d5b1146004b3904301cdc38553e13af5f54565e9e0330d158d584aa388a25f27

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

701f957eaf4c1be43f51d788b80f33ac.exe
Size

333KB
MD5

701f957eaf4c1be43f51d788b80f33ac
SHA1

8a59e8dfe23701eb1fef6090d9956bd4f4848028
SHA256

d5b1146004b3904301cdc38553e13af5f54565e9e0330d158d584aa388a25f27
SHA512

70151cc85d3f6a2c6240a88e3aaa6cc95ee66f47555ba43a0659758373430540c8c8630394124de8a0cffcb011acd21d511e593337126d97c1632c46afd91222
SSDEEP

6144:++QTGMVs9sd1UQXMbQRjkod6U912429sd1UQXMbQRjkod6U:ObQQkA1GQk

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbldphde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfjka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oogpjbbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijlof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iickkbje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Felbnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bobabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhnaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pemomqcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eleepoob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neccpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paelfmaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbepme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilfennic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kggcnoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jngjch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lokdnjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cceddf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlglidlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhkdof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpqodfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfmlghd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmkgkapm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joffnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofegni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjmfjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olicnfco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocacl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpgeee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noehba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Impliekg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehndnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhicpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgaokl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioambknl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnhnaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjngh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eidlnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmeakf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfmojenc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cimcan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjdqmng.exe

Executes dropped EXE 64 IoCs

pid	Process
4080	Lfkaag32.exe
1000	Lmdina32.exe
3300	Ldoaklml.exe
1264	Lepncd32.exe
2392	Lljfpnjg.exe
4284	Lgokmgjm.exe
4956	Lmiciaaj.exe
3368	Mdckfk32.exe
3728	Mlopkm32.exe
1708	Mmpijp32.exe
3256	Mpoefk32.exe
8	Melnob32.exe
2252	Mpablkhc.exe
1924	Miifeq32.exe
4420	Nilcjp32.exe
3756	Npfkgjdn.exe
2496	Nebdoa32.exe
2008	Nphhmj32.exe
2376	Ngbpidjh.exe
4344	Nnlhfn32.exe
3156	Ngdmod32.exe
3412	Nnneknob.exe
632	Ndhmhh32.exe
3520	Oponmilc.exe
960	Ofnckp32.exe
4640	Ocbddc32.exe
3784	Onhhamgg.exe
704	Odapnf32.exe
216	Ofcmfodb.exe
1832	Olmeci32.exe
4912	Ojaelm32.exe
1284	Pjeoglgc.exe
4364	Pflplnlg.exe
1456	Pmfhig32.exe
4688	Pnfdcjkg.exe
804	Pdpmpdbd.exe
1956	Pfaigm32.exe
4508	Qdbiedpa.exe
724	Qfcfml32.exe
1996	Qmmnjfnl.exe
3904	Qgcbgo32.exe
3232	Aqkgpedc.exe
4352	Acjclpcf.exe
2540	Ajckij32.exe
3532	Aqncedbp.exe
1500	Ajfhnjhq.exe
3840	Amddjegd.exe
4480	Acnlgp32.exe
792	Andqdh32.exe
1716	Acqimo32.exe
1904	Bnkgeg32.exe
3908	Baicac32.exe
4040	Bgcknmop.exe
4492	Bjagjhnc.exe
4280	Balpgb32.exe
2364	Beihma32.exe
3208	Bhhdil32.exe
4528	Bnbmefbg.exe
3952	Bapiabak.exe
4500	Chjaol32.exe
4752	Cndikf32.exe
2216	Chmndlge.exe
4560	Cnffqf32.exe
4620	Cdcoim32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Caageq32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Jqcdkk32.dll	Kbbokdlk.exe
File opened for modification	C:\Windows\SysWOW64\Lncjlq32.exe	Lgibpf32.exe
File created	C:\Windows\SysWOW64\Begfqa32.dll	Ekajec32.exe
File created	C:\Windows\SysWOW64\Bdlgcp32.dll	Opeiadfg.exe
File created	C:\Windows\SysWOW64\Mbgjbkfg.exe	Mlmbfqoj.exe
File created	C:\Windows\SysWOW64\Lhjlnlii.dll	Pcepkfld.exe
File opened for modification	C:\Windows\SysWOW64\Efjimhnh.exe	Eleepoob.exe
File created	C:\Windows\SysWOW64\Nagpeo32.exe	Nnicid32.exe
File created	C:\Windows\SysWOW64\Najmjokc.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Fpimlfke.exe	Fealin32.exe
File created	C:\Windows\SysWOW64\Fbpcnkaj.dll	Gldglf32.exe
File created	C:\Windows\SysWOW64\Echegpbb.dll	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Dpphjp32.exe	Dfgcakon.exe
File created	C:\Windows\SysWOW64\Blciboie.dll	Phigif32.exe
File created	C:\Windows\SysWOW64\Dhikci32.exe	Ddnobj32.exe
File opened for modification	C:\Windows\SysWOW64\Lepncd32.exe	Ldoaklml.exe
File opened for modification	C:\Windows\SysWOW64\Eopbnbhd.exe	Ehfjah32.exe
File created	C:\Windows\SysWOW64\Ehhpla32.exe	Efhcbodf.exe
File created	C:\Windows\SysWOW64\Hilpobpd.dll	Mcifkf32.exe
File opened for modification	C:\Windows\SysWOW64\Jhgiim32.exe	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Gdkkfn32.dll	Lgokmgjm.exe
File opened for modification	C:\Windows\SysWOW64\Ngomin32.exe	Neppokal.exe
File opened for modification	C:\Windows\SysWOW64\Pgflqkdd.exe	Ppmcdq32.exe
File created	C:\Windows\SysWOW64\Kggcnoic.exe	Kdigadjo.exe
File created	C:\Windows\SysWOW64\Cocacl32.exe	Cleegp32.exe
File created	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Jlikkkhn.exe	Jlgoek32.exe
File created	C:\Windows\SysWOW64\Mfpell32.exe	Mofmobmo.exe
File opened for modification	C:\Windows\SysWOW64\Npfkgjdn.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Ioambknl.exe	Igjeanmj.exe
File created	C:\Windows\SysWOW64\Ddhnoefl.dll	Ohpkmn32.exe
File created	C:\Windows\SysWOW64\Hlfkfcja.dll	Phbhcmjl.exe
File created	C:\Windows\SysWOW64\Hlegnjbm.exe	Hpjmnjqn.exe
File created	C:\Windows\SysWOW64\Oeoblb32.exe	Obafpg32.exe
File created	C:\Windows\SysWOW64\Qcjdoc32.dll	Kdbjhbbd.exe
File created	C:\Windows\SysWOW64\Jklliiom.dll	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Nmfmde32.exe	Nfldgk32.exe
File opened for modification	C:\Windows\SysWOW64\Opcqnb32.exe	Ohlimd32.exe
File opened for modification	C:\Windows\SysWOW64\Injcmc32.exe	Hacbhb32.exe
File opened for modification	C:\Windows\SysWOW64\Dihlbf32.exe	Dpphjp32.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Bljlpjaf.dll	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Mofmobmo.exe	Mhldbh32.exe
File opened for modification	C:\Windows\SysWOW64\Aiplmq32.exe	Acqgojmb.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Jajoep32.dll	Ajcdnd32.exe
File opened for modification	C:\Windows\SysWOW64\Ginnfgop.exe	Ggpbjkpl.exe
File opened for modification	C:\Windows\SysWOW64\Qofcff32.exe	Pemomqcn.exe
File opened for modification	C:\Windows\SysWOW64\Nnkpnclp.exe	Nagpeo32.exe
File created	C:\Windows\SysWOW64\Ogclbn32.dll	Dahhio32.exe
File created	C:\Windows\SysWOW64\Ohepjfbb.dll	Gojnko32.exe
File opened for modification	C:\Windows\SysWOW64\Jngjch32.exe	Igmagnkg.exe
File created	C:\Windows\SysWOW64\Pkpmdbfd.exe	Phodcg32.exe
File created	C:\Windows\SysWOW64\Caqpkjcl.exe	Ckggnp32.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Mamjbp32.dll	Njinmf32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Clbidkde.dll	Cpfmlghd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9792	8852	WerFault.exe	920

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbggjh32.dll"	Ekpmbddq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbjelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdpmoppk.dll"	Plpjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njjdho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gekcaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djfkblnn.dll"	Hhbkinel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaiann32.dll"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djaiilmd.dll"	Legjmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdedak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnoigi32.dll"	Pedlgbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpbponhh.dll"	Likcilhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbgalmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eopbnbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kijjbofj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoclopne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oogpjbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aahbbkaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aadafn32.dll"	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhepna32.dll"	Hnfamjqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lihfcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnblgj32.dll"	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipligd32.dll"	Hdbfodfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cglgjeci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmbhgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbpkkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnpcnol.dll"	Kmieae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fojedapj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikndgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pocpfphe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijlof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmlkhofd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lncjlq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpmomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkehj32.dll"	Affikdfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfidbo32.dll"	Ilnbicff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmbhgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccppmc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4080	2432	701f957eaf4c1be43f51d788b80f33ac.exe	184
PID 2432 wrote to memory of 4080	2432	701f957eaf4c1be43f51d788b80f33ac.exe	184
PID 2432 wrote to memory of 4080	2432	701f957eaf4c1be43f51d788b80f33ac.exe	184
PID 4080 wrote to memory of 1000	4080	Lfkaag32.exe	183
PID 4080 wrote to memory of 1000	4080	Lfkaag32.exe	183
PID 4080 wrote to memory of 1000	4080	Lfkaag32.exe	183
PID 1000 wrote to memory of 3300	1000	Lmdina32.exe	182
PID 1000 wrote to memory of 3300	1000	Lmdina32.exe	182
PID 1000 wrote to memory of 3300	1000	Lmdina32.exe	182
PID 3300 wrote to memory of 1264	3300	Ldoaklml.exe	181
PID 3300 wrote to memory of 1264	3300	Ldoaklml.exe	181
PID 3300 wrote to memory of 1264	3300	Ldoaklml.exe	181
PID 1264 wrote to memory of 2392	1264	Lepncd32.exe	180
PID 1264 wrote to memory of 2392	1264	Lepncd32.exe	180
PID 1264 wrote to memory of 2392	1264	Lepncd32.exe	180
PID 2392 wrote to memory of 4284	2392	Lljfpnjg.exe	179
PID 2392 wrote to memory of 4284	2392	Lljfpnjg.exe	179
PID 2392 wrote to memory of 4284	2392	Lljfpnjg.exe	179
PID 4284 wrote to memory of 4956	4284	Lgokmgjm.exe	178
PID 4284 wrote to memory of 4956	4284	Lgokmgjm.exe	178
PID 4284 wrote to memory of 4956	4284	Lgokmgjm.exe	178
PID 4956 wrote to memory of 3368	4956	Lmiciaaj.exe	18
PID 4956 wrote to memory of 3368	4956	Lmiciaaj.exe	18
PID 4956 wrote to memory of 3368	4956	Lmiciaaj.exe	18
PID 3368 wrote to memory of 3728	3368	Mdckfk32.exe	176
PID 3368 wrote to memory of 3728	3368	Mdckfk32.exe	176
PID 3368 wrote to memory of 3728	3368	Mdckfk32.exe	176
PID 3728 wrote to memory of 1708	3728	Mlopkm32.exe	174
PID 3728 wrote to memory of 1708	3728	Mlopkm32.exe	174
PID 3728 wrote to memory of 1708	3728	Mlopkm32.exe	174
PID 1708 wrote to memory of 3256	1708	Mmpijp32.exe	173
PID 1708 wrote to memory of 3256	1708	Mmpijp32.exe	173
PID 1708 wrote to memory of 3256	1708	Mmpijp32.exe	173
PID 3256 wrote to memory of 8	3256	Mpoefk32.exe	172
PID 3256 wrote to memory of 8	3256	Mpoefk32.exe	172
PID 3256 wrote to memory of 8	3256	Mpoefk32.exe	172
PID 8 wrote to memory of 2252	8	Melnob32.exe	19
PID 8 wrote to memory of 2252	8	Melnob32.exe	19
PID 8 wrote to memory of 2252	8	Melnob32.exe	19
PID 2252 wrote to memory of 1924	2252	Mpablkhc.exe	20
PID 2252 wrote to memory of 1924	2252	Mpablkhc.exe	20
PID 2252 wrote to memory of 1924	2252	Mpablkhc.exe	20
PID 1924 wrote to memory of 4420	1924	Miifeq32.exe	169
PID 1924 wrote to memory of 4420	1924	Miifeq32.exe	169
PID 1924 wrote to memory of 4420	1924	Miifeq32.exe	169
PID 4420 wrote to memory of 3756	4420	Nilcjp32.exe	21
PID 4420 wrote to memory of 3756	4420	Nilcjp32.exe	21
PID 4420 wrote to memory of 3756	4420	Nilcjp32.exe	21
PID 3756 wrote to memory of 2496	3756	Npfkgjdn.exe	22
PID 3756 wrote to memory of 2496	3756	Npfkgjdn.exe	22
PID 3756 wrote to memory of 2496	3756	Npfkgjdn.exe	22
PID 2496 wrote to memory of 2008	2496	Nebdoa32.exe	23
PID 2496 wrote to memory of 2008	2496	Nebdoa32.exe	23
PID 2496 wrote to memory of 2008	2496	Nebdoa32.exe	23
PID 2008 wrote to memory of 2376	2008	Nphhmj32.exe	24
PID 2008 wrote to memory of 2376	2008	Nphhmj32.exe	24
PID 2008 wrote to memory of 2376	2008	Nphhmj32.exe	24
PID 2376 wrote to memory of 4344	2376	Ngbpidjh.exe	25
PID 2376 wrote to memory of 4344	2376	Ngbpidjh.exe	25
PID 2376 wrote to memory of 4344	2376	Ngbpidjh.exe	25
PID 4344 wrote to memory of 3156	4344	Nnlhfn32.exe	26
PID 4344 wrote to memory of 3156	4344	Nnlhfn32.exe	26
PID 4344 wrote to memory of 3156	4344	Nnlhfn32.exe	26
PID 3156 wrote to memory of 3412	3156	Ngdmod32.exe	168

C:\Users\Admin\AppData\Local\Temp\701f957eaf4c1be43f51d788b80f33ac.exe
"C:\Users\Admin\AppData\Local\Temp\701f957eaf4c1be43f51d788b80f33ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\Lfkaag32.exe
  C:\Windows\system32\Lfkaag32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4080

C:\Windows\SysWOW64\Mdckfk32.exe
C:\Windows\system32\Mdckfk32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\Mlopkm32.exe
  C:\Windows\system32\Mlopkm32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3728

C:\Windows\SysWOW64\Mpablkhc.exe
C:\Windows\system32\Mpablkhc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\Miifeq32.exe
  C:\Windows\system32\Miifeq32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\Nilcjp32.exe
    C:\Windows\system32\Nilcjp32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4420

C:\Windows\SysWOW64\Npfkgjdn.exe
C:\Windows\system32\Npfkgjdn.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\Nebdoa32.exe
  C:\Windows\system32\Nebdoa32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\Nphhmj32.exe
    C:\Windows\system32\Nphhmj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\Ngbpidjh.exe
      C:\Windows\system32\Ngbpidjh.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4344
      - C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        7⤵
        Executes dropped EXE
        
        PID:3412

C:\Windows\SysWOW64\Ndhmhh32.exe
C:\Windows\system32\Ndhmhh32.exe
1⤵
- Executes dropped EXE
PID:632
- C:\Windows\SysWOW64\Oponmilc.exe
  C:\Windows\system32\Oponmilc.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Windows\SysWOW64\Ofnckp32.exe
    C:\Windows\system32\Ofnckp32.exe
    3⤵
    - Executes dropped EXE
    PID:960

C:\Windows\SysWOW64\Onhhamgg.exe
C:\Windows\system32\Onhhamgg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3784
- C:\Windows\SysWOW64\Odapnf32.exe
  C:\Windows\system32\Odapnf32.exe
  2⤵
  - Executes dropped EXE
  PID:704

C:\Windows\SysWOW64\Ojaelm32.exe
C:\Windows\system32\Ojaelm32.exe
1⤵
- Executes dropped EXE
PID:4912
- C:\Windows\SysWOW64\Pjeoglgc.exe
  C:\Windows\system32\Pjeoglgc.exe
  2⤵
  - Executes dropped EXE
  PID:1284

C:\Windows\SysWOW64\Pmfhig32.exe
C:\Windows\system32\Pmfhig32.exe
1⤵
- Executes dropped EXE
PID:1456
- C:\Windows\SysWOW64\Pnfdcjkg.exe
  C:\Windows\system32\Pnfdcjkg.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Windows\SysWOW64\Pdpmpdbd.exe
    C:\Windows\system32\Pdpmpdbd.exe
    3⤵
    - Executes dropped EXE
    PID:804

C:\Windows\SysWOW64\Pfaigm32.exe
C:\Windows\system32\Pfaigm32.exe
1⤵
- Executes dropped EXE
PID:1956
- C:\Windows\SysWOW64\Qdbiedpa.exe
  C:\Windows\system32\Qdbiedpa.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Windows\SysWOW64\Qfcfml32.exe
    C:\Windows\system32\Qfcfml32.exe
    3⤵
    - Executes dropped EXE
    PID:724
  - - C:\Windows\SysWOW64\Qmmnjfnl.exe
      C:\Windows\system32\Qmmnjfnl.exe
      4⤵
      Executes dropped EXE
      PID:1996

C:\Windows\SysWOW64\Aqkgpedc.exe
C:\Windows\system32\Aqkgpedc.exe
1⤵
- Executes dropped EXE
PID:3232
- C:\Windows\SysWOW64\Acjclpcf.exe
  C:\Windows\system32\Acjclpcf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Windows\SysWOW64\Ajckij32.exe
    C:\Windows\system32\Ajckij32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:2540

C:\Windows\SysWOW64\Aqncedbp.exe
C:\Windows\system32\Aqncedbp.exe
1⤵
- Executes dropped EXE
PID:3532
- C:\Windows\SysWOW64\Ajfhnjhq.exe
  C:\Windows\system32\Ajfhnjhq.exe
  2⤵
  - Executes dropped EXE
  PID:1500

C:\Windows\SysWOW64\Amddjegd.exe
C:\Windows\system32\Amddjegd.exe
1⤵
- Executes dropped EXE
PID:3840
- C:\Windows\SysWOW64\Acnlgp32.exe
  C:\Windows\system32\Acnlgp32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4480
- - C:\Windows\SysWOW64\Andqdh32.exe
    C:\Windows\system32\Andqdh32.exe
    3⤵
    - Executes dropped EXE
    PID:792
  - - C:\Windows\SysWOW64\Acqimo32.exe
      C:\Windows\system32\Acqimo32.exe
      4⤵
      Executes dropped EXE
      PID:1716

C:\Windows\SysWOW64\Bnkgeg32.exe
C:\Windows\system32\Bnkgeg32.exe
1⤵
- Executes dropped EXE
PID:1904
- C:\Windows\SysWOW64\Baicac32.exe
  C:\Windows\system32\Baicac32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3908

C:\Windows\SysWOW64\Balpgb32.exe
C:\Windows\system32\Balpgb32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4280
- C:\Windows\SysWOW64\Beihma32.exe
  C:\Windows\system32\Beihma32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2364
- - C:\Windows\SysWOW64\Bhhdil32.exe
    C:\Windows\system32\Bhhdil32.exe
    3⤵
    - Executes dropped EXE
    PID:3208

C:\Windows\SysWOW64\Bnbmefbg.exe
C:\Windows\system32\Bnbmefbg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4528
- C:\Windows\SysWOW64\Bapiabak.exe
  C:\Windows\system32\Bapiabak.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- - C:\Windows\SysWOW64\Chjaol32.exe
    C:\Windows\system32\Chjaol32.exe
    3⤵
    - Executes dropped EXE
    PID:4500
  - - C:\Windows\SysWOW64\Cndikf32.exe
      C:\Windows\system32\Cndikf32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4752

C:\Windows\SysWOW64\Chmndlge.exe
C:\Windows\system32\Chmndlge.exe
1⤵
- Executes dropped EXE
PID:2216
- C:\Windows\SysWOW64\Cnffqf32.exe
  C:\Windows\system32\Cnffqf32.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Windows\SysWOW64\Cdcoim32.exe
    C:\Windows\system32\Cdcoim32.exe
    3⤵
    - Executes dropped EXE
    PID:4620

C:\Windows\SysWOW64\Cmlcbbcj.exe
C:\Windows\system32\Cmlcbbcj.exe
1⤵
PID:700
- C:\Windows\SysWOW64\Ceckcp32.exe
  C:\Windows\system32\Ceckcp32.exe
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\Cfdhkhjj.exe
    C:\Windows\system32\Cfdhkhjj.exe
    3⤵
    PID:1328
  - - C:\Windows\SysWOW64\Cajlhqjp.exe
      C:\Windows\system32\Cajlhqjp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:2912
    - - C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        5⤵
        
        PID:5072
      - C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        6⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        7⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        8⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        9⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:228
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        11⤵
        Drops file in System32 directory
        
        PID:1644

C:\Windows\SysWOW64\Dmefhako.exe
C:\Windows\system32\Dmefhako.exe
1⤵
PID:2980
- C:\Windows\SysWOW64\Daqbip32.exe
  C:\Windows\system32\Daqbip32.exe
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\Dhkjej32.exe
    C:\Windows\system32\Dhkjej32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4968
  - - C:\Windows\SysWOW64\Dodbbdbb.exe
      C:\Windows\system32\Dodbbdbb.exe
      4⤵
      Modifies registry class
      PID:860

C:\Windows\SysWOW64\Dhmgki32.exe
C:\Windows\system32\Dhmgki32.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\Dkkcge32.exe
  C:\Windows\system32\Dkkcge32.exe
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\Daekdooc.exe
    C:\Windows\system32\Daekdooc.exe
    3⤵
    PID:3432
  - - C:\Windows\SysWOW64\Dhocqigp.exe
      C:\Windows\system32\Dhocqigp.exe
      4⤵
      PID:2084
    - - C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        5⤵
        Modifies registry class
        
        PID:5144

C:\Windows\SysWOW64\Dahhio32.exe
C:\Windows\system32\Dahhio32.exe
1⤵
- Drops file in System32 directory
PID:5192
- C:\Windows\SysWOW64\Edfdej32.exe
  C:\Windows\system32\Edfdej32.exe
  2⤵
  PID:5240

C:\Windows\SysWOW64\Ekpmbddq.exe
C:\Windows\system32\Ekpmbddq.exe
1⤵
- Modifies registry class
PID:5296
- C:\Windows\SysWOW64\Emoinpcd.exe
  C:\Windows\system32\Emoinpcd.exe
  2⤵
  PID:5336
- - C:\Windows\SysWOW64\Eefaomcg.exe
    C:\Windows\system32\Eefaomcg.exe
    3⤵
    PID:5384

C:\Windows\SysWOW64\Eggmge32.exe
C:\Windows\system32\Eggmge32.exe
1⤵
PID:5448
- C:\Windows\SysWOW64\Eonehbjg.exe
  C:\Windows\system32\Eonehbjg.exe
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\Eehnem32.exe
    C:\Windows\system32\Eehnem32.exe
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\Ehfjah32.exe
      C:\Windows\system32\Ehfjah32.exe
      4⤵
      Drops file in System32 directory
      PID:5604
    - - C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        5⤵
        Modifies registry class
        
        PID:5660

C:\Windows\SysWOW64\Eejjjl32.exe
C:\Windows\system32\Eejjjl32.exe
1⤵
PID:5696
- C:\Windows\SysWOW64\Ekgbccni.exe
  C:\Windows\system32\Ekgbccni.exe
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\Emeoooml.exe
    C:\Windows\system32\Emeoooml.exe
    3⤵
    PID:5812

C:\Windows\SysWOW64\Eemgplno.exe
C:\Windows\system32\Eemgplno.exe
1⤵
PID:5880
- C:\Windows\SysWOW64\Ehkclgmb.exe
  C:\Windows\system32\Ehkclgmb.exe
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\Ekiohclf.exe
    C:\Windows\system32\Ekiohclf.exe
    3⤵
    PID:5996

C:\Windows\SysWOW64\Eachem32.exe
C:\Windows\system32\Eachem32.exe
1⤵
PID:6040
- C:\Windows\SysWOW64\Fgppmd32.exe
  C:\Windows\system32\Fgppmd32.exe
  2⤵
  PID:6084
- - C:\Windows\SysWOW64\Foghnabl.exe
    C:\Windows\system32\Foghnabl.exe
    3⤵
    PID:6124
  - - C:\Windows\SysWOW64\Fafdkmap.exe
      C:\Windows\system32\Fafdkmap.exe
      4⤵
      PID:5172
    - - C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        5⤵
        
        PID:5228
      - C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        6⤵
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        7⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        8⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        9⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        10⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        11⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        12⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        11⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        12⤵
        
        PID:6916

C:\Windows\SysWOW64\Gglpibgm.exe
C:\Windows\system32\Gglpibgm.exe
1⤵
PID:5924
- C:\Windows\SysWOW64\Gochjpho.exe
  C:\Windows\system32\Gochjpho.exe
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\Gaadfkgc.exe
    C:\Windows\system32\Gaadfkgc.exe
    3⤵
    PID:6080
  - - C:\Windows\SysWOW64\Ghklce32.exe
      C:\Windows\system32\Ghklce32.exe
      4⤵
      PID:5124
    - - C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        6⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        7⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        8⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        9⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        10⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        11⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        12⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        13⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        14⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        15⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        16⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        17⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        18⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        19⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        20⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        21⤵
        
        PID:5160
  - - C:\Windows\SysWOW64\Pjmjdm32.exe
      C:\Windows\system32\Pjmjdm32.exe
      4⤵
      PID:6544
    - - C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        5⤵
        
        PID:4140

C:\Windows\SysWOW64\Deokon32.exe
C:\Windows\system32\Deokon32.exe
1⤵
PID:3608

C:\Windows\SysWOW64\Hdbfodfa.exe
C:\Windows\system32\Hdbfodfa.exe
1⤵
- Modifies registry class
PID:5460
- C:\Windows\SysWOW64\Hgabkoee.exe
  C:\Windows\system32\Hgabkoee.exe
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\Inkjhi32.exe
    C:\Windows\system32\Inkjhi32.exe
    3⤵
    PID:5940
  - - C:\Windows\SysWOW64\Idebdcdo.exe
      C:\Windows\system32\Idebdcdo.exe
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        5⤵
        
        PID:1824
      - C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        6⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        8⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        9⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        10⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        11⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        12⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        13⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        14⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        16⤵
        
        PID:6288

C:\Windows\SysWOW64\Cfbkeh32.exe
C:\Windows\system32\Cfbkeh32.exe
1⤵
- Drops file in System32 directory
PID:3164

C:\Windows\SysWOW64\Ienekbld.exe
C:\Windows\system32\Ienekbld.exe
1⤵
PID:6328
- C:\Windows\SysWOW64\Igmagnkg.exe
  C:\Windows\system32\Igmagnkg.exe
  2⤵
  - Drops file in System32 directory
  PID:6376
- - C:\Windows\SysWOW64\Jngjch32.exe
    C:\Windows\system32\Jngjch32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6416
  - - C:\Windows\SysWOW64\Jfnbdecg.exe
      C:\Windows\system32\Jfnbdecg.exe
      4⤵
      PID:6460
    - - C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        5⤵
        
        PID:6504
      - C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        7⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        8⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        9⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        10⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        11⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        12⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        13⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        14⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        15⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        16⤵
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        17⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        18⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        19⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        20⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        21⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        22⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        23⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        24⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        26⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        27⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        28⤵
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        29⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        30⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        31⤵
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        32⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        33⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        34⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        35⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        36⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        37⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        38⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        39⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        40⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        41⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1528
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        43⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        44⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        46⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        47⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        48⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        49⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        50⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        51⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        52⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        53⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        54⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        55⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        56⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        57⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        58⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        59⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        60⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        61⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        62⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        63⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        64⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        65⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        66⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        67⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        68⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        69⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        70⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        71⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        72⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        73⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        74⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        75⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        76⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        77⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        78⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        79⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        80⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        81⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        82⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        83⤵
        Drops file in System32 directory
        
        PID:4064
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        84⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        85⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        86⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        87⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        88⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        89⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        90⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        91⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        92⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        94⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        95⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        96⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        97⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        99⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        101⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        103⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        104⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        105⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        106⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        107⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        108⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        109⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        111⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        112⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        113⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        114⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        115⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        116⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        117⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        118⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        119⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        120⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        121⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        122⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        123⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        124⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        125⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        126⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        127⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        128⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        129⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        130⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        131⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        132⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        133⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        134⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        135⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        137⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        139⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        140⤵
        Drops file in System32 directory
        
        PID:9104
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        141⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        142⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        143⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        144⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        145⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        146⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        147⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        148⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        149⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        150⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        151⤵
        Drops file in System32 directory
        
        PID:8740
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        152⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        153⤵
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        154⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        155⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        156⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        157⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        159⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        160⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        161⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        162⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        163⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        164⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        165⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        166⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        167⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        168⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        169⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        170⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        171⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        172⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        173⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        174⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        175⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        176⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        177⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        178⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        179⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        180⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        181⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        182⤵
        Modifies registry class
        
        PID:8480
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        183⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        184⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        185⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        186⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        187⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        188⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        189⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        191⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        192⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        193⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        194⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        195⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        196⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        197⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        198⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        199⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        200⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        201⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        202⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        203⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        204⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        205⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        206⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        207⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        208⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        209⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        211⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        212⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        213⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        214⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        215⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        216⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        217⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        218⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        219⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        220⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        221⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        222⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        223⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        224⤵
        Drops file in System32 directory
        
        PID:10212
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        225⤵
        Modifies registry class
        
        PID:10232
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        226⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        227⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        228⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        229⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        230⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        231⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        232⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        233⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        234⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        236⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        237⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        238⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        239⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        240⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        241⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        242⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        243⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        244⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        245⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        246⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        247⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        248⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        249⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        250⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        251⤵
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10248
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        253⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        254⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        255⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        256⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        257⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        258⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10548
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        260⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10628
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        262⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        263⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10756
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        265⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        266⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        267⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10924
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        269⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        270⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        271⤵
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        272⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        273⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        274⤵
        Modifies registry class
        
        PID:11184
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        275⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        276⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        277⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        278⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        279⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        280⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        281⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        282⤵
        Modifies registry class
        
        PID:10640
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        283⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        284⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10844
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        286⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        287⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        288⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        289⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        290⤵
        Drops file in System32 directory
        
        PID:11196
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9384
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        292⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        293⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        294⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        295⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        296⤵
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        297⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        298⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        300⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        301⤵
        Drops file in System32 directory
        
        PID:10620
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        302⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        303⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        304⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        305⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        306⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        307⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        308⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        309⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        310⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        311⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        312⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        313⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        314⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        315⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        175⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        176⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        177⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        178⤵
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        179⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        180⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        181⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        182⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        183⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        184⤵
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        185⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        186⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        187⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        188⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        189⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        190⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        191⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        192⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        193⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        194⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        195⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        196⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        197⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        198⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        199⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        200⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        201⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        202⤵
        Modifies registry class
        
        PID:10204
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        203⤵
        Drops file in System32 directory
        
        PID:9780
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        204⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        205⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        206⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        207⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        209⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        210⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        211⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        212⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        213⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8852 -s 408
        214⤵
        Program crash
        
        PID:9792

C:\Windows\SysWOW64\Bjagjhnc.exe
C:\Windows\system32\Bjagjhnc.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4492
- C:\Windows\SysWOW64\Jmbhoeid.exe
  C:\Windows\system32\Jmbhoeid.exe
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\Jofalmmp.exe
    C:\Windows\system32\Jofalmmp.exe
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\Jilfifme.exe
      C:\Windows\system32\Jilfifme.exe
      4⤵
      PID:6012
    - - C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        5⤵
        
        PID:3056
      - C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        6⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        7⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        9⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        10⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        11⤵
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        12⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        13⤵
        
        PID:3824

C:\Windows\SysWOW64\Bgcknmop.exe
C:\Windows\system32\Bgcknmop.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\SysWOW64\Qgcbgo32.exe
C:\Windows\system32\Qgcbgo32.exe
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\SysWOW64\Pflplnlg.exe
C:\Windows\system32\Pflplnlg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4364

C:\Windows\SysWOW64\Olmeci32.exe
C:\Windows\system32\Olmeci32.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\SysWOW64\Ofcmfodb.exe
C:\Windows\system32\Ofcmfodb.exe
1⤵
- Executes dropped EXE
PID:216

C:\Windows\SysWOW64\Ocbddc32.exe
C:\Windows\system32\Ocbddc32.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\SysWOW64\Melnob32.exe
C:\Windows\system32\Melnob32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\Mpoefk32.exe
C:\Windows\system32\Mpoefk32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\Mmpijp32.exe
C:\Windows\system32\Mmpijp32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\Lmiciaaj.exe
C:\Windows\system32\Lmiciaaj.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\SysWOW64\Lgokmgjm.exe
C:\Windows\system32\Lgokmgjm.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\SysWOW64\Lljfpnjg.exe
C:\Windows\system32\Lljfpnjg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\Lepncd32.exe
C:\Windows\system32\Lepncd32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\Ldoaklml.exe
C:\Windows\system32\Ldoaklml.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\Lmdina32.exe
C:\Windows\system32\Lmdina32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\Mgaokl32.exe
C:\Windows\system32\Mgaokl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11336
- C:\Windows\SysWOW64\Mjokgg32.exe
  C:\Windows\system32\Mjokgg32.exe
  2⤵
  PID:11380
- - C:\Windows\SysWOW64\Mnmdme32.exe
    C:\Windows\system32\Mnmdme32.exe
    3⤵
    PID:11448
  - - C:\Windows\SysWOW64\Mjdebfnd.exe
      C:\Windows\system32\Mjdebfnd.exe
      4⤵
      PID:11496
    - - C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        5⤵
        
        PID:11548
      - C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        6⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        7⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        8⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        9⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        10⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        11⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        12⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        13⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        14⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        15⤵
        Drops file in System32 directory
        
        PID:12032
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        16⤵
        Drops file in System32 directory
        
        PID:12084
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        17⤵
        Drops file in System32 directory
        
        PID:12144
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        18⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        19⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        20⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        21⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        22⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        23⤵
        Modifies registry class
        
        PID:11372
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        24⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        25⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2244
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11608
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        29⤵
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        30⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        31⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        32⤵
        Modifies registry class
        
        PID:11820
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        33⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        34⤵
        Modifies registry class
        
        PID:11928
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        35⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        36⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        37⤵
        Drops file in System32 directory
        
        PID:12104
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        38⤵
        Modifies registry class
        
        PID:12164
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        39⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12248
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        41⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        42⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        43⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        44⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        45⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        46⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        47⤵
        Modifies registry class
        
        PID:11568
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        48⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        49⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        50⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        51⤵
        
        PID:704
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        52⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        53⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        54⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        55⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        56⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        57⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        58⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        59⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        60⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2212
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        62⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        63⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        64⤵
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        65⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        66⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        67⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        68⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        69⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        70⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        71⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        72⤵
        
        PID:1912

C:\Windows\SysWOW64\Ekmhejao.exe
C:\Windows\system32\Ekmhejao.exe
1⤵
PID:4264
- C:\Windows\SysWOW64\Eokqkh32.exe
  C:\Windows\system32\Eokqkh32.exe
  2⤵
  PID:12220
- - C:\Windows\SysWOW64\Felbnn32.exe
    C:\Windows\system32\Felbnn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2568

C:\Windows\SysWOW64\Fpbflg32.exe
C:\Windows\system32\Fpbflg32.exe
1⤵
PID:2536
- C:\Windows\SysWOW64\Feoodn32.exe
  C:\Windows\system32\Feoodn32.exe
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\Fealin32.exe
    C:\Windows\system32\Fealin32.exe
    3⤵
    - Drops file in System32 directory
    PID:10736
  - - C:\Windows\SysWOW64\Fpimlfke.exe
      C:\Windows\system32\Fpimlfke.exe
      4⤵
      PID:11208
    - - C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        5⤵
        
        PID:2752
      - C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        6⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        7⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        8⤵
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        9⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        10⤵
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        11⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        12⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2012
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        14⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        15⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        16⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        17⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        18⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        19⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        20⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        21⤵
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2588
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3884

C:\Windows\SysWOW64\Ifmqfm32.exe
C:\Windows\system32\Ifmqfm32.exe
1⤵
PID:5908
- C:\Windows\SysWOW64\Iliinc32.exe
  C:\Windows\system32\Iliinc32.exe
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\Iojbpo32.exe
    C:\Windows\system32\Iojbpo32.exe
    3⤵
    PID:2576
  - - C:\Windows\SysWOW64\Iedjmioj.exe
      C:\Windows\system32\Iedjmioj.exe
      4⤵
      PID:5504
    - - C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        5⤵
        Modifies registry class
        
        PID:1904
      - C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        6⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        7⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        8⤵
        Modifies registry class
        
        PID:11420
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844

C:\Windows\SysWOW64\Jcmdaljn.exe
C:\Windows\system32\Jcmdaljn.exe
1⤵
PID:4492

C:\Windows\SysWOW64\Lnjgfb32.exe
C:\Windows\system32\Lnjgfb32.exe
1⤵
PID:3904
- C:\Windows\SysWOW64\Lokdnjkg.exe
  C:\Windows\system32\Lokdnjkg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:3028
- - C:\Windows\SysWOW64\Lomqcjie.exe
    C:\Windows\system32\Lomqcjie.exe
    3⤵
    PID:5308
  - - C:\Windows\SysWOW64\Lnoaaaad.exe
      C:\Windows\system32\Lnoaaaad.exe
      4⤵
      PID:6028
    - - C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        5⤵
        
        PID:4484
      - C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        6⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        7⤵
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        8⤵
        Modifies registry class
        
        PID:12156
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        9⤵
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        10⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        11⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        12⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        13⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        14⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        15⤵
        
        PID:12276

C:\Windows\SysWOW64\Mgbefe32.exe
C:\Windows\system32\Mgbefe32.exe
1⤵
PID:5564
- C:\Windows\SysWOW64\Mmpmnl32.exe
  C:\Windows\system32\Mmpmnl32.exe
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\Mcifkf32.exe
    C:\Windows\system32\Mcifkf32.exe
    3⤵
    - Drops file in System32 directory
    PID:5708
  - - C:\Windows\SysWOW64\Mfhbga32.exe
      C:\Windows\system32\Mfhbga32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:5320
    - - C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        5⤵
        
        PID:5440
      - C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        6⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        7⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        10⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        11⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        12⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        13⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        14⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        15⤵
        Modifies registry class
        
        PID:11476
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        16⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        17⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        18⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        19⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4996
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        21⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        23⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        24⤵
        
        PID:6080

C:\Windows\SysWOW64\Pffgom32.exe
C:\Windows\system32\Pffgom32.exe
1⤵
PID:7100
- C:\Windows\SysWOW64\Palklf32.exe
  C:\Windows\system32\Palklf32.exe
  2⤵
  PID:912
- - C:\Windows\SysWOW64\Pfiddm32.exe
    C:\Windows\system32\Pfiddm32.exe
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\Pnplfj32.exe
      C:\Windows\system32\Pnplfj32.exe
      4⤵
      PID:5592
    - - C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        5⤵
        Modifies registry class
        
        PID:4428
      - C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        6⤵
        
        PID:588
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        7⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        8⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        9⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        10⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        11⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        12⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        13⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        14⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        15⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        16⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10324
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        18⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        19⤵
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        20⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        21⤵
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        22⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        24⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        25⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        26⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        27⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        28⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        29⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        30⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        31⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        32⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        33⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11712
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        35⤵
        
        PID:5668

C:\Windows\SysWOW64\Dpiplm32.exe
C:\Windows\system32\Dpiplm32.exe
1⤵
PID:1328
- C:\Windows\SysWOW64\Dnmaea32.exe
  C:\Windows\system32\Dnmaea32.exe
  2⤵
  PID:864
- - C:\Windows\SysWOW64\Ddgibkpc.exe
    C:\Windows\system32\Ddgibkpc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6980
  - - C:\Windows\SysWOW64\Dgeenfog.exe
      C:\Windows\system32\Dgeenfog.exe
      4⤵
      PID:6684
    - - C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        5⤵
        
        PID:7108
      - C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        6⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        7⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        8⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        9⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        10⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        11⤵
        Drops file in System32 directory
        
        PID:7704
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        12⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        13⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        14⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        15⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        17⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        18⤵
        
        PID:792
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        19⤵
        
        PID:2964

C:\Windows\SysWOW64\Ekajec32.exe
C:\Windows\system32\Ekajec32.exe
1⤵
- Drops file in System32 directory
PID:6936
- C:\Windows\SysWOW64\Ekcgkb32.exe
  C:\Windows\system32\Ekcgkb32.exe
  2⤵
  PID:10260
- - C:\Windows\SysWOW64\Fdlkdhnk.exe
    C:\Windows\system32\Fdlkdhnk.exe
    3⤵
    PID:6480
  - - C:\Windows\SysWOW64\Fdnhih32.exe
      C:\Windows\system32\Fdnhih32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8188
    - - C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        5⤵
        
        PID:7836
      - C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        6⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        7⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        8⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        9⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        10⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        11⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        12⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        13⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        14⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        15⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        16⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        17⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        18⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        19⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        20⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3572
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        22⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        23⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        25⤵
        
        PID:6852

C:\Windows\SysWOW64\Hemmac32.exe
C:\Windows\system32\Hemmac32.exe
1⤵
PID:6160
- C:\Windows\SysWOW64\Ilfennic.exe
  C:\Windows\system32\Ilfennic.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5304
- - C:\Windows\SysWOW64\Inebjihf.exe
    C:\Windows\system32\Inebjihf.exe
    3⤵
    PID:5764
  - - C:\Windows\SysWOW64\Ihmfco32.exe
      C:\Windows\system32\Ihmfco32.exe
      4⤵
      PID:12224
    - - C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        5⤵
        
        PID:7588
      - C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        6⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        7⤵
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        8⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        9⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        10⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        11⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        12⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        13⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        14⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        15⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        16⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        17⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        18⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        19⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        20⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        22⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        23⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        24⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        25⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        26⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        27⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        28⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        29⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        30⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        31⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        32⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        33⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        34⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        35⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        36⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        37⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        38⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        39⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        40⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        41⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        42⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        43⤵
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        44⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        45⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        46⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        47⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        48⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        49⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        50⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        51⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        52⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        53⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        54⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8400
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        56⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        57⤵
        
        PID:8664

C:\Windows\SysWOW64\Nfnamjhk.exe
C:\Windows\system32\Nfnamjhk.exe
1⤵
PID:7956
- C:\Windows\SysWOW64\Nmhijd32.exe
  C:\Windows\system32\Nmhijd32.exe
  2⤵
  - Modifies registry class
  PID:7340
- - C:\Windows\SysWOW64\Nbebbk32.exe
    C:\Windows\system32\Nbebbk32.exe
    3⤵
    PID:8788
  - - C:\Windows\SysWOW64\Nqfbpb32.exe
      C:\Windows\system32\Nqfbpb32.exe
      4⤵
      PID:8244
    - - C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        5⤵
        
        PID:6156
      - C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        7⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        9⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        10⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        11⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        12⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        13⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        14⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        15⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        16⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        17⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        18⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        19⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        20⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        21⤵
        
        PID:8864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8852 -ip 8852
1⤵
PID:8936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abponp32.exe

Filesize
320KB

MD5
8dd8b50e44913e5a8becd4066ea97fa2

SHA1
750bcb72e1e7d803ea1ed9673d987fd996e01e43

SHA256
84b11aa537cd54dbc279f83dab0a28f41d01cbed166798aee0b87646136c4c97

SHA512
d464fdb777fd04f5e2822ad8b3328f066c3451365efaf58839a620f7432de2d62c033e40ddc9f75ce1354de27f6639beb2e4827f1dbcda60754d591fcd5924b0

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
333KB

MD5
1e85506912b14561ebf133a784340f26

SHA1
9cede40150c969dd8fb47e3ceb887f3dc8606d5f

SHA256
07a829ea4cb55cbde1c69b6f23cddf9b1889eb69a84eadf39b117e12971cd6e8

SHA512
1c4f3bf863a684c9f27c7e1515e8014932db25c495cfed851c308a15520c3b56d5f941158928f8d0dd5b1c1c6740339466b5cbca14709b2db0a1cb2651133975

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
333KB

MD5
c1092288087d201d4d2444f42a5c5e58

SHA1
3bbfe5cb496c0a58d1caf4792dc3e4675109aa64

SHA256
d7e72d2f10d5d36a2cb850c644b3ac971e534cb2fe16a84bf67887990f18277d

SHA512
9f3408d3c626e32f71b5f8dfe45acf34ef045eef823eb91d05af656a3babee1338cfe67e05230555de0671efbdf73fd4c7ea7560de2f854399b1a13375073deb

Download Submit
C:\Windows\SysWOW64\Amhfkopc.exe

Filesize
333KB

MD5
cb7791326936b6f52ec4040d9e6918e3

SHA1
9e04623921d5c69df7877e74451977a25c5e0c6c

SHA256
7564610de2127e7f78f93a5e1fbdd5cb34de29ed1098845c1f2264aa712a595c

SHA512
012123b5407b49ba49b2581e55db386eea737dea2ddb0b5ba6c9403e49eda01038dcc159590c1c043f203afd00e9c593be0c3245f0d4d4f95521e0a578a6b02f

Download Submit
C:\Windows\SysWOW64\Cceddf32.exe

Filesize
333KB

MD5
35d305214e0e9d1d101286baa27cdfc0

SHA1
f8568ca183c316675263322b5c092b01c2c77cd8

SHA256
12bfe45636bad263a736e0c2a4edd8c690b7b3196546b286e758e6b2ce6565c4

SHA512
75019a282e703119bfd2a235ca96464ede0f82a391462a3a23322c3f37a4a3c177b8b6217966a1197c25c2f5c7d0795dd15b2b4c99d5f114246144206d23e093

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
333KB

MD5
2f4e51e80f5c7ec1744af9aba8adbc51

SHA1
17bd20e8c76e76848c45cffaf5a246e6054b43a1

SHA256
ff0831fc984da6ca834d67f7576674d672b96f634bbe311f8bdbc7818b7ead1a

SHA512
f5a6d8e9f367924f3362f9aa16f8ddfc0d2c3f8ec701fdf6d234964458ea892d2da54ce9989dc54301acf8ea191f67fb313702383725dcc36ea218cd50f478d2

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
333KB

MD5
11183a157e89daf7c269bc35f33b1cd9

SHA1
4896dd1cda7a698864b3e231ac6603b31b0b681e

SHA256
33f2d94c697a84dd8d8584e077dfcbfd8a75c39ddf4fafb28af584ec84c1d74a

SHA512
aff3f98a0e1c0513f01449e1974393a651969b149e5bfc766e17b2bcef065601326edc81969efb05fe517ee12db9ec85ff6710b10a3a0a4df416f44cd099e8e3

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
333KB

MD5
979a6bb7a41a1110a397da06d9a961b4

SHA1
d3197cf99d269f60f31831456c7d9eaf7ffac862

SHA256
357c8ffee624b29a5eb3381afee8e04cb770f5f86fb70219e08b68023a6fafd0

SHA512
4842f57cf8cdbf4f77ac5bfbb76c675284b2cdd47a5f3e91d5994643c00b27a138d25768c8275a965f5f361f3b49af83e8a75cc841d444a578078cc55a455edc

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
57KB

MD5
70e547f1a3dc8d0e474d766d49da81e5

SHA1
6e73ddd51ddd4db5a294c3382a1f59691b5cde86

SHA256
7327bbe6333595432b2a9cbc37f421a581badd3c601b860efbffa75999b108fd

SHA512
afd2f50a7fc3b7feef9bfcefb7046b1b25091b534131f81704ad0c4fc4d53dac38f0bf87782c93f879496426fd53a0f403113859f8c44a2a17112645c03921c7

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
134KB

MD5
994b70602b1f26567e1e310e8b35a1c3

SHA1
d546e3c4514b32a9a35fa859da7e51a6de7b1417

SHA256
ad30dbb11eb2c0f71eea3144d3003bde36aefde48ec270a2b42b978e8ebdf988

SHA512
b49c38d237071f002fba165b9dcbb0dfce15f9654021b50f6d6511798fb6d71e62003e2bb5cd19af7e54b41fe8b926eb2bfac2fb576f7d8c5c9762f65e5cbc25

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
333KB

MD5
f98d759bff73d9a6ec8ace6059fad2be

SHA1
71fa303ed6b7a58329f56c202fb3d283c2af3c5f

SHA256
10b05394552fe0ede3cb0445567e79437dc0ef418e5dc402275e2ff040c74814

SHA512
8d7b97107a09e215238fd2f5fb29b339ba80820b9215df31cdfbd3327a34573ccc2c2c7d517cf97461808b943243e8c4fb65731e8307eba04e5cf51d638bbb6c

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
333KB

MD5
123985748a0d1f657150c17c7598019b

SHA1
acfbac758306003bceacb2d95c750fc2cbaf05fc

SHA256
6856740def5c2747ddc971b4d942ed29220d0600081072ed09e8d6b84cbd4fa5

SHA512
cbedd1dfe8eb3051d028612737ecb2c0b085b145068763e1bf4f64771f6fb6645c04b61d01a1f34a83c30a006ce1f0297f63bd72e81fca421bb8dcc6107436e5

Download Submit
C:\Windows\SysWOW64\Fdglmkeg.exe

Filesize
333KB

MD5
f03a4423ee4411e7c178b7a7bc1d3138

SHA1
0c5cf32b9cce6ba6712a4ad7e7a7499a9480d8cb

SHA256
77c6e4fba52ede1f11e421b3f9bfc5964ab7b8d3ce2887698d8b68dc494418cb

SHA512
b3a50a2077de916b3df7f250ca3b8540626a740cb065c74576ad7793d570104d16fe7f5a0bbb8b48a335154b407d3939d7f871b50a9baa79921430ef7ade37e8

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
333KB

MD5
ccacb5cfba86a85684f92551b74f8b6a

SHA1
de20c8c79baa5b6fa083e6449b863db4f1bdca87

SHA256
55719e2d8e7a3c9a9e9c1dc7f3449ce71f9e8b6d15f7159f73049c37aeb55a71

SHA512
58c499974c7bf33fa2ff40ac5fa8d3d00eb91f5452c9d77aadef02b98729125539a65505f999c87709d3e6fd73316ef5bea829b905a241f39af22c056ff4bad6

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
333KB

MD5
c1b6ad66a4952a672e711967f2923ed6

SHA1
3d92f9b0a2834e2b6a6663278bd1f813e87e118a

SHA256
70d286bc561184a35c2099183d1d6593f54edaaacdf67de1fd00af4f653b176c

SHA512
1a184696f6cc948fe7147861b6869ae1bab56cf47b38778e35c4c37b19bf7f6e28c74c8f603ddca859b1213fdf9e18637fa59fe42e5e959d51ec0b45505f5954

Download Submit
C:\Windows\SysWOW64\Gmeakf32.exe

Filesize
333KB

MD5
993e591899e69ba63b515df3cad9e6da

SHA1
d1c97d681287666af214d32418ef7f91dd6c39f8

SHA256
575f2b412df01e14ee452942df971dee97d20267e11fa4ada117f56bcb029f54

SHA512
df9b54115813e62d9a9f20bca3b07b29e08e7f5a91c35343d2bc1fcf4ee9c0c7ae6ec6ef17c2719862338659a662cfdbf1ebedf023505b1636f63660482b35ba

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
333KB

MD5
514fe91badec5f012fc78709577d3858

SHA1
bd8d78bd676d12c9c0067a5e59c5b3ef0970a0b8

SHA256
922c07f4e0f8bea829d857d3c0623f062029c1c0eecacc76f64758ac821db680

SHA512
88d9410af9f3f835877de3a55e743dcca197a0b919729614654077bebcac395aad72241421d21be1a1d053b566f661b859b21c7c99303ca0428e1b1389ecf4e4

Download Submit
C:\Windows\SysWOW64\Hgiepjga.exe

Filesize
333KB

MD5
063a8a0570b49c8c6c690cda088b2573

SHA1
f6c2b4385fb3af795ae955df16a354256be3442c

SHA256
50f778d14f7281a8e7aff7a762c50611203795e5e1bee25cb5b8fe3a6492120b

SHA512
c4feee65b17762abfd2de4645c05b2305e7b1ef3ccf86667936172b3a063c01d832a560a8c7cb32cd731056248c714d4b3952658b94bbabbc69a984353482c47

Download Submit
C:\Windows\SysWOW64\Hnfamjqg.exe

Filesize
333KB

MD5
e3d4a9cadd8a6f132b035f9acee2e55a

SHA1
41c276fed523cfcc3ab8c87611b0454187d1f004

SHA256
fe330af1dced6610b69fb98f5c09404763c95ca59fb7aefce4258a4f068486e6

SHA512
9c1bea28f7aea2c1c873c576e72215fd0710c76e16c2627f7a3de2f014e381ed27fad0d934b7ea7280c5625d1a893a56230f150c18eb1564a5643e4b83456e46

Download Submit
C:\Windows\SysWOW64\Hnoklk32.exe

Filesize
333KB

MD5
1cd225e8e87cce82606da0724b4e6c28

SHA1
335c50a3e87d5d2d10fbf756930c35faee1b0a4b

SHA256
60bd588ee1e21caa72896f81c1b6c89b3e0596cbfb1f4a4ab3d0ee9ea7ef3a61

SHA512
e7ec80aebde0dc914fd5b40bff82cccc374c1c5e23de4ebc512235ca02f9907fd10c93293162da69259fbedf1717706c44aff479e04cd9dd52697a893c91b27a

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
333KB

MD5
f92c0811c242cd38f9f7751f25ca9657

SHA1
73993decc640f965cf6164065854df33e8f814c4

SHA256
a74dd409fb17b1ec5eff19f27db22677a2062c07098a5384e0756e56349038a8

SHA512
acb6cc0d323febbb9a08f411f3562b2bcaa26d2159bbe297937fc4d95369259ba27e595d61d4a5b0cfd08cc6ccdc5e3537df0d5d1020739204607d7c83f3f73f

Download Submit
C:\Windows\SysWOW64\Inkjhi32.exe

Filesize
333KB

MD5
dbf1d46480155c84b4009d68ad458d27

SHA1
8bf7e855564e11cbabd430b28f8ea1c377f28161

SHA256
b40466685668b05c18bbd8c519b30849952b221cc6ab12d1030b0360b1923162

SHA512
00c95a8a81557ace666b34abe550dc7b83feb1cee3dfc3ff37fbae7d9b2600f9a6be7dfe8dcff08cd5cfbfbc9027abbb00ea50bbd2435d89d97c8622a6f6fb9b

Download Submit
C:\Windows\SysWOW64\Jjdjoane.exe

Filesize
333KB

MD5
ab7bedb936dc9c1ea1f9f9fc86cb1ad7

SHA1
32339f94476e4edcd5eed9aa70b31247e75078bd

SHA256
9e0ca4b315d8a64fe0051e14bc2c5846509efd481d6ae520c83a226da960d667

SHA512
17ed893faadc5fcf31ab691c1ea8fa13740d8aa27f720ef747b9ca3e91735947189cc3e5648ae07f816f8655bf5a88547b3bd22b0017ce9b4588366b5de44455

Download Submit
C:\Windows\SysWOW64\Jkjcbe32.exe

Filesize
333KB

MD5
dac8b1841e3ca085345b872f0789f571

SHA1
6c148650f820db272fd12598e5d47975d7d70315

SHA256
aec75e6689bdcd797a70ccdb8fd96035ba40dc372673538297c1ffd832494b3a

SHA512
ca5d354cd12ca8ccf9306a74499754694609e85f7ff5ed23e33a0902a1a6797c9f987b71d743838a6a6cc4d550f11779070b6b023b2ce3114928c771d2f6563e

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
333KB

MD5
5b33672201734b2f8d25286af3a83ad6

SHA1
61f25d6c419f697409012b75a407d895d4e1bca6

SHA256
57117a5f6b43664e9ba99cb5d0f79504eceb2698df1ac98c139f973de77048a5

SHA512
d4fa13c22367bd179bbaf151ebd636d1e2415875fa7df4b0eb6f073181242e1eb5dc6be2ba06d35c562cc05d731bae05a3f5de8271ecdf291aed16e18e990ce7

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
333KB

MD5
974a9aa2769864398b41a6c070c9e6ca

SHA1
caf51a3816052cf6f8febe6fec8904461b7da84b

SHA256
cde48169a6647e35b400f88354234e6e66b6b8396eb65133425912ae22b7fd06

SHA512
3460a188f5a1392da3adddf190d4db7fbe452b0d1f1183aeccb62d879fefad4fc3f6f0d3a6f1c4b361efcd29519243744e35882b880c34032e0aba95c1c302d4

Download Submit
C:\Windows\SysWOW64\Lbgalmej.exe

Filesize
333KB

MD5
206cf31a7c10fd2654cbe6fd37c8a284

SHA1
109aea7c27fea8f42c7663bcd61fedb283abdf72

SHA256
ed2e8b00e089546c22755d9603d8708cd5de117cf30930fb4f8be62f66662337

SHA512
7ee901c45dca4082f16aff6a36afd08aa38ac8979510232fd5d7a42cef67cb09b9cb39c080e91aaf09d175622db36e7793889294390cb8fd11095b194eb38ead

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
333KB

MD5
51b96c3d4161b26924eecf552b4786b2

SHA1
145895f2f6334bd8533ac1fbb98d9923180d6d84

SHA256
81806ebc7078b6df6f37505dad006cbce4533b15fcb92d77d612f222df3b7eb7

SHA512
19fb51a5b95f80f3d280bd9e43ef0b3b615ba65ddd03ed205bc99135c79577d27f1959b9316569ee58c9b45ecac51a07627da81b81a1546f14de097b73ae04b0

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
333KB

MD5
eac66549ba7834dd921f904e29c075f5

SHA1
b3eb111b4bc5f04501e8b81e8f56a36373bf5fdf

SHA256
700518682463d26cf2d102b9eafc5b33fe6dfb4e5453b329f41e8acd7d4f5887

SHA512
ab080179e7854da585185df9716f90d14103cacced47622ef4b9aa7a7cc53d8465e0b9be929cdaa34e41273665ef572d02731c40c69cbd4beaf1f1e7503fac25

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
333KB

MD5
3b46eebce3409accd45671a61b481169

SHA1
42cad5648be45a4b3f5eaa36ff73205d12078d1f

SHA256
c6b9beb37bca0a3d2d4a50472c8463a025d13e7a14325d2f80f828dab3b942bc

SHA512
22684e0c8f39c3c5d7bfd4f3f19bd1907be354f4230f7ba650621bd195cdb7e1c46f190cecefe95b41f31dbd1869cb21a9fabb526e835a81d6ba0b2ee7c7f281

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
333KB

MD5
1f5c649c88c05e45913ad15bdb0869b4

SHA1
38090771ec7760792766e9c7ad23712a5d4e668a

SHA256
d7bd6563f19a75021d63a5ba1e6f57a07de9d40d434d60feff74f73572d34e1c

SHA512
30688fff19a530ca8ec1f3d686d1cc150ff64d0709763dee4c288436ca317d76c4838954083e9a4e8764a17d26e5250410f3d908bbba65baa5da5fc18ccee685

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
30KB

MD5
ae71354e8c22b49b123e9b34c8495efd

SHA1
618a3e7a0d1a326e0cdc7e3abc1751c8fafa04ed

SHA256
20c04a02cc7df4fcd07c7e5d2f7024588d347cf8bc8b64a92add3da3b9bb9dab

SHA512
cdcc40bb9eeb51b53a0d7d0ca14c9f66f9f68d1b4a0d21cd1449101d68af910fc185b497bbed07c4e20064a9404442e0669664bc12095e1480ad3dcf76c66926

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
333KB

MD5
21474ca67f087d72843ea7b4def0eb2b

SHA1
2d23fa6ddaf4df9538dfcc4e82cdb85583ec63ff

SHA256
f5371485157feb2ff67e782526b92558d585c988c99d5e6abece51d625052c8d

SHA512
08735ed5dd1a382b4f0e8e058815f2b472a0fe3b3cc5d99b10d2e3a81fbcce3a5a82600b461ee862c3c0ccec9c62afdb175191d3511f74072ce3eb33b75b3581

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
333KB

MD5
feef15d26f2277c821a248548de91957

SHA1
c2e762b8e723c536c677bca3cf69bb7f504f70a3

SHA256
d18713540b749f2b2298819874f455bff1f14406db2e91ecf8707da8c33e9738

SHA512
274eb7476164a3cd8c46a90012e6be01235c0da6295d293d3cc64e8efc91eb12aad8039da6a4929e58bb0b6f13c15f75253688978cc9d2f446ca42c9afffd437

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
333KB

MD5
fc07731735c8be7eb6df24a518343d1c

SHA1
4c68637994c49ba6f4f002acf24492434651ba58

SHA256
546e787d2467669194fb5a67bb0c94786847e8b8a8902f26144b0f648f582fac

SHA512
7d1c6bd74812b84cb72871650c8af708a2709ea75bdbd35e5a4610cf5817bf13ca09efcad5cf1519ac49acf859d6ff0623546a792c578277663d8a9339bec464

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
51KB

MD5
bb1aece200bd819829576b8e905a32d0

SHA1
fe27693700359b421587206ac32a47e76ef641c6

SHA256
ac7765c134ee85ebcbf1340b80f1d379f684f91394e332b8629d1e62e797bcb8

SHA512
8f6911a2d039e6125efb5a0c1e97a4c398f073a62eb7be25edad9eff6ef5eb146e7c5f603a91589cabed61104b3e5d4d2617fc7f27bc3fabbcbe64aa1a1232eb

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
10KB

MD5
097fee2e72606babf076c69c2cd3ced4

SHA1
2fc2b862eedb52c7d92f1b05c7c2b1ac04ca5289

SHA256
013904f0e16cc95b183522d2f934cc799a5668b65dd515f6520f67379e6a5d0f

SHA512
9a1244113602c522f6cb144d4900b19f7d03a458560c009b1341ce291bd15da7ae9f713920dfe02abacad1ba6907267ee7c7c10feb0fde58a72b9fcf1a11f7ce

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
5KB

MD5
283bcbabc16776c28b3a5309c987e015

SHA1
aad5b30a69a9af35c02087c810405f0ca6c4c432

SHA256
96816ef02a5095b9ff88d90e0081769a9243e6abfa5eeccd8690e3188333a6bf

SHA512
118a32d8ce5c3e5e1b5a2668e245bd89a38987b4a7da0a2e4a28fb3f25f7b9cd1bb8cfc0a909b55d85cc0b72e028cf22c319078a9e4ffd49d0416d84631feb69

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
333KB

MD5
98eaf06f043c7f90e2d0dad3bea47af8

SHA1
f1cc309ad7181d8d7be3848aae7574f4bb0365f3

SHA256
606a7400087eaa4fe515f460e45ce3a2da208f886550eeaaaca071b367a2fcfb

SHA512
530a49c02383c9b901e8c85b2c66259645cd1e8c848107b7372188212e6292899b42601a5cc746918cba6fa7e3620cc58166ac97f2b57bcab2a3f766e2438e08

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
23KB

MD5
8253411f6c690b29e2bd7d21bfe60188

SHA1
ef9cb686006ec36eee69b813215d9eabc59a2a26

SHA256
002e066b22c77dd6f6b132806a9f91e1becad2c4c3111ea3d749fce9608fc01a

SHA512
ae2889b0dfcb35acab0a61b5e219cb85047e90c7e63d584148246709833cfc7555d7936c83e05274ec3f926c381c50c875bc957531cea8e041c5a3fec9e1698a

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
27KB

MD5
7ffb4716d52765da340a644d05429e1c

SHA1
19a2b44da87ac8b315af87fbec30498ba298ed4b

SHA256
870bcf1b462d192297ec72b4c05a08d7325b2c9556498563d7e62d19046d1c81

SHA512
1b1caf85417b4bed6b34e952f6c8a163db7038ee8686aca6750259735193d5b7b663f46c951f469caf6ed1f02d95df2452867e447c51e63a2c0e3fcf72aa730e

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
333KB

MD5
8d73a2c901dcbc4b7bef1c734f0c4693

SHA1
a9a4f4edde1385ba24528a26615e0ae10fa33950

SHA256
00e10a7e95626b55dca911d2049a8f0e4904df2765c780cfae6692e8ffdc7ff3

SHA512
b1b4765a27b14813f8b5b8066945db457083b8ff21cc7737f5f47b4f0e610c3cdcae04dd0e6735a4ace726ce49631c79a963b57cc9de268870c93bc4ef5c086d

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
40KB

MD5
a5165df0a5187b1013423666f2dc832c

SHA1
5c69f61656c0ab55302e1b998743548014299448

SHA256
fd06e0f2f530c80c16962d5867a2e5864ffa05d5dd9b79aea1037e89abd363f0

SHA512
97ec5c6ccf3692692beaa123c423ad29c2a2ab1e02e4c29ecf771c5ea5f0985ba364555fa3579b5e1d681366480817829d6324b9ebf296be14fa5148fadb38cc

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
22KB

MD5
94c36648d22ddaada486ba29553f2bbc

SHA1
0b10d6c81a50e58c6b5ed0351e850e54daa5bc57

SHA256
073c57642d1c7ebeff742cb181898cfca6d4b7cbcd828ad4c7e75e575dea6616

SHA512
f477a5dcef823c0b87a10e961f1f28af3f19665943a5b5f7249b0f6cb4a5b48df086053abca0e7bbbc2ac55f2ab19efcb6b4e0f14a5f1a07db3e7e2855bb4fb4

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
333KB

MD5
cb1f33c7cbb8b371aa3e84a51ab57eef

SHA1
757a6f9458a8ede01a7c410ed5cf84968984792d

SHA256
939c01e7dabdc9388b9dd5f99125c6bd3dff7aac7610c7094c4fa0b2c7c9c4db

SHA512
a434650e6185dd4b817c6976e49f4f34786639b3e0bfc717a3f44fe5e68805e6bb2917b942abdf91c7d64bea9baaf5efbef454989bda90bb0f241908351edabc

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
43KB

MD5
aa75a1f4b9b9705ba59cb843ced1827d

SHA1
18c300065e09663c5876c12193dadcca761c049e

SHA256
b2a7f9a56293972d3dd6d92488c77d464434d5ee2acb8d773f90a706a55e4586

SHA512
2261324191fbfc2605c7dd7d3363cabbcd8c2ec537c14bfd8935b697e10d3ce1ab44f57d887ad10428c9cc33166c7f3fdca2317a36f7b6739096d06626b8a7d9

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
333KB

MD5
029f050b61bd39114ca8e025f3788f84

SHA1
0b737d863ebd3f2228d5a9e3ee1a0444db93660e

SHA256
a4f7627e59b174be5adca88b195cea94b2ec8413c7c4f3993ac18e191f8c8cb2

SHA512
56e5abc64a62034b7ce49a14ce1a5e85002b76bdaa51e2bec8a1c4f18bb3e49da325d4d360e7e55a59ed709ebaf87c8a3ce4b07aa181a1430f4b49e5f1d43adb

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
333KB

MD5
e01596d332ad0422f2283c7b8ac2b54e

SHA1
9bf5f694bb99e9bfea49bb8bbeeb08894cfac940

SHA256
bf4e7dbb73be1eb212e1320777121db3ed5c161cccb606ebb64d0a9b21709d19

SHA512
888eb73c50e309ca7aff1aa21837297b5b0d6cad470725a3e3efff1db586724b948d3ccec99b7ef740335e0373daf8f5fd1331e915292dfd604cbe15c6b207c1

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
29KB

MD5
311349427a687e40f4bd53af08a71eef

SHA1
880aab0438a22900b96408a46cdb5a547f62b627

SHA256
3e79ae8f9a048a5af1d953cc076927a4d827604a0ab4d8e6036d53049ae608c9

SHA512
2811a5f6a0d4cf2e772e81831b6415cbc5121096539eb8e55bdb143d20344497e1274652a89cb7880f30aa38a21971be2f62e9fcc6c885d569853507be9c8f1b

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
333KB

MD5
e996e91025886fb723afda0fc547ecbb

SHA1
86c6e1c93d2724454155734097d0b8c37a604b15

SHA256
14c83cb80998059fe9986bce4788858a0b5137176d5d1faa46d0be6eef38365a

SHA512
a1bfde0458a364e31a4fd1d07135a2509c6f5cca22e385152a1e662037d9805ded456d28b3d07830472d1ec5f1734746518775a35d3186617759ff4e096a88c4

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
42KB

MD5
ac4552c237a128b916be329485105a11

SHA1
75db06aa6642e8cc6ad10fa8edb2e82bcf987aa6

SHA256
8501835b60e725e54fc06e9dee879313c39ba6a37692b322c910a9249dd34d9f

SHA512
70883d16b89ebb56c7c4a8c59ce803ee514cbf3fc9724a360ed6409bc809d280329603ce10278e408c3492dcccaff264250d7ae13953248fb67c9f884bfe7a48

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
333KB

MD5
dfe78d7850a108e8e8b2fb455a21d84c

SHA1
8159c4b3824102300e4fc2df46e45c20617e725f

SHA256
c326f3a479e96b3bed862e233d65160bdd3ed6b7d8b731e225de5f7cf63df250

SHA512
8ca1f8807ddc67af5ae0ceff97008063312dc289565a8b52f96a69da80449550eaefaa09fb867b746c16106e97c4f0a1a717345c7dc0d71d5591f792d0808ec5

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
333KB

MD5
40bb904e36fba076308ead27200dea0d

SHA1
2b5c3d1afa59b0aa46d11ce9124781df22199513

SHA256
5f836b70bbeb03ffc8f62b7073e5cc2c6d14f633764088baaf9827d380e4db07

SHA512
8f720b84f2810d922b1ba73b98ab906c322d0c4bc476f76f7c94864a72f4b7a4206198cc3a75a9653464b705865194255d8f1cd800403c3e9805daab83d48833

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
333KB

MD5
29b059bf0fe11c8c8e0bcd105c3e35a2

SHA1
d5480b3fc55e6d073d9b5c224c543bb5669bdacd

SHA256
c6ef135c0c18a96aab37a4f88a1b831483da1d5397f1c6c17b5b4b0a8c2a8269

SHA512
7037394f7ce97fef060f63f0d79a2261412689e7b5159f6dd9e93b6db24cd00399bd6b5ac78f4fd6e3ad3d82bfef746fa4a67b36366550806f28cb5be6b7c1ad

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
333KB

MD5
0163fb9d54e6efe12d6a2a34e2135b3a

SHA1
46cc43a36faab0a0d80457f1a26059a4fca30f74

SHA256
1140a859ae042e6f244739603c88724924e7752ea8343f2f8a478ef8e5b3b354

SHA512
974e681697fed01912bd66a6f677ddb9c0683d1494eee9de1b2a81fded6109d21b38910f75a77738ebb0cf01ede52683ff294c1438b3e939056a9cf307e20ead

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
333KB

MD5
54f86412439f41107b57736d349773a4

SHA1
e1e6130fa4b13d377b401513b026863c631034dc

SHA256
19d9a6a27443e258b01e6c801668b88536522c172a9fc5a1dbb4e5e06267c847

SHA512
fa6088de9f7815aa227c5fecdc70306a87cc98d49e219eef4b4569e3377d30e4107ef9a2d1f54cfd0e06d22983b9ca041690f8b09284d6745b09e3347e02c45d

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
33KB

MD5
1de05b0d2f21d25f78eb9322caf2a83a

SHA1
e4595b81097a565f5c4268a53a56e34763e315ae

SHA256
47b6af339312fc9dcbf290baf99f88fd28eea8a0a6fc5c384d2ab50525068a6b

SHA512
a3c637369e718a08cb852cc43f6b626229b3040e37640895d8d50ba2e2402372cedbc85284b2bec802f9847026bb30ba37b5ff49abd76ef9408c98eb5ea5b1fd

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
333KB

MD5
0cde2494c0dbef7a3735f1edb4762040

SHA1
c23ce11f45567bb1c09db8069d5716867fe73395

SHA256
cb1bba27f5a9c025350a96ea77b609ed864c655101351bd67341da84736e7987

SHA512
209afeca93dd56c03e95070fb316fb1fc3f874009ddac3c36f6abb53907ac12fb35089174cbf53c54da1fd3b3014079137b32414ccb228511d1fc77922217e51

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
333KB

MD5
6534a8a5c391d5f13592579c6bcd4b29

SHA1
759a81274926340905a0a320409188931e39897e

SHA256
48e63a8c1cde887b031fc6f3fb54a309dac9a5fc089131ece2795769a61900f5

SHA512
1170271d4194f84e5cd226ee460131a1c152736151368f1ae2b09fcd786c820a0d58798b9946cbfc03ee51f5077f5932868744eda3e3520741466655a9717b31

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
33KB

MD5
ef154337f4d3d217d6835915a0b90224

SHA1
cf1487b46fbf583359bdc264de07d8a97a632b1f

SHA256
0597d0b54296eafcec0bbbde32d7e46120b97ca894b564ee5ee1438940a3ceb0

SHA512
4f92c9e0e6d3bd6de28c2c49d6d6723bfe1285d0d4283ec5016233d27b8783c9f5e20ff7b68dc2d6c4b9dae0ee825d28ed77db5635582b02f8311762b309dbdd

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
333KB

MD5
00a53a8c7ed688ae85cb2eb6aeafac3a

SHA1
18e1f8cfcbf5a8b91aecffa538009b7f8f5892dd

SHA256
64545b0ede47e91b68baa86c20ab2e890ab6017761d85f6755015ffcde9cfeca

SHA512
55b709c3d43329cf8af77e199a7fb6b7ea9212bb6d8c8bd34e808aa38266c72b1c07900439ab349944236c101ad8dc9522839406eed456209707748a3a663bf2

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
333KB

MD5
a1acbd3429ecd7ae6c76fc047eca2e7b

SHA1
51bb0ad247295b413ae61cf20fcfd9724df9c25b

SHA256
324fdd898369c512db3595e3b42d51da86eb59c637b120e65821989b91cd3e45

SHA512
4e52bfe9a6b47e4c4039e4b63342959384d4e6faf7df915f5ffd064a9f1a288a0a496fb3dfd65501258c7aef1b536b990ed489da8fb630a82830f3ebb43eabd6

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
333KB

MD5
5f0b9aeab90998aae9d0a01992d9317b

SHA1
7d425475be82ba1a0d9e88be2e4764db84169ede

SHA256
74baf05cdb38177f781320a2335d903678dcd155404d2db433a1cf900dcdd4ec

SHA512
ad92edf17f69d0c8f2ea07db442e7722cab9e25bfa1bd7f630a1dea6079a218ce4716c29d3c33fd1271e7291607f8dee776f57fd747d1010fefc17f57b391b54

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
333KB

MD5
e98a2bbb3357bca3a3917abae97920df

SHA1
9cade522a4eaeb97032f0abf3a9ab30bc663c0f9

SHA256
69b13cbd1755dd885cff9a4dea5d2d5bf60937c512b7c5a1b13eb941ad08391b

SHA512
84910506481c42d6473b7802dbce56a64ecb59e1d0d3839d3a8f7446829be1f24a9b4868fb0164fdd283dc9c7777b25d90ac319cc7da644774d9defc149e2280

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
333KB

MD5
7ed3df0f0ae521b7994b2e245a297a83

SHA1
cb22d45589a40d9eb58332be44024f78173b2b86

SHA256
95dcbb7c12738e2f440e3384b41b5216385d29a218fc6a1aeb503321c491d8a2

SHA512
f044010c8a55aa2aed246cc7f08f798ca1eca4e3b48a0cd8fdbb8e740a63a4bafd9afa4bc4ed17464c15b3dc67a5c73891d7c48b4b68272b02ce1d78f16ba6da

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
333KB

MD5
cdd001e7a7293069c4a7fe959c956442

SHA1
e5971ef5f1c1af3bf060248e673f4b46634e60cb

SHA256
2043ff84f7b1312197423787488334dca6fcf7df93bfc0129ef5b28ad3ed9d6f

SHA512
92bc6d422ef4e73018eddd84a4995329c867bef883561197baaca0a0ff01a97af6f62181d8639bfa2237fb4a997d77fa22a723be26c736283e9907aa83071e78

Download Submit
C:\Windows\SysWOW64\Ohkbbn32.exe

Filesize
333KB

MD5
78c561c7b813c1a820d5af2b6518de9a

SHA1
fc06824f14b3ce4e3cc78c2234ad87eb1b8df931

SHA256
fa4fe093624f87865fc6bd903a485bdcf632212f891d13d2afccee9f390ce396

SHA512
bc2c5577f3301acacbc99707c78193f28d271ac00112d88e05e744796e5b5b3e43cc47e3e297b487d4ef39631ff8c451eb6134874c59f22ba2312406408488b5

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
333KB

MD5
d4c44bae209ddb0fb94f20f9159889d0

SHA1
79e6e8f8cd9d53da98777390b08bab91f4be2a60

SHA256
487546416497f4fb6c025fe101d84ed5d9b39e83fe7576d93b59566d7219fbba

SHA512
b5ac61f0a1cbe69a11dd249efa7cae3e115bc2c6729a7a78c8cd85b0476c8d145046c5c5052591dc44479ad75ff42a5191b3250f939fb5827e354fa73934bc64

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
333KB

MD5
c9b27f6117fa6fcc8e9e9f4a3d9714fd

SHA1
6b7bed0422f0ebc0c2ee2c6f727f32755188b415

SHA256
44f811eec3944a9bea9dc155fdaf2da921a2d7bc8d82a29d8f648279d802e23c

SHA512
5e224ac145c9d8409e86603c07c65c2cf9126d9ab4b21afc7065fa67229a5f99f44c1d6d6e3bde084b0588840520ec917d1568f0622f2fbc0d2c088d8ee50f51

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
333KB

MD5
fea32ab122e2c7df4ed126b74a320803

SHA1
50a561d0d5b396a7f211105ca3b4ad5fceb37caa

SHA256
9972c7f53a49c8a9805adb0c388b7fefca393d552b92cda8e98b5ef75406716a

SHA512
ef36361a16ad3deecc6072df2830a782be05bfc29851305288a5d502c27895bbc57fa8e17601dd573fbf32a171b7babe934ba549d8fc7396ccdf178859fabc06

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
333KB

MD5
8cf8a3d838666a100acc3f9808f78e26

SHA1
97955821df071dd3522e5e36c3511c44b5f116cf

SHA256
0d66b3ae4675d52386a77de9565d8f268747e0f4a1b64ca96b51a6aaaded8be7

SHA512
a51dd4f2f1fd4aa63d1e2029708e1890ce41e38f09d41bd199dd28ee1b0f9c4014f6fa5ff39b3f32d5c370d95d0ef9796e74e9ca1e3de938c0cfc27a947a6d5f

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
333KB

MD5
433972671d0684f30f0af4b986035dd2

SHA1
973496808643af51ab73a5483ef5d44be02c23da

SHA256
319ff5a941366089fc2f4f148bd65cad2892aa572738b6b8f7da77360560e3ab

SHA512
0d750aa5e236a413bf5a6270adc5aa0db3774397030b02a3ccadae95b9597cf35c6a24906c671d5f996df2c48a765da51fe47d4ac70b96d7f1aa7069fec93627

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
333KB

MD5
f84939aa8873d6e0dc687e0dd3dbe86e

SHA1
1a0de3d553679360b236638c6550b0fa64ee78f1

SHA256
119472029138f17090d9ad229d24ae28b1462b7d383541a5a0253369f86e6d54

SHA512
bac16e3edfee8ed10620206bb2818e04ba315c88acef0d1bac07e343eac5a622fccd28030249a8e0113621ecac063c139f607e66714dcbd885ed6b7c955e79ca

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
333KB

MD5
54f590e620692b9591f33e81377f6f30

SHA1
26741fc132389777de3de3fac03b204c74e6253b

SHA256
49fcac86a0ca6d44cb0eef93571464ade4f6326572f0627f4de727715aedd83b

SHA512
25553f393a746fd9c86849b521f5799e76c0394289480d6cc1455a6fe79726fa8fee972acbf50b370a5e07dd1f5463369f4e14af7c741912c3fec5679c000a11

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
333KB

MD5
edffccebf5b2b044030acf34a2a71324

SHA1
78b5e664917aa7e35ada2ac49710479dd9760d93

SHA256
30a9d00f897b80001e678a767012cd2f4d149b6334fc7e61efd915842f2f460c

SHA512
7379cc3b5b5025288df50bc6aa6d22750a8be7e84c3d859e1baacdb3f7f9c514c462df5b85f1dfcd6fd5e0992b7d3a42c76e61faa64f5855785463f3a3cf02fb

Download Submit
C:\Windows\SysWOW64\Qofcff32.exe

Filesize
333KB

MD5
dc256138cfbb7aa83495a936f72b1175

SHA1
35fbc8dbd39a75f28a417f914a844255d17bd187

SHA256
3e27b2729670b87ac9e02a11b36518c3521213b002bd98a4d7d03715b515bbe3

SHA512
d18c30a9d4d83b535fbe9eb363ec150904957fcf94d77950107d41d7cce8348a934204f5e12ae355e0050971baea374967c4887a410aab507d8522e04d5970e5

Download Submit
memory/8-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/632-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/704-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/792-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/804-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1284-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1708-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1924-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2252-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2392-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2496-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3232-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3256-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3368-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3728-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3756-130-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3784-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3840-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4284-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4500-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4508-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4528-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4912-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads