaedkdp.exe
      C:\Windows\system32\Jfaedkdp.exe
      4⤵
      PID:7380

C:\Windows\SysWOW64\Jioaqfcc.exe
C:\Windows\system32\Jioaqfcc.exe
1⤵
PID:7444
- C:\Windows\SysWOW64\Jlnnmb32.exe
  C:\Windows\system32\Jlnnmb32.exe
  2⤵
  PID:7500

C:\Windows\SysWOW64\Jcefno32.exe
C:\Windows\system32\Jcefno32.exe
1⤵
PID:7588
- C:\Windows\SysWOW64\Jbhfjljd.exe
  C:\Windows\system32\Jbhfjljd.exe
  2⤵
  PID:7656
- - C:\Windows\SysWOW64\Jefbfgig.exe
    C:\Windows\system32\Jefbfgig.exe
    3⤵
    PID:7716

C:\Windows\SysWOW64\Jlpkba32.exe
C:\Windows\system32\Jlpkba32.exe
1⤵
PID:7840
- C:\Windows\SysWOW64\Jcgbco32.exe
  C:\Windows\system32\Jcgbco32.exe
  2⤵
  PID:7920

C:\Windows\SysWOW64\Jfeopj32.exe
C:\Windows\system32\Jfeopj32.exe
1⤵
PID:8004
- C:\Windows\SysWOW64\Jidklf32.exe
  C:\Windows\system32\Jidklf32.exe
  2⤵
  PID:8040
- - C:\Windows\SysWOW64\Jlbgha32.exe
    C:\Windows\system32\Jlbgha32.exe
    3⤵
    PID:8136

C:\Windows\SysWOW64\Jcioiood.exe
C:\Windows\system32\Jcioiood.exe
1⤵
PID:8188
- C:\Windows\SysWOW64\Jfhlejnh.exe
  C:\Windows\system32\Jfhlejnh.exe
  2⤵
  PID:7284
- - C:\Windows\SysWOW64\Jifhaenk.exe
    C:\Windows\system32\Jifhaenk.exe
    3⤵
    PID:7468

C:\Windows\SysWOW64\Jlednamo.exe
C:\Windows\system32\Jlednamo.exe
1⤵
PID:7552
- C:\Windows\SysWOW64\Jcllonma.exe
  C:\Windows\system32\Jcllonma.exe
  2⤵
  PID:7632
- - C:\Windows\SysWOW64\Kfjhkjle.exe
    C:\Windows\system32\Kfjhkjle.exe
    3⤵
    PID:7760

C:\Windows\SysWOW64\Kiidgeki.exe
C:\Windows\system32\Kiidgeki.exe
1⤵
PID:7804
- C:\Windows\SysWOW64\Klgqcqkl.exe
  C:\Windows\system32\Klgqcqkl.exe
  2⤵
  PID:7972
- - C:\Windows\SysWOW64\Kdnidn32.exe
    C:\Windows\system32\Kdnidn32.exe
    3⤵
    PID:8072

C:\Windows\SysWOW64\Kepelfam.exe
C:\Windows\system32\Kepelfam.exe
1⤵
PID:7356
- C:\Windows\SysWOW64\Kmfmmcbo.exe
  C:\Windows\system32\Kmfmmcbo.exe
  2⤵
  PID:7508
- - C:\Windows\SysWOW64\Kdqejn32.exe
    C:\Windows\system32\Kdqejn32.exe
    3⤵
    PID:7752

C:\Windows\SysWOW64\Kfoafi32.exe
C:\Windows\system32\Kfoafi32.exe
1⤵
PID:7888
- C:\Windows\SysWOW64\Kimnbd32.exe
  C:\Windows\system32\Kimnbd32.exe
  2⤵
  PID:8092
- - C:\Windows\SysWOW64\Klljnp32.exe
    C:\Windows\system32\Klljnp32.exe
    3⤵
    PID:7296

C:\Windows\SysWOW64\Kdcbom32.exe
C:\Windows\system32\Kdcbom32.exe
1⤵
PID:7396
- C:\Windows\SysWOW64\Kfankifm.exe
  C:\Windows\system32\Kfankifm.exe
  2⤵
  PID:7868

C:\Windows\SysWOW64\Kedoge32.exe
C:\Windows\system32\Kedoge32.exe
1⤵
PID:8124
- C:\Windows\SysWOW64\Kmkfhc32.exe
  C:\Windows\system32\Kmkfhc32.exe
  2⤵
  PID:7556

C:\Windows\SysWOW64\Kpjcdn32.exe
C:\Windows\system32\Kpjcdn32.exe
1⤵
PID:8044
- C:\Windows\SysWOW64\Kdeoemeg.exe
  C:\Windows\system32\Kdeoemeg.exe
  2⤵
  PID:7640

C:\Windows\SysWOW64\Kfckahdj.exe
C:\Windows\system32\Kfckahdj.exe
1⤵
PID:7188
- C:\Windows\SysWOW64\Kefkme32.exe
  C:\Windows\system32\Kefkme32.exe
  2⤵
  PID:8200
- - C:\Windows\SysWOW64\Kmncnb32.exe
    C:\Windows\system32\Kmncnb32.exe
    3⤵
    PID:8248

C:\Windows\SysWOW64\Kdgljmcd.exe
C:\Windows\system32\Kdgljmcd.exe
1⤵
PID:8296
- C:\Windows\SysWOW64\Lffhfh32.exe
  C:\Windows\system32\Lffhfh32.exe
  2⤵
  PID:8340

C:\Windows\SysWOW64\Liddbc32.exe
C:\Windows\system32\Liddbc32.exe
1⤵
PID:8376
- C:\Windows\SysWOW64\Llcpoo32.exe
  C:\Windows\system32\Llcpoo32.exe
  2⤵
  PID:8420
- - C:\Windows\SysWOW64\Ldjhpl32.exe
    C:\Windows\system32\Ldjhpl32.exe
    3⤵
    PID:8460

C:\Windows\SysWOW64\Lfhdlh32.exe
C:\Windows\system32\Lfhdlh32.exe
1⤵
PID:8504
- C:\Windows\SysWOW64\Ligqhc32.exe
  C:\Windows\system32\Ligqhc32.exe
  2⤵
  PID:8548
- - C:\Windows\SysWOW64\Llemdo32.exe
    C:\Windows\system32\Llemdo32.exe
    3⤵
    PID:8588

C:\Windows\SysWOW64\Ldleel32.exe
C:\Windows\system32\Ldleel32.exe
1⤵
PID:8632
- C:\Windows\SysWOW64\Lfkaag32.exe
  C:\Windows\system32\Lfkaag32.exe
  2⤵
  PID:8676

C:\Windows\SysWOW64\Liimncmf.exe
C:\Windows\system32\Liimncmf.exe
1⤵
PID:8720
- C:\Windows\SysWOW64\Lmdina32.exe
  C:\Windows\system32\Lmdina32.exe
  2⤵
  PID:8772

C:\Windows\SysWOW64\Ldoaklml.exe
C:\Windows\system32\Ldoaklml.exe
1⤵
PID:8820
- C:\Windows\SysWOW64\Lbabgh32.exe
  C:\Windows\system32\Lbabgh32.exe
  2⤵
  PID:8868
- - C:\Windows\SysWOW64\Lepncd32.exe
    C:\Windows\system32\Lepncd32.exe
    3⤵
    PID:8912

C:\Windows\SysWOW64\Lmgfda32.exe
C:\Windows\system32\Lmgfda32.exe
1⤵
PID:8956
- C:\Windows\SysWOW64\Lljfpnjg.exe
  C:\Windows\system32\Lljfpnjg.exe
  2⤵
  PID:9000

C:\Windows\SysWOW64\Ldanqkki.exe
C:\Windows\system32\Ldanqkki.exe
1⤵
PID:9040
- C:\Windows\SysWOW64\Lbdolh32.exe
  C:\Windows\system32\Lbdolh32.exe
  2⤵
  PID:9080

C:\Windows\SysWOW64\Lebkhc32.exe
C:\Windows\system32\Lebkhc32.exe
1⤵
PID:9128
- C:\Windows\SysWOW64\Lingibiq.exe
  C:\Windows\system32\Lingibiq.exe
  2⤵
  PID:9168

C:\Windows\SysWOW64\Lllcen32.exe
C:\Windows\system32\Lllcen32.exe
1⤵
PID:9212
- C:\Windows\SysWOW64\Lphoelqn.exe
  C:\Windows\system32\Lphoelqn.exe
  2⤵
  PID:8220
- - C:\Windows\SysWOW64\Mbfkbhpa.exe
    C:\Windows\system32\Mbfkbhpa.exe
    3⤵
    PID:8276

C:\Windows\SysWOW64\Mipcob32.exe
C:\Windows\system32\Mipcob32.exe
1⤵
PID:8448
- C:\Windows\SysWOW64\Mmlpoqpg.exe
  C:\Windows\system32\Mmlpoqpg.exe
  2⤵
  PID:8472
- - C:\Windows\SysWOW64\Mdehlk32.exe
    C:\Windows\system32\Mdehlk32.exe
    3⤵
    PID:8568

C:\Windows\SysWOW64\Mchhggno.exe
C:\Windows\system32\Mchhggno.exe
1⤵
PID:8640
- C:\Windows\SysWOW64\Megdccmb.exe
  C:\Windows\system32\Megdccmb.exe
  2⤵
  PID:8708

C:\Windows\SysWOW64\Mibpda32.exe
C:\Windows\system32\Mibpda32.exe
1⤵
PID:8808
- C:\Windows\SysWOW64\Mlampmdo.exe
  C:\Windows\system32\Mlampmdo.exe
  2⤵
  PID:8860

C:\Windows\SysWOW64\Mdhdajea.exe
C:\Windows\system32\Mdhdajea.exe
1⤵
PID:8940
- C:\Windows\SysWOW64\Mckemg32.exe
  C:\Windows\system32\Mckemg32.exe
  2⤵
  PID:8996
- - C:\Windows\SysWOW64\Meiaib32.exe
    C:\Windows\system32\Meiaib32.exe
    3⤵
    PID:9076

C:\Windows\SysWOW64\Mmpijp32.exe
C:\Windows\system32\Mmpijp32.exe
1⤵
PID:9152
- C:\Windows\SysWOW64\Mpoefk32.exe
  C:\Windows\system32\Mpoefk32.exe
  2⤵
  PID:9208

C:\Windows\SysWOW64\Mcmabg32.exe
C:\Windows\system32\Mcmabg32.exe
1⤵
PID:8284
- C:\Windows\SysWOW64\Melnob32.exe
  C:\Windows\system32\Melnob32.exe
  2⤵
  PID:8456

C:\Windows\SysWOW64\Migjoaaf.exe
C:\Windows\system32\Migjoaaf.exe
1⤵
PID:8524
- C:\Windows\SysWOW64\Mlefklpj.exe
  C:\Windows\system32\Mlefklpj.exe
  2⤵
  PID:8612
- - C:\Windows\SysWOW64\Mdmnlj32.exe
    C:\Windows\system32\Mdmnlj32.exe
    3⤵
    PID:8760

C:\Windows\SysWOW64\Mcpnhfhf.exe
C:\Windows\system32\Mcpnhfhf.exe
1⤵
PID:8880
- C:\Windows\SysWOW64\Mgkjhe32.exe
  C:\Windows\system32\Mgkjhe32.exe
  2⤵
  PID:9024

C:\Windows\SysWOW64\Miifeq32.exe
C:\Windows\system32\Miifeq32.exe
1⤵
PID:9108
- C:\Windows\SysWOW64\Mlhbal32.exe
  C:\Windows\system32\Mlhbal32.exe
  2⤵
  PID:8208

C:\Windows\SysWOW64\Npcoakfp.exe
C:\Windows\system32\Npcoakfp.exe
1⤵
PID:8428
- C:\Windows\SysWOW64\Ncbknfed.exe
  C:\Windows\system32\Ncbknfed.exe
  2⤵
  PID:8556

C:\Windows\SysWOW64\Nepgjaeg.exe
C:\Windows\system32\Nepgjaeg.exe
1⤵
PID:8756
- C:\Windows\SysWOW64\Nilcjp32.exe
  C:\Windows\system32\Nilcjp32.exe
  2⤵
  PID:8984

C:\Windows\SysWOW64\Nljofl32.exe
C:\Windows\system32\Nljofl32.exe
1⤵
PID:9100
- C:\Windows\SysWOW64\Ndaggimg.exe
  C:\Windows\system32\Ndaggimg.exe
  2⤵
  PID:8384
- - C:\Windows\SysWOW64\Ngpccdlj.exe
    C:\Windows\system32\Ngpccdlj.exe
    3⤵
    PID:8628

C:\Windows\SysWOW64\Nnjlpo32.exe
C:\Windows\system32\Nnjlpo32.exe
1⤵
PID:8336
- C:\Windows\SysWOW64\Nphhmj32.exe
  C:\Windows\system32\Nphhmj32.exe
  2⤵
  PID:8768
- - C:\Windows\SysWOW64\Ndcdmikd.exe
    C:\Windows\system32\Ndcdmikd.exe
    3⤵
    PID:9088

C:\Windows\SysWOW64\Ngbpidjh.exe
C:\Windows\system32\Ngbpidjh.exe
1⤵
PID:8492
- C:\Windows\SysWOW64\Njqmepik.exe
  C:\Windows\system32\Njqmepik.exe
  2⤵
  PID:8528

C:\Windows\SysWOW64\Nnlhfn32.exe
C:\Windows\system32\Nnlhfn32.exe
1⤵
PID:8368
- C:\Windows\SysWOW64\Npjebj32.exe
  C:\Windows\system32\Npjebj32.exe
  2⤵
  PID:9252
- - C:\Windows\SysWOW64\Ncianepl.exe
    C:\Windows\system32\Ncianepl.exe
    3⤵
    PID:9296

C:\Windows\SysWOW64\Nfgmjqop.exe
C:\Windows\system32\Nfgmjqop.exe
1⤵
PID:9344
- C:\Windows\SysWOW64\Nnneknob.exe
  C:\Windows\system32\Nnneknob.exe
  2⤵
  PID:9384
- - C:\Windows\SysWOW64\Npmagine.exe
    C:\Windows\system32\Npmagine.exe
    3⤵
    PID:9428

C:\Windows\SysWOW64\Nckndeni.exe
C:\Windows\system32\Nckndeni.exe
1⤵
PID:9468
- C:\Windows\SysWOW64\Nfjjppmm.exe
  C:\Windows\system32\Nfjjppmm.exe
  2⤵
  PID:9512

C:\Windows\SysWOW64\Nnqbanmo.exe
C:\Windows\system32\Nnqbanmo.exe
1⤵
PID:9556
- C:\Windows\SysWOW64\Oponmilc.exe
  C:\Windows\system32\Oponmilc.exe
  2⤵
  PID:9600

C:\Windows\SysWOW64\Ocnjidkf.exe
C:\Windows\system32\Ocnjidkf.exe
1⤵
PID:9636
- C:\Windows\SysWOW64\Oflgep32.exe
  C:\Windows\system32\Oflgep32.exe
  2⤵
  PID:9680
- - C:\Windows\SysWOW64\Ojgbfocc.exe
    C:\Windows\system32\Ojgbfocc.exe
    3⤵
    PID:9724

C:\Windows\SysWOW64\Olfobjbg.exe
C:\Windows\system32\Olfobjbg.exe
1⤵
PID:9764
- C:\Windows\SysWOW64\Opakbi32.exe
  C:\Windows\system32\Opakbi32.exe
  2⤵
  PID:9808

C:\Windows\SysWOW64\Ocpgod32.exe
C:\Windows\system32\Ocpgod32.exe
1⤵
PID:9848
- C:\Windows\SysWOW64\Ofnckp32.exe
  C:\Windows\system32\Ofnckp32.exe
  2⤵
  PID:9888

C:\Windows\SysWOW64\Ojjolnaq.exe
C:\Windows\system32\Ojjolnaq.exe
1⤵
PID:9936
- C:\Windows\SysWOW64\Olhlhjpd.exe
  C:\Windows\system32\Olhlhjpd.exe
  2⤵
  PID:9976

C:\Windows\SysWOW64\Opdghh32.exe
C:\Windows\system32\Opdghh32.exe
1⤵
PID:10012
- C:\Windows\SysWOW64\Ocbddc32.exe
  C:\Windows\system32\Ocbddc32.exe
  2⤵
  PID:10056
- - C:\Windows\SysWOW64\Ofqpqo32.exe
    C:\Windows\system32\Ofqpqo32.exe
    3⤵
    PID:10096

C:\Windows\SysWOW64\Onhhamgg.exe
C:\Windows\system32\Onhhamgg.exe
1⤵
PID:10144
- C:\Windows\SysWOW64\Oqfdnhfk.exe
  C:\Windows\system32\Oqfdnhfk.exe
  2⤵
  PID:10188

C:\Windows\SysWOW64\Ocdqjceo.exe
C:\Windows\system32\Ocdqjceo.exe
1⤵
PID:10224
- C:\Windows\SysWOW64\Ofcmfodb.exe
  C:\Windows\system32\Ofcmfodb.exe
  2⤵
  PID:9236
- - C:\Windows\SysWOW64\Ojoign32.exe
    C:\Windows\system32\Ojoign32.exe
    3⤵
    PID:9312
  - - C:\Windows\SysWOW64\Oddmdf32.exe
      C:\Windows\system32\Oddmdf32.exe
      4⤵
      PID:9392

C:\Windows\SysWOW64\Pnonbk32.exe
C:\Windows\system32\Pnonbk32.exe
1⤵
PID:9452
- C:\Windows\SysWOW64\Pqmjog32.exe
  C:\Windows\system32\Pqmjog32.exe
  2⤵
  PID:8728

C:\Windows\SysWOW64\Pggbkagp.exe
C:\Windows\system32\Pggbkagp.exe
1⤵
PID:9648
- C:\Windows\SysWOW64\Pjeoglgc.exe
  C:\Windows\system32\Pjeoglgc.exe
  2⤵
  PID:9716
- - C:\Windows\SysWOW64\Pmdkch32.exe
    C:\Windows\system32\Pmdkch32.exe
    3⤵
    PID:9800

C:\Windows\SysWOW64\Pdkcde32.exe
C:\Windows\system32\Pdkcde32.exe
1⤵
PID:9872
- C:\Windows\SysWOW64\Pgioqq32.exe
  C:\Windows\system32\Pgioqq32.exe
  2⤵
  PID:9928

C:\Windows\SysWOW64\Pflplnlg.exe
C:\Windows\system32\Pflplnlg.exe
1⤵
PID:10008
- C:\Windows\SysWOW64\Pncgmkmj.exe
  C:\Windows\system32\Pncgmkmj.exe
  2⤵
  PID:10076

C:\Windows\SysWOW64\Pqbdjfln.exe
C:\Windows\system32\Pqbdjfln.exe
1⤵
PID:10156
- C:\Windows\SysWOW64\Pdmpje32.exe
  C:\Windows\system32\Pdmpje32.exe
  2⤵
  PID:10220

C:\Windows\SysWOW64\Pgllfp32.exe
C:\Windows\system32\Pgllfp32.exe
1⤵
PID:9280
- C:\Windows\SysWOW64\Pjjhbl32.exe
  C:\Windows\system32\Pjjhbl32.exe
  2⤵
  PID:9420

C:\Windows\SysWOW64\Pmidog32.exe
C:\Windows\system32\Pmidog32.exe
1⤵
PID:9520
- C:\Windows\SysWOW64\Pqdqof32.exe
  C:\Windows\system32\Pqdqof32.exe
  2⤵
  PID:9628

C:\Windows\SysWOW64\Pdpmpdbd.exe
C:\Windows\system32\Pdpmpdbd.exe
1⤵
PID:9792
- C:\Windows\SysWOW64\Pgnilpah.exe
  C:\Windows\system32\Pgnilpah.exe
  2⤵
  PID:9896

C:\Windows\SysWOW64\Pfaigm32.exe
C:\Windows\system32\Pfaigm32.exe
1⤵
PID:10024
- C:\Windows\SysWOW64\Qnhahj32.exe
  C:\Windows\system32\Qnhahj32.exe
  2⤵
  PID:10124
- - C:\Windows\SysWOW64\Qqfmde32.exe
    C:\Windows\system32\Qqfmde32.exe
    3⤵
    PID:10236

C:\Windows\SysWOW64\Qceiaa32.exe
C:\Windows\system32\Qceiaa32.exe
1⤵
PID:9424
- C:\Windows\SysWOW64\Qgqeappe.exe
  C:\Windows\system32\Qgqeappe.exe
  2⤵
  PID:9580

C:\Windows\SysWOW64\Qjoankoi.exe
C:\Windows\system32\Qjoankoi.exe
1⤵
PID:9776
- C:\Windows\SysWOW64\Qnjnnj32.exe
  C:\Windows\system32\Qnjnnj32.exe
  2⤵
  PID:9956

C:\Windows\SysWOW64\Qqijje32.exe
C:\Windows\system32\Qqijje32.exe
1⤵
PID:10064
- C:\Windows\SysWOW64\Qcgffqei.exe
  C:\Windows\system32\Qcgffqei.exe
  2⤵
  PID:9328

C:\Windows\SysWOW64\Qgcbgo32.exe
C:\Windows\system32\Qgcbgo32.exe
1⤵
PID:9552
- C:\Windows\SysWOW64\Ajanck32.exe
  C:\Windows\system32\Ajanck32.exe
  2⤵
  PID:9996

C:\Windows\SysWOW64\Anmjcieo.exe
C:\Windows\system32\Anmjcieo.exe
1⤵
PID:10212
- C:\Windows\SysWOW64\Adgbpc32.exe
  C:\Windows\system32\Adgbpc32.exe
  2⤵
  PID:9488
- - C:\Windows\SysWOW64\Ageolo32.exe
    C:\Windows\system32\Ageolo32.exe
    3⤵
    PID:10084

C:\Windows\SysWOW64\Ajckij32.exe
C:\Windows\system32\Ajckij32.exe
1⤵
PID:9772
- C:\Windows\SysWOW64\Ambgef32.exe
  C:\Windows\system32\Ambgef32.exe
  2⤵
  PID:10208

C:\Windows\SysWOW64\Aeiofcji.exe
C:\Windows\system32\Aeiofcji.exe
1⤵
PID:9644
- C:\Windows\SysWOW64\Agglboim.exe
  C:\Windows\system32\Agglboim.exe
  2⤵
  PID:10292

C:\Windows\SysWOW64\Ajfhnjhq.exe
C:\Windows\system32\Ajfhnjhq.exe
1⤵
PID:10332
- C:\Windows\SysWOW64\Amddjegd.exe
  C:\Windows\system32\Amddjegd.exe
  2⤵
  PID:10384

C:\Windows\SysWOW64\Aeklkchg.exe
C:\Windows\system32\Aeklkchg.exe
1⤵
PID:10428
- C:\Windows\SysWOW64\Agjhgngj.exe
  C:\Windows\system32\Agjhgngj.exe
  2⤵
  PID:10472
- - C:\Windows\SysWOW64\Ajhddjfn.exe
    C:\Windows\system32\Ajhddjfn.exe
    3⤵
    PID:10516

C:\Windows\SysWOW64\Andqdh32.exe
C:\Windows\system32\Andqdh32.exe
1⤵
PID:10560
- C:\Windows\SysWOW64\Aeniabfd.exe
  C:\Windows\system32\Aeniabfd.exe
  2⤵
  PID:10604

C:\Windows\SysWOW64\Acqimo32.exe
C:\Windows\system32\Acqimo32.exe
1⤵
PID:10640
- C:\Windows\SysWOW64\Afoeiklb.exe
  C:\Windows\system32\Afoeiklb.exe
  2⤵
  PID:10692

C:\Windows\SysWOW64\Anfmjhmd.exe
C:\Windows\system32\Anfmjhmd.exe
1⤵
PID:10728
- C:\Windows\SysWOW64\Aminee32.exe
  C:\Windows\system32\Aminee32.exe
  2⤵
  PID:10780
- - C:\Windows\SysWOW64\Aepefb32.exe
    C:\Windows\system32\Aepefb32.exe
    3⤵
    PID:10820

C:\Windows\SysWOW64\Agoabn32.exe
C:\Windows\system32\Agoabn32.exe
1⤵
PID:10860
- C:\Windows\SysWOW64\Bfabnjjp.exe
  C:\Windows\system32\Bfabnjjp.exe
  2⤵
  PID:10900

C:\Windows\SysWOW64\Bnhjohkb.exe
C:\Windows\system32\Bnhjohkb.exe
1⤵
PID:10940
- C:\Windows\SysWOW64\Bebblb32.exe
  C:\Windows\system32\Bebblb32.exe
  2⤵
  PID:10980
- - C:\Windows\SysWOW64\Bganhm32.exe
    C:\Windows\system32\Bganhm32.exe
    3⤵
    PID:11024

C:\Windows\SysWOW64\Bnkgeg32.exe
C:\Windows\system32\Bnkgeg32.exe
1⤵
PID:11056
- C:\Windows\SysWOW64\Bgcknmop.exe
  C:\Windows\system32\Bgcknmop.exe
  2⤵
  PID:11108
- - C:\Windows\SysWOW64\Bffkij32.exe
    C:\Windows\system32\Bffkij32.exe
    3⤵
    PID:11144
  - - C:\Windows\SysWOW64\Bmpcfdmg.exe
      C:\Windows\system32\Bmpcfdmg.exe
      4⤵
      PID:11192

C:\Windows\SysWOW64\Beglgani.exe
C:\Windows\system32\Beglgani.exe
1⤵
PID:9288
- C:\Windows\SysWOW64\Bgehcmmm.exe
  C:\Windows\system32\Bgehcmmm.exe
  2⤵
  PID:10340
- - C:\Windows\SysWOW64\Bjddphlq.exe
    C:\Windows\system32\Bjddphlq.exe
    3⤵
    PID:10364

C:\Windows\SysWOW64\Bmbplc32.exe
C:\Windows\system32\Bmbplc32.exe
1⤵
PID:10436
- C:\Windows\SysWOW64\Beihma32.exe
  C:\Windows\system32\Beihma32.exe
  2⤵
  PID:10504

C:\Windows\SysWOW64\Bclhhnca.exe
C:\Windows\system32\Bclhhnca.exe
1⤵
PID:10600
- C:\Windows\SysWOW64\Bfkedibe.exe
  C:\Windows\system32\Bfkedibe.exe
  2⤵
  PID:10632

C:\Windows\SysWOW64\Bjfaeh32.exe
C:\Windows\system32\Bjfaeh32.exe
1⤵
PID:10704
- C:\Windows\SysWOW64\Bmemac32.exe
  C:\Windows\system32\Bmemac32.exe
  2⤵
  PID:10788

C:\Windows\SysWOW64\Belebq32.exe
C:\Windows\system32\Belebq32.exe
1⤵
PID:10852
- C:\Windows\SysWOW64\Chjaol32.exe
  C:\Windows\system32\Chjaol32.exe
  2⤵
  PID:10924
- - C:\Windows\SysWOW64\Cjinkg32.exe
    C:\Windows\system32\Cjinkg32.exe
    3⤵
    PID:4884
  - - C:\Windows\SysWOW64\Cabfga32.exe
      C:\Windows\system32\Cabfga32.exe
      4⤵
      PID:4144

C:\Windows\SysWOW64\Cdabcm32.exe
C:\Windows\system32\Cdabcm32.exe
1⤵
PID:3236
- C:\Windows\SysWOW64\Chmndlge.exe
  C:\Windows\system32\Chmndlge.exe
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\Cjkjpgfi.exe
    C:\Windows\system32\Cjkjpgfi.exe
    3⤵
    PID:11132

C:\Windows\SysWOW64\Cmiflbel.exe
C:\Windows\system32\Cmiflbel.exe
1⤵
PID:11208
- C:\Windows\SysWOW64\Ceqnmpfo.exe
  C:\Windows\system32\Ceqnmpfo.exe
  2⤵
  PID:11256

C:\Windows\SysWOW64\Cjmgfgdf.exe
C:\Windows\system32\Cjmgfgdf.exe
1⤵
PID:10452
- C:\Windows\SysWOW64\Cmlcbbcj.exe
  C:\Windows\system32\Cmlcbbcj.exe
  2⤵
  PID:10592
- - C:\Windows\SysWOW64\Cagobalc.exe
    C:\Windows\system32\Cagobalc.exe
    3⤵
    PID:10688

C:\Windows\SysWOW64\Cdfkolkf.exe
C:\Windows\system32\Cdfkolkf.exe
1⤵
PID:10808
- C:\Windows\SysWOW64\Chagok32.exe
  C:\Windows\system32\Chagok32.exe
  2⤵
  PID:10932

C:\Windows\SysWOW64\Cjpckf32.exe
C:\Windows\system32\Cjpckf32.exe
1⤵
PID:2408
- C:\Windows\SysWOW64\Cmnpgb32.exe
  C:\Windows\system32\Cmnpgb32.exe
  2⤵
  PID:11000
- - C:\Windows\SysWOW64\Ceehho32.exe
    C:\Windows\system32\Ceehho32.exe
    3⤵
    PID:11076

C:\Windows\SysWOW64\Chcddk32.exe
C:\Windows\system32\Chcddk32.exe
1⤵
PID:11224
- C:\Windows\SysWOW64\Cjbpaf32.exe
  C:\Windows\system32\Cjbpaf32.exe
  2⤵
  PID:10424

C:\Windows\SysWOW64\Cnnlaehj.exe
C:\Windows\system32\Cnnlaehj.exe
1⤵
PID:10544
- C:\Windows\SysWOW64\Calhnpgn.exe
  C:\Windows\system32\Calhnpgn.exe
  2⤵
  PID:10720
- - C:\Windows\SysWOW64\Ddjejl32.exe
    C:\Windows\system32\Ddjejl32.exe
    3⤵
    PID:10908

C:\Windows\SysWOW64\Dfiafg32.exe
C:\Windows\system32\Dfiafg32.exe
1⤵
PID:4864
- C:\Windows\SysWOW64\Dopigd32.exe
  C:\Windows\system32\Dopigd32.exe
  2⤵
  PID:11092
- - C:\Windows\SysWOW64\Danecp32.exe
    C:\Windows\system32\Danecp32.exe
    3⤵
    PID:10304

C:\Windows\SysWOW64\Ddmaok32.exe
C:\Windows\system32\Ddmaok32.exe
1⤵
PID:10456
- C:\Windows\SysWOW64\Dhhnpjmh.exe
  C:\Windows\system32\Dhhnpjmh.exe
  2⤵
  PID:10776
- - C:\Windows\SysWOW64\Djgjlelk.exe
    C:\Windows\system32\Djgjlelk.exe
    3⤵
    PID:10972

C:\Windows\SysWOW64\Daqbip32.exe
C:\Windows\system32\Daqbip32.exe
1⤵
PID:9228
- C:\Windows\SysWOW64\Delnin32.exe
  C:\Windows\system32\Delnin32.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\Dhkjej32.exe
    C:\Windows\system32\Dhkjej32.exe
    3⤵
    PID:4088

C:\Windows\SysWOW64\Dkifae32.exe
C:\Windows\system32\Dkifae32.exe
1⤵
PID:10484
- C:\Windows\SysWOW64\Dmgbnq32.exe
  C:\Windows\system32\Dmgbnq32.exe
  2⤵
  PID:11080

C:\Windows\SysWOW64\Daconoae.exe
C:\Windows\system32\Daconoae.exe
1⤵
PID:3004
- C:\Windows\SysWOW64\Ddakjkqi.exe
  C:\Windows\system32\Ddakjkqi.exe
  2⤵
  PID:11284

C:\Windows\SysWOW64\Dfpgffpm.exe
C:\Windows\system32\Dfpgffpm.exe
1⤵
PID:11328
- C:\Windows\SysWOW64\Dkkcge32.exe
  C:\Windows\system32\Dkkcge32.exe
  2⤵
  PID:11364

C:\Windows\SysWOW64\Dmjocp32.exe
C:\Windows\system32\Dmjocp32.exe
1⤵
PID:11408
- C:\Windows\SysWOW64\Daekdooc.exe
  C:\Windows\system32\Daekdooc.exe
  2⤵
  PID:11456

C:\Windows\SysWOW64\Dddhpjof.exe
C:\Windows\system32\Dddhpjof.exe
1⤵
PID:11500
- C:\Windows\SysWOW64\Dhocqigp.exe
  C:\Windows\system32\Dhocqigp.exe
  2⤵
  PID:11540

C:\Windows\SysWOW64\Dknpmdfc.exe
C:\Windows\system32\Dknpmdfc.exe
1⤵
PID:11592
- C:\Windows\SysWOW64\Dmllipeg.exe
  C:\Windows\system32\Dmllipeg.exe
  2⤵
  PID:11632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11632 -s 404
    3⤵
    - Program crash
    PID:11868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 11632 -ip 11632
1⤵
PID:11748

C:\Windows\SysWOW64\Chokikeb.exe
C:\Windows\system32\Chokikeb.exe
1⤵
PID:10392

C:\Windows\SysWOW64\Balpgb32.exe
C:\Windows\system32\Balpgb32.exe
1⤵
PID:11232

C:\Windows\SysWOW64\Pclgkb32.exe
C:\Windows\system32\Pclgkb32.exe
1⤵
PID:9584

C:\Windows\SysWOW64\Njnpppkn.exe
C:\Windows\system32\Njnpppkn.exe
1⤵
PID:8900

C:\Windows\SysWOW64\Mgagbf32.exe
C:\Windows\system32\Mgagbf32.exe
1⤵
PID:8372

C:\Windows\SysWOW64\Kfmepi32.exe
C:\Windows\system32\Kfmepi32.exe
1⤵
PID:8180

C:\Windows\SysWOW64\Jmmjgejj.exe
C:\Windows\system32\Jmmjgejj.exe
1⤵
PID:7780

C:\Windows\SysWOW64\Ippggbck.exe
C:\Windows\system32\Ippggbck.exe
1⤵
PID:7684

C:\Windows\SysWOW64\Icgjmapi.exe
C:\Windows\system32\Icgjmapi.exe
1⤵
PID:7340

C:\Windows\SysWOW64\Hbpgbo32.exe
C:\Windows\system32\Hbpgbo32.exe
1⤵
PID:7048

C:\Windows\SysWOW64\Fdlnbm32.exe
C:\Windows\system32\Fdlnbm32.exe
1⤵
PID:6900

C:\Windows\SysWOW64\Fhcpgmjf.exe
C:\Windows\system32\Fhcpgmjf.exe
1⤵
PID:6424

C:\Windows\SysWOW64\Fdgdgnbm.exe
C:\Windows\system32\Fdgdgnbm.exe
1⤵
PID:6380

C:\Windows\SysWOW64\Ffddka32.exe
C:\Windows\system32\Ffddka32.exe
1⤵
PID:6344

C:\Windows\SysWOW64\Fcckif32.exe
C:\Windows\system32\Fcckif32.exe
1⤵
PID:5380

C:\Windows\SysWOW64\Ehnglm32.exe
C:\Windows\system32\Ehnglm32.exe
1⤵
PID:5968

C:\Windows\SysWOW64\Edbklofb.exe
C:\Windows\system32\Edbklofb.exe
1⤵
PID:5784

C:\Windows\SysWOW64\Eapedd32.exe
C:\Windows\system32\Eapedd32.exe
1⤵
PID:6016

C:\Windows\SysWOW64\Eoaihhlp.exe
C:\Windows\system32\Eoaihhlp.exe
1⤵
PID:5924

C:\Windows\SysWOW64\Ekemhj32.exe
C:\Windows\system32\Ekemhj32.exe
1⤵
PID:5816

C:\Windows\SysWOW64\Dceohhja.exe
C:\Windows\system32\Dceohhja.exe
1⤵
PID:5580

C:\Windows\SysWOW64\Chpada32.exe
C:\Windows\system32\Chpada32.exe
1⤵
PID:400

C:\Windows\SysWOW64\Ceaehfjj.exe
C:\Windows\system32\Ceaehfjj.exe
1⤵
PID:1300

C:\Windows\SysWOW64\Cliaoq32.exe
C:\Windows\system32\Cliaoq32.exe
1⤵
PID:4920

C:\Windows\SysWOW64\Baaplhef.exe
C:\Windows\system32\Baaplhef.exe
1⤵
PID:816

C:\Windows\SysWOW64\Bbnpqk32.exe
C:\Windows\system32\Bbnpqk32.exe
1⤵
PID:1692

C:\Windows\SysWOW64\Bjghpn32.exe
C:\Windows\system32\Bjghpn32.exe
1⤵
PID:4652

C:\Windows\SysWOW64\Bbifelba.exe
C:\Windows\system32\Bbifelba.exe
1⤵
PID:2444

C:\Windows\SysWOW64\Beeflhdh.exe
C:\Windows\system32\Beeflhdh.exe
1⤵
PID:4212

C:\Windows\SysWOW64\Bajjli32.exe
C:\Windows\system32\Bajjli32.exe
1⤵
PID:708

C:\Windows\SysWOW64\Bnlnon32.exe
C:\Windows\system32\Bnlnon32.exe
1⤵
PID:3776

C:\Windows\SysWOW64\Blmacb32.exe
C:\Windows\system32\Blmacb32.exe
1⤵
PID:4324

C:\Windows\SysWOW64\Bhaebcen.exe
C:\Windows\system32\Bhaebcen.exe
1⤵
PID:3444

C:\Windows\SysWOW64\Bahmfj32.exe
C:\Windows\system32\Bahmfj32.exe
1⤵
PID:728

C:\Windows\SysWOW64\Abemjmgg.exe
C:\Windows\system32\Abemjmgg.exe
1⤵
PID:4036

C:\Windows\SysWOW64\Ajkhdp32.exe
C:\Windows\system32\Ajkhdp32.exe
1⤵
PID:956

C:\Windows\SysWOW64\Aeopki32.exe
C:\Windows\system32\Aeopki32.exe
1⤵
PID:1676

C:\Windows\SysWOW64\Andgoobc.exe
C:\Windows\system32\Andgoobc.exe
1⤵
PID:4284

C:\Windows\SysWOW64\Ahkobekf.exe
C:\Windows\system32\Ahkobekf.exe
1⤵
PID:448

C:\Windows\SysWOW64\Aelcfilb.exe
C:\Windows\system32\Aelcfilb.exe
1⤵
PID:3800

C:\Windows\SysWOW64\Abngjnmo.exe
C:\Windows\system32\Abngjnmo.exe
1⤵
PID:2436

C:\Windows\SysWOW64\Ajfoiqll.exe
C:\Windows\system32\Ajfoiqll.exe
1⤵
PID:2440

C:\Windows\SysWOW64\Ahhblemi.exe
C:\Windows\system32\Ahhblemi.exe
1⤵
PID:3968

C:\Windows\SysWOW64\Aejfpjne.exe
C:\Windows\system32\Aejfpjne.exe
1⤵
PID:4700

C:\Windows\SysWOW64\Aanjpk32.exe
C:\Windows\system32\Aanjpk32.exe
1⤵
PID:2316

C:\Windows\SysWOW64\Anpncp32.exe
C:\Windows\system32\Anpncp32.exe
1⤵
PID:4832

C:\Windows\SysWOW64\Alabgd32.exe
C:\Windows\system32\Alabgd32.exe
1⤵
PID:2804

C:\Windows\SysWOW64\Acjjfggb.exe
C:\Windows\system32\Acjjfggb.exe
1⤵
PID:3208

C:\Windows\SysWOW64\Qalnjkgo.exe
C:\Windows\system32\Qalnjkgo.exe
1⤵
PID:4300

C:\Windows\SysWOW64\Qnnanphk.exe
C:\Windows\system32\Qnnanphk.exe
1⤵
PID:1844

C:\Windows\SysWOW64\Qbgqio32.exe
C:\Windows\system32\Qbgqio32.exe
1⤵
PID:4588

C:\Windows\SysWOW64\Qjpiha32.exe
C:\Windows\system32\Qjpiha32.exe
1⤵
PID:3120

C:\Windows\SysWOW64\Qgallfcq.exe
C:\Windows\system32\Qgallfcq.exe
1⤵
PID:4688

C:\Windows\SysWOW64\Qecppkdm.exe
C:\Windows\system32\Qecppkdm.exe
1⤵
PID:3792

C:\Windows\SysWOW64\Pbddcoei.exe
C:\Windows\system32\Pbddcoei.exe
1⤵
PID:3464

C:\Windows\SysWOW64\Peqcjkfp.exe
C:\Windows\system32\Peqcjkfp.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\SysWOW64\Pbbgnpgl.exe
C:\Windows\system32\Pbbgnpgl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\Pkhoae32.exe
C:\Windows\system32\Pkhoae32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\Pcagphom.exe
C:\Windows\system32\Pcagphom.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\SysWOW64\Pabkdmpi.exe
C:\Windows\system32\Pabkdmpi.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
91KB

MD5
b048301f40375c56979020d74bacd8bf

SHA1
60f91596842bf2f051f45b76ee80c4f5d183c527

SHA256
4291826847e86eeac18539a5402f735e4bf5bba130bb7a25543696b3b8589cf3

SHA512
e23c491fe5f3b4a06a95b22b277aaf0aa02338f694c3d23e8c7d8d82955773122773af23bd87cdb00eb3da517ffe37ca10a055aff339716ba1020ad6b0c11270

Download Submit
C:\Windows\SysWOW64\Abbpem32.exe

Filesize
91KB

MD5
6e9167c72c786df4f2bf4cbf3ec85dbb

SHA1
9a276df36f88d7ba3d2d1e8767d42f7bf8a9fc89

SHA256
d922177fe277708fa2fe34095ad37b875484a2ffe7dc26b3963f5c61360da702

SHA512
e8a45bdf365ed03e7dac237b4b4fbcfee8c7e5231a5e40feb501524033c4d17e1674217f06504c5114992412ae862256548270c07aa5abb95bee5f12c45d6064

Download Submit
C:\Windows\SysWOW64\Abngjnmo.exe

Filesize
91KB

MD5
0a50bc0814bcf456536510554bfe48a2

SHA1
52f19973433e13339ee1a034e71f94528cf94ae9

SHA256
2e10f67aca3546fe24f61532cdb09abb0010156c7edbc278aa9a8072a933b295

SHA512
93fcd2f025028b8cc5e50182d33bf568b93fb650e67d72df023bf0077aaaf30c12fd1f9eafb134feb5b59154be976b317ba3af08ba2f1bd15f0db2618266046c

Download Submit
C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
91KB

MD5
cbd00e69f1038d59374872f9431f9326

SHA1
3c07d2caf46f4cf26bfbda97bfc7c4f7c4dc630a

SHA256
abae56be4cbf235c6f3397f415b3c41cffef466a4ce639b6a724d6750d215589

SHA512
13d7ebd5bd2101afe74c0309039f7cb5d7a06103cee4a47638d2979de4752bc546c34b11096fd82e52faed4a48c8ce4f966401ff9498136c42f4ce148aa500fc

Download Submit
C:\Windows\SysWOW64\Aejfpjne.exe

Filesize
91KB

MD5
92e57bb2059b7e8eff93311c1538e8d5

SHA1
a9df5edca05cbfb6b79407af67e2e50a28f45e63

SHA256
11c4f15c25c7ac82f6ef6085807c8e6dc914c6cb61a28841ac928288798c2201

SHA512
77905f1710308053ed519e1cf0896bd5ea36a26a65a24d795aa863eea27d98c920c1e9f2c28854ea2a57f51042af81dc283c743391f2e70534ed47a57b3e7641

Download Submit
C:\Windows\SysWOW64\Aelcfilb.exe

Filesize
91KB

MD5
f19815f18d7a9c7a4f268d1e1c076d51

SHA1
ad275ab08eff24774b3df8f52f39e0de7584b25d

SHA256
52f1843d0689c0f3513ee5c499f8069ff342f808658726938980aafa6bf0e967

SHA512
eda166d95a214aaea84973195e9b010afac8200efd3b5ef4dd7c764076eeb7ab165266945fb4c86a107c73b3851e8e82460a806e079dc8d6ddc389ab98b20b88

Download Submit
C:\Windows\SysWOW64\Aeopki32.exe

Filesize
91KB

MD5
1097a730afa62f9fd8d781dffc7aabbc

SHA1
b273a0851730ebd017e0b2ee9078ec8fbef934cc

SHA256
c77f2212cdbf747e8a406c58bff8e040858581a8d383544c5f7529c7959e6d5b

SHA512
dead5c46b77f85e6daf664d6ba4868d72a43284c93702b1281440ecc6808005a72beb989864544ea1cb6f7f4b3313b65f303ff4c2fbfb6178e942897df1e0d70

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
91KB

MD5
24892dfe3a6cfec0a715f28144f75ffb

SHA1
7aaba1262ad7e55c67d97d1301a59b3d3357cea8

SHA256
9b280a79b56f4e2d953ea0cbefd2fa4f7ba6a6e1b57efec509855ced1378cc7a

SHA512
e4ecc5cdefcdef11a6211b868a1db60391699d422898a35b5e5ed17bcbe4088b42f3f59d5cf6ad1ea6138caab5bb40eb5bc6198d0c6b7d7756bfa690f30d64ce

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
91KB

MD5
0eb6d9f53bd25fdc1e06a14bbf2cf016

SHA1
352cecb299cd413273d1b9579fb8f7b1d086e369

SHA256
9c3a53c34bead1acb04027f0238a875bcfba7e646d1761a696b77d07358ca0c0

SHA512
f7a02d2eec3da0796c50fc9df40365ccfe10571e6232f7ad306b1f8187dae1b968a18cb65d4379dd857a4fe6ac3ad9879a180929aab27a2af71248c284aa45f3

Download Submit
C:\Windows\SysWOW64\Ahkobekf.exe

Filesize
91KB

MD5
5bc050c282a4ecf508ccf44e90f39b57

SHA1
2937cb3f3569bb253a993c433a5a72a679ff3586

SHA256
1f4953e0208bf7f196c20e825a2645cc5e719a4a0732f03620e6d7fe0be979e9

SHA512
f25c02b5ae6208683a93a9791fbf85ed986daf67bb4be6f8ad4ab5a0b3b7c0b5377b10a4fad4477d2a042d2974f11aaa4f371fa16b823e91a1e837a53db07536

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
91KB

MD5
afe0bb99f0230a851ad3a607c374b6a1

SHA1
c4a2ad9408d7aa47b34a6bd34209a2a50676dd6f

SHA256
8b380ff124108c18d9be2ac3083212425d204bfa64a601d4fae2dfa0a024d54d

SHA512
917d531915c73973c47fdfb8197b805a1859f85bcc99ca3153ba66d3aeabeb78261c2bc4b2fa72b99688a4c9050c3211242e2141cb5a1a86b8b2732e93ae2fe1

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
91KB

MD5
2c79e6fc11297e0dfa2da185fdc67b83

SHA1
46f500c6e38dc55d68c82fbe85e6709cd244d3a4

SHA256
0c4224250113877635e1ec46f3b9dde2aa3dfc70d2a9c3d617baa9b865675614

SHA512
8b17ee460ed7dd5c06c58dd939e6f5347fd693b2199be55ad0971d538e651d6b2b03c6d7ac03e7fc338f8c36178724f07f88b6e4eb5a0a1d31b0fa2a7e28ad55

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
91KB

MD5
cce74228bcbf5dfb2e4f6c2c5f22a453

SHA1
50b33d80571e9a6dade5ab38c8a99cab64605989

SHA256
62c9cfef1dab839a467d7076f3b8cd695bd8877168627c7ef2ae626c1e874309

SHA512
6ae484a5870093ea9218d77f9cd3a6f54ff7445159f786f50871c3c0e101b23be847ab6940168b0537a4bc16a81d28ebdd8cdbd2ed4277761fd17feca564f622

Download Submit
C:\Windows\SysWOW64\Alabgd32.exe

Filesize
91KB

MD5
55d01c7e6a32086e53c8ace24254b36e

SHA1
c1d34606b38288812173c3c7dda8d6212a92367f

SHA256
503af30b230a79243d1b12e9930bbf8f46b01b01c33775a6df92a510bba798cc

SHA512
d1a8f698359070d8c8feec7ee7db486db60558363e4b4811f29fb04059b1dc38df74d7318560548e83382e962da83595c47f7eb03ccd14dbcdc25d198f255fa2

Download Submit
C:\Windows\SysWOW64\Andgoobc.exe

Filesize
91KB

MD5
c4c947ade8bee0711f1f76ce1329bb9d

SHA1
c07a9252292f333f532a8cda1130b03a518b883f

SHA256
1cc8fd850e1e91989b21397f59a7f1af96fedd4e8fbc4c79f6674a36aabda731

SHA512
1e86eedd1ff5299c4b2d7eb656cec1db7e717207dee2f0c7ecf342d9ffb367ffae4ce08779816b7477b0b9535666064eb8a7e512f73bbd737dfa4ae473003213

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
91KB

MD5
75b93281eae5c268219393bf4ad2f614

SHA1
1cde0f1c1fe0c129945a9b05b22163c13d86efa6

SHA256
64e3770fefa93c6b01074feead8f2d38170baea576ca2176398ee575250c93ad

SHA512
ffc690f5ad5851d6c8fbb4774825cebaa532a78f462fd45cc2f3d666e6fa8c1b0b39d6af0d5661838e2ee39275ba20a6871dabb0787002a914874a756ebc91bc

Download Submit
C:\Windows\SysWOW64\Beeflhdh.exe

Filesize
91KB

MD5
89d3b676ec6cbd4b823cd6e7ace7d4d1

SHA1
7e1574459220ef327c07be3c0b661de60f3ec9b3

SHA256
888a85fabe586232422d7e8485daf54ff87126080e894f2b93aa35d53a20eafe

SHA512
22ddfef8f8b7c976e098f42b89d269a33e99fc6e4f9c83b7cf71558c25d821628d8e7fe0eb85e521d806f36a02f9e1aa00567a471032e4d891fcbdee6bf8e1a0

Download Submit
C:\Windows\SysWOW64\Bejogg32.exe

Filesize
91KB

MD5
ccc49b91e95450bb13814a5b7900dee8

SHA1
d77c28497aa5043b7c957f54eb257519e99e1bc7

SHA256
0a51902f921b4020f14b1d2d463290c74130d5ec59d49b7e01e10db0deda1cfc

SHA512
4a993b712bb03d1598a2755b13d5b0014d80247972f97a662dd3458013a63383baa8a402fd1bdb96222b675cf1ac9e99699fb70cfaab17e9881ab7c46042cee1

Download Submit
C:\Windows\SysWOW64\Bkidenlg.exe

Filesize
91KB

MD5
d822d6456af9454ea08bc28a8be7ef20

SHA1
c6dc71aecb6080f513748686e9087f9d5fe4f02e

SHA256
681ebdfaa974bf3af40f23abce55f5d7b27890f2a1ec91d00c28d692277aeb0b

SHA512
1aa7fab34b925c268550a84c43cbe6099e9e1b4cb1afc325d1024bc0d0e58ef8d92b4b25543cb2b07ec5935b1c757343fe3491f5cf698702905d4b03dc2487e0

Download Submit
C:\Windows\SysWOW64\Blmacb32.exe

Filesize
91KB

MD5
67c646607d1aaaff2b049e2e517ff953

SHA1
47dd14055772dc7bcd3902ab568e76eeb3b43443

SHA256
f84d187addfc79ea87cbd4815a18d9e744d583172f1d86d4879d642f0bce91e5

SHA512
ec09adb2d2ef12891485c507e51ead34172430adedc15fe6845d08f75d3a198816469b1cc72f6f6cf87b50bc955d64c211763f3cfdb66392a624cd6d18f23141

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
91KB

MD5
546591b84cbfb00dae6726a2dc0a6701

SHA1
fac2a61ce6dd3a6c613f9fe479189ca53576d05d

SHA256
3d9f4479a0137a7e8d62645d05c945f83d7af3db53e97acf1fcaf65a0cb0daf0

SHA512
b6fba369c695342f2a0f9b6bc88d5bc987e3f99488b8c97fa2623aa9bf404cd6c24d5b0985d445ef34bd703b70e186805ae8313ac9cceb82c2e01bbc094d59ee

Download Submit
C:\Windows\SysWOW64\Conclk32.exe

Filesize
91KB

MD5
ae3a2fe0c69ebedfba761b9c663f73be

SHA1
5035e39a532fbd60c0340b8484a147d6c8ae1f56

SHA256
a004c538f56a17fd517aeb66ea5773e60498570294e7d352e3700ebaa2c15a44

SHA512
b2bfe6e27bd35382e3ce6d357c724497f94c8f1f93940529ccd5d0e28f4189abf046c83de16f60cbb5c633fecd2c56749c76dc65e90d0570ad8130c36fc9bc66

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
91KB

MD5
f93f0427e3506d79e1c4ab6bae87b18b

SHA1
b8f4048ce9c347edb05d5c98ee2c6faac408c059

SHA256
3cc33f9663e592fb7cb3b527afc55a660c32e09e713e6f115413d6ceb1e52f34

SHA512
bc868d9598d5445e4635feef4e742ee99e56887dbd458c43463d2b4989dcf638957c2c61b1464ce09cc9f00e5fc7e41ae085edec30e172c74b0a5945cb4b346b

Download Submit
C:\Windows\SysWOW64\Dhbgqohi.exe

Filesize
91KB

MD5
a888fd85d077caddb1867ba4239b4219

SHA1
0ef710455c5ada119620c7c743bb023310d1b810

SHA256
2d5baf0c6b5343cbb513fcc9221a09ee78cd0b528264823e4c24a84d7229f69d

SHA512
74de2200157129b11be18e10ee7b8292ff942b563f8a1ec4435c9d315be8ce02f5c032f6716cb7b7035d3ca4d87ad54e00f3b636b98bc6c8f708295f2a9ae733

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
91KB

MD5
a89ae1d87c224a8c08d41df28f074f4a

SHA1
f2aa2cbd75b679b5fc3ef3c830332028104233b1

SHA256
45859c54087ea7e4154baeaa6463164923f560433e730ce4429f82ad4be15676

SHA512
148127031372f754cea702eabfff197392f4629bb37ada104a2469d2392cd42d885231e01c43a5b967cca0201252453caed9ea4cedc8a00c5083da2ff72bf6ab

Download Submit
C:\Windows\SysWOW64\Ednaqo32.exe

Filesize
91KB

MD5
dad2b34ce14662363267bd016bf5ded1

SHA1
fd1e47e9f737b78ebf93ed9c96dd072395c6108b

SHA256
b9b22d3e12e18dcc4d471a432986bb9f03404b72cca3f53b294e3a24b825f947

SHA512
325bb765b839e7178e43b2c5353bc61debf2ba01989c6599dd24d8de80d9640d79231184c6db181002b4e2f6ded55997b5819bc43f3be0ca10df34b17eed4888

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
91KB

MD5
b0a57a16333e76ef1b44a86716c1f436

SHA1
270c933397aebd2ffadf28d1b368d9e28b903a94

SHA256
9a008fddad95edf1a62a6ae2e7ef2d573a6f7420f7f9959a03deae1731382caa

SHA512
e6aa85c0e5bbaa0df71b5470bc4a13dced617f4c3ed230218be11aa5a7883d58bd4988195bde0c4f57dc97cc4e4e67059ba2d90ab7ffd5c73026b93c6fd0354d

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
91KB

MD5
f13d0f66780baaaf7c8a97cabc4e28f7

SHA1
c19e4c9fda98e75dbdb079396bcf845bcad2fb16

SHA256
ac874a298bb5e8583e56e683470eeb5afdeb7b70c77cc0aea82c17969acc169e

SHA512
4107eec4becead395ecf931f4b0d3f8298871cbd55aad5dfbd6a56399ef7269aed207d9f28e546aa0c20523ccc75581e5cc597a65c9987d314a9b25695535742

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
91KB

MD5
e270568ed79a4ae2ded00928ad3568e2

SHA1
2b57f1b1c0235d936e515d643540fa5a0ea99208

SHA256
8a8aab89a57cf5ee01a699c0f8fcb62257440285a1821d15e3515a3df149b867

SHA512
6862ae195d9b403ab191e3d36dd4f0285dee551d0daf8c50bffb88d0f41b94c1d526b25c63f79343e3f7ddf280bc8328dfff5cfbaf6eb7f9ccc5ceb8d1055b0a

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
91KB

MD5
43765211578693801c9fac92cfe66896

SHA1
4e3f092776af7b191f1a08e327e958fea53c41c9

SHA256
2c45538ce9e700f6790ccac88c47cdd7811d1a3b4e8eebeeeb0d2dbc7bfdf557

SHA512
03f880647ca5341bb0df868494a7822f1f87ea741e732c6ce2ab7d4c8674820d3878022fd95bb6226bdbb3c1b03ceb2ab7c80d2917c1cf5a57768cdd95f3c125

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
91KB

MD5
51b379277f3cadbbb7b60d97f2092ca8

SHA1
f0f5fe4f659314eb0b7dc6554844c8b45cfa6106

SHA256
d4f547ed7eb0f307877cbd666ab84f6358fc82703eafefbec6e4302b7154fb36

SHA512
272b7ed480f7fcd6fd3bbbc27c426dff1b132f02c738bef56d0edaefb2b1ae0d895ed05b123e0d390f80f6de38b48981ceb54b6b5497b2e981715025ff474e3d

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
91KB

MD5
f804e3ce036391c908ce8b330b0629da

SHA1
f67018be271dc8a494c6a7e0efb1b9d05eaab738

SHA256
f0635f0ce7320c09836778350f27cde94e46919a00f1edee0d9c457973022b20

SHA512
ef2af16985ca83eae917703ffbc5c78ba654c4af82d19b0b5f9d53686b10ef97247bd3010b6a0ef57eae900784164de8c3bc287408e309e5dc21695a8f75972e

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
91KB

MD5
42dc2bba0de53887b396d608356dd2ff

SHA1
042cfaa2cdbe3f11ed13798a63f892d2c275ddb5

SHA256
95e25c5005940737bec2fa726a4ab3288964a027ef142821c7af59e2df69da0e

SHA512
812e0e7e599c0e40e72d964cccf1dbd1b68499771ba42350df6c89eea593908cd3d60e5829cab9916e9db4ff8c65a4ffa3baa4ec350b864d836d78725d73954e

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
91KB

MD5
b90f7b1bc7ef0742195094652a80c2b0

SHA1
5ca9b18256659f6e753bcb4a0d730e199d336eb8

SHA256
bbddd915b9cda229a56296b97ae57323945e863317990cd2d2409757651e6b40

SHA512
7e6a2bc3b65f62b765bb2ab95e8dbc6c486b1a2b438fd298c507a6e7f94d6cdc8983d1fdde028c5f5ce73122d7366c97661615076d64d044c2d79a4ef9ecf71e

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
91KB

MD5
f914942f31ef76c0e0623215308370fe

SHA1
b6df091911863ce6db7148e1fe32d6cb7e912518

SHA256
2cdf7287ce212d2c9696333552acd183fdb1b4b42ad81c4e56b37eb35f612b5d

SHA512
64c5572a4964cd5274e3cfdefce0c608ae68a62800b4e20a0d8e2bb84c99eccc3b6e2b639e5d98339babfb95029a1f2c7cea4853b24dc4090a097e05004aff74

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
91KB

MD5
863d084aede37f209b18e26e72191c39

SHA1
2e4d8a74afef800768d763d6bcad4ac515b451d0

SHA256
c63e7d9842176a3fe942bdb687d8c8071f3f9c40bd7f3de5aeb3c634520ed7a7

SHA512
8a63175169bba15db202acf79c53a9200c7714a475c6c6687b009803219f1a9f20035a09d9d99cc8d048cd07af0e326569f99c303c3f049822ca441a3c24c63b

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
91KB

MD5
4fbd6614264bbc5fc3b81c647e286093

SHA1
f04a7098e4e0e2b59c14fcb6acc76471c7f42b11

SHA256
c6ba2ab66eb7696aeb86dd5d71a04a834e419ce43f6b3d97d4001bba5fd03847

SHA512
9047be3d1f7797e9ed203555e036503e7c01d3a7bb7c481af384bbdfcbc5f9563b5b55eb80c3851660d0c386da767ca51f87041f7f56936bde14ae6fbbb080f5

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
91KB

MD5
9a9a985d18752dfd8ef67a6cbe8b389a

SHA1
32f304030d66bfaa4973a3c66724ff937f7dff43

SHA256
b6a7d520bb34c2f18cd6e1abdd404837684702d1af72fe4c4bd7273c6dcdcfec

SHA512
0a1fbd35bc5bc079ad14e8599ba03458de6f7c6d190b285a5553bdb33022887a3f518b226ca21f67fd1469e984e246f7aed008197647011391c232675a420b01

Download Submit
C:\Windows\SysWOW64\Icgjmapi.exe

Filesize
91KB

MD5
af9308f146576e07f857d0c84c6b8ecd

SHA1
5d5395e83fc89fe724c0a315c1ec05a390e39ad7

SHA256
00ff370859145e450913db1d6d5a0a3f87e4068b06e73e17e9996ac57b753bf2

SHA512
73c9ad5af935422793592092de0ce5fb10d2c8fc86c2f27dcd608edaa8d391e95f1756f0b31b9887093bd116975291953bf126b91be3d5a9afd556620d443cec

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
91KB

MD5
117731798f5661ee5b50d1ef0ba790a5

SHA1
8a2509220806cefb90fc94820f953c0de8be7b40

SHA256
111b3edbaa45b47a7fec34e6e7c57022fcc62c8e4c31f969768f37ebe1620429

SHA512
850929ba5321fc56c954c57314784bd8221ea32d0434479caa1967d037676d00c7ed13c0434b36e2b48d8469ffbe3ecc674dd4d1d08e35b332242aeab9e4ea1a

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
91KB

MD5
0d798c1b490500e01e4a3b6133db521b

SHA1
b351ff6cace93f01e1912dd82f24112ff579a8da

SHA256
fa2a1e43e1bc07583965d50291dea9cb0e39f1264c45de14c286ff8233f07451

SHA512
0d87bed2c45f7ec824279c797791a555422001331607d7808e25248bfce36635f2689f0b35ab50405092bd15942f48d3196f111b280ebc936ee700a8e3a14058

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
91KB

MD5
47dab54482f219ef9c4d9c47135fc25f

SHA1
d743fe75fa1e5442ad4f7c90bf1dde0e1ffc396e

SHA256
6d231bc00d2deba77befae1fc89d9a0984a230fe7088fb6994f4922db94c992a

SHA512
2fee796ca4b3593fd7c38437b52a15c569c4ccb7fd9688ce877fcbd9b23dee66ae1531149a0803497394d078f6563c516c152d94d5232992039365f0d55aad6f

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
91KB

MD5
0dffbca48e4b74077fa8378ec438a724

SHA1
ca20f05c2a4f9c23fb0b7a35ac94a9ee56ad005e

SHA256
bcf4ff9c02be7ae2692389da9d801cda9fe64a5b713099ee982294f094439a0e

SHA512
a8acb55bf1eb8ebefcf3fe8f2f950fd9c45906e0cf8c8bf2b4dd96a9c7d73c050afedf4dd4d2a7d9505eaa99f3c0b0c56ed3729bfb6437fc41af89ff613034a5

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
91KB

MD5
3de5a2d2a93850a08b99e306597bb1d9

SHA1
5b44c82bcbc3e98705ac80221c2437b9fd5d30e3

SHA256
71c97378d6b0f3327f2591723f34e8f2ea02b8fc3d387fb7041e83a44eff01f1

SHA512
0a3792d19a444a5e13e865d3aad4c1e7fffd194a7f68bd04611a9fff72ad1c829950eb32ee4d209594bca5b1099414314d78e5322ec8769f0e637cdb3d70a9a6

Download Submit
C:\Windows\SysWOW64\Pcagphom.exe

Filesize
91KB

MD5
c4c6dd94eb24c306536a1c74f0ce8c66

SHA1
f334ca8d7177f8f8c5bb6733d6005d946af436e5

SHA256
c377b0ee2a2ed9519c73988d90ef14fbdc96ff9dc8bd0f006e4b5124527c43cc

SHA512
91c6bfcf8ceee32a8dc89ab81785327cadc48a5faf07e65e9a27aa2e30b2de1e24547d334da01b5b7c14e7cf48d1e7725fc3a6be098799e10dbf5a9d6d8fb73c

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
91KB

MD5
84f1896b096ce1b57d329300d065a4d5

SHA1
49b1a829216d5893d4289eff0eb15c41a6649acb

SHA256
f8ecd8812294ea22de3a262974bbf43ed3f3e7f394420f775f1f48f70dc43338

SHA512
1b155fdd9fb9e70706a3c1f96bdc47c363839042128da0aa644fa0d7cfa6350a6a1acc3c840b247c4e09930a53caad8a7417df10cae098dcb07587f6d8b66e87

Download Submit
C:\Windows\SysWOW64\Pkhoae32.exe

Filesize
91KB

MD5
c3d29a275ffe1716e5358e56a263e13d

SHA1
402544f451fefd8c0953c0854940cdc01c220330

SHA256
8e6dd72696709365efd47821b37b6287fdeab93543a6ab4fbf752cafbfa9faed

SHA512
79533bc368ab9d30b72d61581db799eeec6f830fb5d76cf00573800479e245079afe22ee04d19920875eadc17fad66e1095eb2f7ee85295eef16a41764f7dfff

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
91KB

MD5
b8b690a118eabba6b1ec2251c77eed66

SHA1
9fb45a8740fb94adc6cca46225fe87707b5e3583

SHA256
9b2f4b08ad55bb3ba2a4c37bd6c91a6a7534db54d1c76523902b72c6c7b267a2

SHA512
54d95bf9029b542054b77b4f35a94d9ef7e87268ae4b30b04311fc9ec60e90e51c802aa2b325fbff5d00f7b0289557d66069df4324ffddffa009af3206dd9360

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
91KB

MD5
69654fb144fa3e2d253e5099bfd34609

SHA1
d2fd5dd763da7dd6fd03b70a34ed5e09b2d07115

SHA256
3aff81ed85005c4f2feb38b89bc83f9de7b4b6064481e894b5c2fbd129b175c1

SHA512
426e0806305b4b2b40b0746a8624fbf5b874d5bdc13d6d977d0936c79b4e82ed881c6fc90d4b0b34c6a7633eeb56cff0ca1bb1c972d2e9459769a15441176966

Download Submit
C:\Windows\SysWOW64\Qecppkdm.exe

Filesize
91KB

MD5
c3d5dc371874c6960a79f1eae2f7b73f

SHA1
3303d5e66b849e3faf8d5daf7d61291156921780

SHA256
27fc5d3d136a9858486af4c412d692a2bc89d0b4e247123604360a7a2defde62

SHA512
8143eda6bbd8a5340ccf57f137df8ca38103f09e99df3b7b26ad90c0aac179da4baf19b4238758a24f618e58c4c4c78a198482ff6e3b73854bdd00cccce9fc16

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
91KB

MD5
1dd355f61cbf96ab7355df4712a9f2b7

SHA1
fc3a08069b63832b78b859a0b61e11a5cb1c0dfd

SHA256
be09709ffac88d8e83d867e7fb42ee9a5379e1a19fcd371fd73e9ae248a957b8

SHA512
dd9608dd68195c64ef3b8bcf0a33a32e0f44eb5855a3952f1c5c978a9b5648964271e2234dd4f77fcaf7d4f32bedc5fb2afdb82d726fec57ddfe79bed6f875c9

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
91KB

MD5
420d93f0a8c5e96a427a999c5b8eb880

SHA1
3e45e00b13983882d6d5c3cf1e82c88bdf15eefe

SHA256
6ac0bff2b577af0b7e809b58698302d045c586e83bb12a1ab278d983e7b1fa8a

SHA512
1e673c874ae0dfc44c166887a857091bbbccbfcd1d12ba05935585d3cfe07b5ccd56b7f8d8267a22420cf56782a1583b96e79ea1231432f0651ccc8530ce84eb

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
91KB

MD5
803dd5c7e8a70002127b5808f62e46a3

SHA1
4ae9b354c93102a9f6d608224d70810ac24366e7

SHA256
a7cd592248f539eaf0333f05e05f5fc54784629897ca352a44ee7ae89f04186d

SHA512
1fc95c44aea72211c04e190bd3eeea6c41c41b73dff82789c7fdef67fb40c9e145403f3317c1df0d9f8371929c74aa99ddd3ae9ea89980a0630fe97ecae1ac78

Download Submit
memory/400-446-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/448-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/592-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/708-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/728-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/816-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/856-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/864-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/956-245-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1008-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1148-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1300-440-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1448-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1516-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1588-19-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1612-3026-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1676-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1692-375-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1844-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2252-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2316-172-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-383-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2408-3041-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2436-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2440-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2444-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2680-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2804-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2952-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3120-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3164-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3208-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3300-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3444-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3464-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3512-332-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3592-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3608-363-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3776-289-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3792-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3800-213-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3836-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3852-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3968-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4036-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4184-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4212-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4284-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4300-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4324-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4360-52-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4508-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4560-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4588-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4652-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4688-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4700-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4712-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4768-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4828-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4832-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4852-429-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4908-326-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4920-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4964-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9228-3027-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10424-3037-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10484-3024-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10544-3036-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10688-3044-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10908-3034-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11000-3040-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11092-3032-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11224-3038-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11284-3021-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11328-3020-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11408-3018-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11456-3017-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/11500-3016-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads