2269e6a977fd45c6be3cde8a9afccad3edaf5461f1b27b9922bb7df8707db231

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Proxy.Win32.Qukart.exe
Size

324KB
MD5

ddd3f812933cef50b5ca35c7f18df809
SHA1

543f2d2cdbf1ae690b15f8040692eaf88c677089
SHA256

2269e6a977fd45c6be3cde8a9afccad3edaf5461f1b27b9922bb7df8707db231
SHA512

7a4b0f7f485bd2abdb6465de50dd7fcadebf707b4041fb8b82fc3d2cd06554d36df6f78cd1196531eaf9a959b75e54448a570039341afa5ddc15f8a434cf0046
SSDEEP

3072:rfQ/t0/1FcI483CrxdbMqlWGRdA6sQO56TQY2mEmjwCzAhjQjxNX+W5RK0:rfkt0/Rb3wbWGRdA6sQc/Y+mjwjOx5H

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnagak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhniccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnnkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pckppl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glhonj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlmgopjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edhakj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgdhgmep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hienlpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pomgjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbiejoaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blhpqhlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohjlgefb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inbqhhfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oebflhaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dooaoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghipne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqdaadln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhndljll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okloegjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkenjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boflmdkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjlgdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldjcg32.exe

Executes dropped EXE 64 IoCs

pid	Process
2832	Mcklgm32.exe
1236	Mnapdf32.exe
3060	Mamleegg.exe
764	Mcnhmm32.exe
2136	Mgidml32.exe
3928	Mjhqjg32.exe
1076	Maohkd32.exe
3268	Mpaifalo.exe
3908	Mcpebmkb.exe
4188	Mglack32.exe
4600	Mkgmcjld.exe
2328	Mnfipekh.exe
3320	Maaepd32.exe
4980	Mdpalp32.exe
1492	Mgnnhk32.exe
3968	Njljefql.exe
3932	Nacbfdao.exe
776	Nqfbaq32.exe
1340	Ndbnboqb.exe
1240	Ngpjnkpf.exe
1104	Nklfoi32.exe
1816	Njogjfoj.exe
2816	Nafokcol.exe
1952	Nqiogp32.exe
3504	Ncgkcl32.exe
4456	Ngcgcjnc.exe
1540	Nkncdifl.exe
2280	Nnmopdep.exe
880	Nbhkac32.exe
4004	Nqklmpdd.exe
2640	Ncihikcg.exe
3992	Ngedij32.exe
344	Njcpee32.exe
184	Nnolfdcn.exe
3920	Nbkhfc32.exe
4396	Ndidbn32.exe
3256	Ncldnkae.exe
864	Njfmke32.exe
1408	Nnaikd32.exe
372	Nbmelbid.exe
2256	Nqpego32.exe
5080	Ojhiqefo.exe
2336	Ondeac32.exe
1064	Oqbamo32.exe
3476	Odnnnnfe.exe
2892	Ogljjiei.exe
2104	Okhfjh32.exe
2460	Onfbfc32.exe
4536	Obangb32.exe
2196	Oqdoboli.exe
1068	Odpjcm32.exe
5040	Occkojkm.exe
4664	Okjbpglo.exe
3048	Ojmcld32.exe
2924	Onholckc.exe
536	Obdkma32.exe
3804	Odbgim32.exe
2368	Ocegdjij.exe
2896	Ogaceh32.exe
4472	Okloegjl.exe
1456	Onklabip.exe
4268	Onklabip.exe
404	Obfhba32.exe
2448	Odednmpm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qeffca32.dll	Ifdonfka.exe
File created	C:\Windows\SysWOW64\Cnjpknni.dll	Gfkbde32.exe
File opened for modification	C:\Windows\SysWOW64\Gfbploob.exe	Gohhpe32.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Ncianepl.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Ajanck32.exe
File created	C:\Windows\SysWOW64\Fojedapj.exe	Fgbmccpg.exe
File opened for modification	C:\Windows\SysWOW64\Fedmqk32.exe	Fojedapj.exe
File opened for modification	C:\Windows\SysWOW64\Pomgjn32.exe	Ppjgoaoj.exe
File created	C:\Windows\SysWOW64\Fihgkk32.dll	Lfjfecno.exe
File created	C:\Windows\SysWOW64\Jinpgcmg.dll	Dbllbibl.exe
File opened for modification	C:\Windows\SysWOW64\Hkdbpe32.exe	Gfgjgo32.exe
File created	C:\Windows\SysWOW64\Lmdina32.exe	Lfkaag32.exe
File created	C:\Windows\SysWOW64\Ehfnmfki.dll	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Nohehq32.exe	Nhnlkfpp.exe
File opened for modification	C:\Windows\SysWOW64\Bgbdcgld.exe	Bcghch32.exe
File created	C:\Windows\SysWOW64\Oanfen32.exe	Ojdnid32.exe
File created	C:\Windows\SysWOW64\Libddmim.dll	Bjbndobo.exe
File created	C:\Windows\SysWOW64\Cbjoljdo.exe	Conclk32.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Ffddka32.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File created	C:\Windows\SysWOW64\Plgehm32.dll	Inbqhhfj.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bpdnjple.exe
File opened for modification	C:\Windows\SysWOW64\Odpjcm32.exe	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Efpmmmoo.dll	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Ihqiqn32.dll	Kbbhqn32.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Gbiaapdf.exe	Gokdeeec.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Omjpeo32.exe	Oaqbkn32.exe
File opened for modification	C:\Windows\SysWOW64\Knqepc32.exe	Koodbl32.exe
File created	C:\Windows\SysWOW64\Cdkldb32.exe	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Gojnko32.exe	Gddinf32.exe
File created	C:\Windows\SysWOW64\Headjohq.dll	Mniallpq.exe
File created	C:\Windows\SysWOW64\Empbnb32.dll	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Pickil32.dll	Oaqbkn32.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Okhfjh32.exe	Ogljjiei.exe
File created	C:\Windows\SysWOW64\Jmehcnhg.dll	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Jpphah32.dll	Jfeopj32.exe
File opened for modification	C:\Windows\SysWOW64\Mlefklpj.exe	Mmbfpp32.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Acmflf32.exe
File created	C:\Windows\SysWOW64\Hnagak32.exe	Hghoeqmp.exe
File created	C:\Windows\SysWOW64\Cfapoa32.dll	Bfbaonae.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Caebma32.exe
File opened for modification	C:\Windows\SysWOW64\Cjjcfabm.exe	Cgjjdf32.exe
File created	C:\Windows\SysWOW64\Qnidao32.dll	Idahjg32.exe
File created	C:\Windows\SysWOW64\Pmdpecjm.dll	Iphioh32.exe
File created	C:\Windows\SysWOW64\Ipoopgnf.exe	Icknfcol.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Egjpehcm.dll	Obdkma32.exe
File opened for modification	C:\Windows\SysWOW64\Loeolc32.exe	Lihfcm32.exe
File created	C:\Windows\SysWOW64\Lghcocol.exe	Lnpofnhk.exe
File opened for modification	C:\Windows\SysWOW64\Ljilqnlm.exe	Lgkpdcmi.exe
File created	C:\Windows\SysWOW64\Dfefkkqp.exe	Cjnffjkl.exe
File opened for modification	C:\Windows\SysWOW64\Oqbamo32.exe	Ondeac32.exe
File opened for modification	C:\Windows\SysWOW64\Conclk32.exe	Clpgpp32.exe
File created	C:\Windows\SysWOW64\Paadbk32.dll	Flqimk32.exe
File created	C:\Windows\SysWOW64\Npmagine.exe	Nnneknob.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Aglemn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	7648	WerFault.exe	1050

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjhcgd32.dll"	Gfbploob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egijmegb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gekcaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogpepl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchdhnom.dll"	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emaedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhnlkfpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmqopc32.dll"	Eglgbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqkihfg.dll"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onholckc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphkfg32.dll"	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opakbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lblaabdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknjccol.dll"	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqjbohhg.dll"	Edhakj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edmjfifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eobocb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogljjiei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Keakgpko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haplhc32.dll"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogaceh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggbook32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onkidm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eemgplno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gffonbfe.dll"	Ioopml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgknhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljcnd32.dll"	Cippgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njiekege.dll"	Abbkcpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnidloo.dll"	Bffcpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alfkbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjiol32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cldcmlpl.dll"	Eggmge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Midfokpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbecoe32.dll"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgjbkhen.dll"	Hhnbpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkmnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eidbij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kqbkfkal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkqgckn.dll"	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpphah32.dll"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnjpohk.dll"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leedqpci.dll"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhokgpp.dll"	Gnkaalkd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2832	860	Trojan-Proxy.Win32.Qukart.exe	87
PID 860 wrote to memory of 2832	860	Trojan-Proxy.Win32.Qukart.exe	87
PID 860 wrote to memory of 2832	860	Trojan-Proxy.Win32.Qukart.exe	87
PID 2832 wrote to memory of 1236	2832	Mcklgm32.exe	162
PID 2832 wrote to memory of 1236	2832	Mcklgm32.exe	162
PID 2832 wrote to memory of 1236	2832	Mcklgm32.exe	162
PID 1236 wrote to memory of 3060	1236	Mnapdf32.exe	88
PID 1236 wrote to memory of 3060	1236	Mnapdf32.exe	88
PID 1236 wrote to memory of 3060	1236	Mnapdf32.exe	88
PID 3060 wrote to memory of 764	3060	Mamleegg.exe	161
PID 3060 wrote to memory of 764	3060	Mamleegg.exe	161
PID 3060 wrote to memory of 764	3060	Mamleegg.exe	161
PID 764 wrote to memory of 2136	764	Mcnhmm32.exe	160
PID 764 wrote to memory of 2136	764	Mcnhmm32.exe	160
PID 764 wrote to memory of 2136	764	Mcnhmm32.exe	160
PID 2136 wrote to memory of 3928	2136	Mgidml32.exe	89
PID 2136 wrote to memory of 3928	2136	Mgidml32.exe	89
PID 2136 wrote to memory of 3928	2136	Mgidml32.exe	89
PID 3928 wrote to memory of 1076	3928	Mjhqjg32.exe	159
PID 3928 wrote to memory of 1076	3928	Mjhqjg32.exe	159
PID 3928 wrote to memory of 1076	3928	Mjhqjg32.exe	159
PID 1076 wrote to memory of 3268	1076	Maohkd32.exe	158
PID 1076 wrote to memory of 3268	1076	Maohkd32.exe	158
PID 1076 wrote to memory of 3268	1076	Maohkd32.exe	158
PID 3268 wrote to memory of 3908	3268	Mpaifalo.exe	157
PID 3268 wrote to memory of 3908	3268	Mpaifalo.exe	157
PID 3268 wrote to memory of 3908	3268	Mpaifalo.exe	157
PID 3908 wrote to memory of 4188	3908	Mcpebmkb.exe	156
PID 3908 wrote to memory of 4188	3908	Mcpebmkb.exe	156
PID 3908 wrote to memory of 4188	3908	Mcpebmkb.exe	156
PID 4188 wrote to memory of 4600	4188	Mglack32.exe	90
PID 4188 wrote to memory of 4600	4188	Mglack32.exe	90
PID 4188 wrote to memory of 4600	4188	Mglack32.exe	90
PID 4600 wrote to memory of 2328	4600	Mkgmcjld.exe	155
PID 4600 wrote to memory of 2328	4600	Mkgmcjld.exe	155
PID 4600 wrote to memory of 2328	4600	Mkgmcjld.exe	155
PID 2328 wrote to memory of 3320	2328	Mnfipekh.exe	154
PID 2328 wrote to memory of 3320	2328	Mnfipekh.exe	154
PID 2328 wrote to memory of 3320	2328	Mnfipekh.exe	154
PID 3320 wrote to memory of 4980	3320	Maaepd32.exe	91
PID 3320 wrote to memory of 4980	3320	Maaepd32.exe	91
PID 3320 wrote to memory of 4980	3320	Maaepd32.exe	91
PID 4980 wrote to memory of 1492	4980	Mdpalp32.exe	153
PID 4980 wrote to memory of 1492	4980	Mdpalp32.exe	153
PID 4980 wrote to memory of 1492	4980	Mdpalp32.exe	153
PID 1492 wrote to memory of 3968	1492	Mgnnhk32.exe	92
PID 1492 wrote to memory of 3968	1492	Mgnnhk32.exe	92
PID 1492 wrote to memory of 3968	1492	Mgnnhk32.exe	92
PID 3968 wrote to memory of 3932	3968	Njljefql.exe	152
PID 3968 wrote to memory of 3932	3968	Njljefql.exe	152
PID 3968 wrote to memory of 3932	3968	Njljefql.exe	152
PID 3932 wrote to memory of 776	3932	Nacbfdao.exe	151
PID 3932 wrote to memory of 776	3932	Nacbfdao.exe	151
PID 3932 wrote to memory of 776	3932	Nacbfdao.exe	151
PID 776 wrote to memory of 1340	776	Nqfbaq32.exe	93
PID 776 wrote to memory of 1340	776	Nqfbaq32.exe	93
PID 776 wrote to memory of 1340	776	Nqfbaq32.exe	93
PID 1340 wrote to memory of 1240	1340	Ndbnboqb.exe	150
PID 1340 wrote to memory of 1240	1340	Ndbnboqb.exe	150
PID 1340 wrote to memory of 1240	1340	Ndbnboqb.exe	150
PID 1240 wrote to memory of 1104	1240	Ngpjnkpf.exe	149
PID 1240 wrote to memory of 1104	1240	Ngpjnkpf.exe	149
PID 1240 wrote to memory of 1104	1240	Ngpjnkpf.exe	149
PID 1104 wrote to memory of 1816	1104	Nklfoi32.exe	94

C:\Users\Admin\AppData\Local\Temp\Trojan-Proxy.Win32.Qukart.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Proxy.Win32.Qukart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\Mcklgm32.exe
  C:\Windows\system32\Mcklgm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\Mnapdf32.exe
    C:\Windows\system32\Mnapdf32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1236

C:\Windows\SysWOW64\Mamleegg.exe
C:\Windows\system32\Mamleegg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\Mcnhmm32.exe
  C:\Windows\system32\Mcnhmm32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:764

C:\Windows\SysWOW64\Mjhqjg32.exe
C:\Windows\system32\Mjhqjg32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\Maohkd32.exe
  C:\Windows\system32\Maohkd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1076

C:\Windows\SysWOW64\Mkgmcjld.exe
C:\Windows\system32\Mkgmcjld.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\Mnfipekh.exe
  C:\Windows\system32\Mnfipekh.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2328

C:\Windows\SysWOW64\Mdpalp32.exe
C:\Windows\system32\Mdpalp32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\Mgnnhk32.exe
  C:\Windows\system32\Mgnnhk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1492

C:\Windows\SysWOW64\Njljefql.exe
C:\Windows\system32\Njljefql.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\Nacbfdao.exe
  C:\Windows\system32\Nacbfdao.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3932

C:\Windows\SysWOW64\Ndbnboqb.exe
C:\Windows\system32\Ndbnboqb.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\Ngpjnkpf.exe
  C:\Windows\system32\Ngpjnkpf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1240

C:\Windows\SysWOW64\Njogjfoj.exe
C:\Windows\system32\Njogjfoj.exe
1⤵
- Executes dropped EXE
PID:1816
- C:\Windows\SysWOW64\Nafokcol.exe
  C:\Windows\system32\Nafokcol.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- - C:\Windows\SysWOW64\Ffmfchle.exe
    C:\Windows\system32\Ffmfchle.exe
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\Fmfnpa32.exe
      C:\Windows\system32\Fmfnpa32.exe
      4⤵
      PID:3152
    - - C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        5⤵
        
        PID:2640

C:\Windows\SysWOW64\Ncgkcl32.exe
C:\Windows\system32\Ncgkcl32.exe
1⤵
- Executes dropped EXE
PID:3504
- C:\Windows\SysWOW64\Ngcgcjnc.exe
  C:\Windows\system32\Ngcgcjnc.exe
  2⤵
  - Executes dropped EXE
  PID:4456

C:\Windows\SysWOW64\Nbmelbid.exe
C:\Windows\system32\Nbmelbid.exe
1⤵
- Executes dropped EXE
PID:372
- C:\Windows\SysWOW64\Nqpego32.exe
  C:\Windows\system32\Nqpego32.exe
  2⤵
  - Executes dropped EXE
  PID:2256

C:\Windows\SysWOW64\Oqbamo32.exe
C:\Windows\system32\Oqbamo32.exe
1⤵
- Executes dropped EXE
PID:1064
- C:\Windows\SysWOW64\Odnnnnfe.exe
  C:\Windows\system32\Odnnnnfe.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Windows\SysWOW64\Hienlpel.exe
    C:\Windows\system32\Hienlpel.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:1140

C:\Windows\SysWOW64\Obangb32.exe
C:\Windows\system32\Obangb32.exe
1⤵
- Executes dropped EXE
PID:4536
- C:\Windows\SysWOW64\Oqdoboli.exe
  C:\Windows\system32\Oqdoboli.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2196
- C:\Windows\SysWOW64\Bblnindg.exe
  C:\Windows\system32\Bblnindg.exe
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\Cbbdjm32.exe
    C:\Windows\system32\Cbbdjm32.exe
    3⤵
    PID:2916

C:\Windows\SysWOW64\Obdkma32.exe
C:\Windows\system32\Obdkma32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:536
- C:\Windows\SysWOW64\Odbgim32.exe
  C:\Windows\system32\Odbgim32.exe
  2⤵
  - Executes dropped EXE
  PID:3804

C:\Windows\SysWOW64\Obfhba32.exe
C:\Windows\system32\Obfhba32.exe
1⤵
- Executes dropped EXE
PID:404
- C:\Windows\SysWOW64\Odednmpm.exe
  C:\Windows\system32\Odednmpm.exe
  2⤵
  - Executes dropped EXE
  PID:2448

C:\Windows\SysWOW64\Obidhaog.exe
C:\Windows\system32\Obidhaog.exe
1⤵
PID:4576
- C:\Windows\SysWOW64\Oqkdcn32.exe
  C:\Windows\system32\Oqkdcn32.exe
  2⤵
  PID:2396

C:\Windows\SysWOW64\Pjdilcla.exe
C:\Windows\system32\Pjdilcla.exe
1⤵
PID:1052
- C:\Windows\SysWOW64\Pnpemb32.exe
  C:\Windows\system32\Pnpemb32.exe
  2⤵
  PID:2064

C:\Windows\SysWOW64\Peimil32.exe
C:\Windows\system32\Peimil32.exe
1⤵
PID:5028
- C:\Windows\SysWOW64\Pclneicb.exe
  C:\Windows\system32\Pclneicb.exe
  2⤵
  PID:648
- - C:\Windows\SysWOW64\Qbgqio32.exe
    C:\Windows\system32\Qbgqio32.exe
    3⤵
    PID:2148
  - - C:\Windows\SysWOW64\Qeemej32.exe
      C:\Windows\system32\Qeemej32.exe
      4⤵
      PID:3832
    - - C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        5⤵
        
        PID:2500
      - C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        6⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        7⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        8⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        9⤵
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        10⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        11⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        12⤵
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        13⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        14⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        15⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        16⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        17⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        18⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        19⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        20⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        21⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        22⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        23⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        24⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        25⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        26⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        27⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        28⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        29⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        30⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        31⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        32⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        33⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        34⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        35⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        36⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        37⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        38⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        39⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        40⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        41⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        42⤵
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        43⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        44⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        45⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        46⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        47⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        48⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        49⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        50⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        51⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        52⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        53⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        54⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        55⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        56⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        57⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        58⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        59⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        60⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        61⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        62⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        63⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3652
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        65⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        66⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        67⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        68⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        69⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        70⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        71⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        72⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        73⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        74⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        75⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        77⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4552
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        79⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        80⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        81⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        82⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        83⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        84⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        85⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        86⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        87⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        88⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        89⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        90⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        91⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        93⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        94⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        96⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        97⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        98⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        99⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        100⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        101⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        102⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        103⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        104⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        105⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        106⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        107⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        108⤵
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        109⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        110⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        111⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        112⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        113⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        114⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        115⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        116⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        117⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        118⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        119⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        121⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        122⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        123⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        124⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        125⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        126⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        127⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        128⤵
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        129⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        130⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        131⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        132⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        134⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        135⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        136⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        137⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        138⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        139⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7448
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        141⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        142⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        143⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        144⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        145⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        146⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        147⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        148⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        149⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        150⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        151⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        152⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        153⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        154⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        155⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        156⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        157⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        158⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        159⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        160⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        161⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        163⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        164⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        165⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        166⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        167⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        168⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        169⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        170⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        171⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        172⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        173⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        174⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        175⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        176⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        178⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        179⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        181⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        183⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        184⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        185⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        186⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        188⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        189⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        190⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        191⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        192⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        193⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        194⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        195⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        196⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        197⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        198⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        199⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        200⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        201⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8476
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        203⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        204⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        205⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        206⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        207⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        208⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        209⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        210⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        211⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        212⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        213⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        214⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        215⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        216⤵
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        217⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        219⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        220⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8264
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        222⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        223⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        224⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        225⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        226⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        227⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        228⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        229⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        230⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        231⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        233⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        234⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        235⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        186⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        137⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        138⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        139⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        140⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        105⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        106⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3268
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        108⤵
        Drops file in System32 directory
        
        PID:4940
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        109⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        110⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        111⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        112⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        97⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        98⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        99⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        81⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        82⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        83⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        84⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        73⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        74⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        44⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        45⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        46⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        31⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        30⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        7⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        8⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        9⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        10⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        11⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        12⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        13⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        14⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        15⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        16⤵
        
        PID:5504

C:\Windows\SysWOW64\Pqnaim32.exe
C:\Windows\system32\Pqnaim32.exe
1⤵
PID:4860

C:\Windows\SysWOW64\Pbkamqmd.exe
C:\Windows\system32\Pbkamqmd.exe
1⤵
PID:2204

C:\Windows\SysWOW64\Pgemphmn.exe
C:\Windows\system32\Pgemphmn.exe
1⤵
PID:1772

C:\Windows\SysWOW64\Odgqdlnj.exe
C:\Windows\system32\Odgqdlnj.exe
1⤵
PID:2804

C:\Windows\SysWOW64\Ojalgcnd.exe
C:\Windows\system32\Ojalgcnd.exe
1⤵
PID:4508

C:\Windows\SysWOW64\Okolkg32.exe
C:\Windows\system32\Okolkg32.exe
1⤵
PID:3716

C:\Windows\SysWOW64\Ocgdji32.exe
C:\Windows\system32\Ocgdji32.exe
1⤵
PID:3520

C:\Windows\SysWOW64\Onklabip.exe
C:\Windows\system32\Onklabip.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\SysWOW64\Onklabip.exe
C:\Windows\system32\Onklabip.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\SysWOW64\Okloegjl.exe
C:\Windows\system32\Okloegjl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4472

C:\Windows\SysWOW64\Ogaceh32.exe
C:\Windows\system32\Ogaceh32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2896

C:\Windows\SysWOW64\Ocegdjij.exe
C:\Windows\system32\Ocegdjij.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\SysWOW64\Onholckc.exe
C:\Windows\system32\Onholckc.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2924

C:\Windows\SysWOW64\Ojmcld32.exe
C:\Windows\system32\Ojmcld32.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWOW64\Okjbpglo.exe
C:\Windows\system32\Okjbpglo.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\SysWOW64\Occkojkm.exe
C:\Windows\system32\Occkojkm.exe
1⤵
- Executes dropped EXE
PID:5040
- C:\Windows\SysWOW64\Qachgk32.exe
  C:\Windows\system32\Qachgk32.exe
  2⤵
  PID:5520

C:\Windows\SysWOW64\Odpjcm32.exe
C:\Windows\system32\Odpjcm32.exe
1⤵
- Executes dropped EXE
PID:1068

C:\Windows\SysWOW64\Onfbfc32.exe
C:\Windows\system32\Onfbfc32.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\SysWOW64\Okhfjh32.exe
C:\Windows\system32\Okhfjh32.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\SysWOW64\Ogljjiei.exe
C:\Windows\system32\Ogljjiei.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2892

C:\Windows\SysWOW64\Ondeac32.exe
C:\Windows\system32\Ondeac32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2336

C:\Windows\SysWOW64\Ojhiqefo.exe
C:\Windows\system32\Ojhiqefo.exe
1⤵
- Executes dropped EXE
PID:5080
- C:\Windows\SysWOW64\Bjpjel32.exe
  C:\Windows\system32\Bjpjel32.exe
  2⤵
  PID:4536

C:\Windows\SysWOW64\Nnaikd32.exe
C:\Windows\system32\Nnaikd32.exe
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\SysWOW64\Njfmke32.exe
C:\Windows\system32\Njfmke32.exe
1⤵
- Executes dropped EXE
PID:864

C:\Windows\SysWOW64\Ncldnkae.exe
C:\Windows\system32\Ncldnkae.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\SysWOW64\Ndidbn32.exe
C:\Windows\system32\Ndidbn32.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\SysWOW64\Nbkhfc32.exe
C:\Windows\system32\Nbkhfc32.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWOW64\Nnolfdcn.exe
C:\Windows\system32\Nnolfdcn.exe
1⤵
- Executes dropped EXE
PID:184

C:\Windows\SysWOW64\Njcpee32.exe
C:\Windows\system32\Njcpee32.exe
1⤵
- Executes dropped EXE
PID:344

C:\Windows\SysWOW64\Ngedij32.exe
C:\Windows\system32\Ngedij32.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\SysWOW64\Ncihikcg.exe
C:\Windows\system32\Ncihikcg.exe
1⤵
- Executes dropped EXE
PID:2640
- C:\Windows\SysWOW64\Fdepgkgj.exe
  C:\Windows\system32\Fdepgkgj.exe
  2⤵
  PID:5596

C:\Windows\SysWOW64\Nqklmpdd.exe
C:\Windows\system32\Nqklmpdd.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\SysWOW64\Nbhkac32.exe
C:\Windows\system32\Nbhkac32.exe
1⤵
- Executes dropped EXE
PID:880

C:\Windows\SysWOW64\Nnmopdep.exe
C:\Windows\system32\Nnmopdep.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2280

C:\Windows\SysWOW64\Nkncdifl.exe
C:\Windows\system32\Nkncdifl.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\SysWOW64\Nqiogp32.exe
C:\Windows\system32\Nqiogp32.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\SysWOW64\Nklfoi32.exe
C:\Windows\system32\Nklfoi32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\Nqfbaq32.exe
C:\Windows\system32\Nqfbaq32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\Maaepd32.exe
C:\Windows\system32\Maaepd32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\Mglack32.exe
C:\Windows\system32\Mglack32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\Mcpebmkb.exe
C:\Windows\system32\Mcpebmkb.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\Mpaifalo.exe
C:\Windows\system32\Mpaifalo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\Mgidml32.exe
C:\Windows\system32\Mgidml32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\Mgimcebb.exe
C:\Windows\system32\Mgimcebb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8844
- C:\Windows\SysWOW64\Melnob32.exe
  C:\Windows\system32\Melnob32.exe
  2⤵
  PID:8796
- - C:\Windows\SysWOW64\Mmbfpp32.exe
    C:\Windows\system32\Mmbfpp32.exe
    3⤵
    - Drops file in System32 directory
    PID:8892
  - - C:\Windows\SysWOW64\Mlefklpj.exe
      C:\Windows\system32\Mlefklpj.exe
      4⤵
      Modifies registry class
      PID:9036
    - - C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        5⤵
        Modifies registry class
        
        PID:9096
      - C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        6⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        7⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        8⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        9⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        10⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8968
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        12⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        13⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        14⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8716
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        16⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        17⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        18⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        19⤵
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        20⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        21⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        22⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        23⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        24⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        25⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        26⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        27⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        28⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        29⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        30⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        31⤵
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        32⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        34⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        35⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        36⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        37⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        38⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        39⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9884
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        41⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        42⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        43⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        44⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        45⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        46⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        47⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        48⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        49⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        50⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        51⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        52⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        53⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        54⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        55⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        56⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        57⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9852
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        59⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        60⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        61⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        62⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        63⤵
        Drops file in System32 directory
        
        PID:10196
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        64⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        65⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        67⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        68⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        69⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9916
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        71⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        72⤵
        Drops file in System32 directory
        
        PID:10116
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        73⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        74⤵
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        75⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        76⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        77⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9316
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        80⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        81⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        82⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        83⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        84⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        85⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        86⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        87⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10316
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        89⤵
        Drops file in System32 directory
        
        PID:10360
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        90⤵
        Drops file in System32 directory
        
        PID:10400
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        91⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        92⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        93⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        94⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        95⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        96⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        97⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        98⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        99⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        100⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        101⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        102⤵
        Modifies registry class
        
        PID:10916
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        103⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        104⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        105⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        106⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        107⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        108⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        109⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        110⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        111⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        112⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        113⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        114⤵
        Drops file in System32 directory
        
        PID:10424
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        115⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        116⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        117⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        118⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        119⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        120⤵
        Drops file in System32 directory
        
        PID:10820
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        121⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        122⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        123⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        124⤵
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        125⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        126⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        127⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        128⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        129⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        130⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        131⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        132⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        133⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        134⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        135⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        136⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        137⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        138⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        139⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        140⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        141⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        142⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        143⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        144⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        145⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        146⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        147⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        148⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        149⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        150⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        151⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        152⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        153⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        154⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        155⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11504
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        157⤵
        Modifies registry class
        
        PID:11544
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        158⤵
        Modifies registry class
        
        PID:11584
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        159⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        160⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        161⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        162⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        163⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        164⤵
        Modifies registry class
        
        PID:11832
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        165⤵
        Modifies registry class
        
        PID:11872
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        166⤵
        Modifies registry class
        
        PID:11920
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        167⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        168⤵
        Modifies registry class
        
        PID:12004
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        169⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        170⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        171⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        172⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        173⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        174⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        175⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        176⤵
        Drops file in System32 directory
        
        PID:11296
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        177⤵
        Drops file in System32 directory
        
        PID:11368
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        178⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        179⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        180⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        181⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        182⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        183⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        184⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        185⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        186⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        187⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        188⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        189⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        190⤵
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11328
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        192⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        193⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        194⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        195⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        196⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        197⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        198⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        199⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        200⤵
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        201⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        202⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        203⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        204⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        205⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        206⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        207⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        208⤵
        Drops file in System32 directory
        
        PID:11404
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11752
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        210⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        211⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        212⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        213⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        214⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        215⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        216⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        217⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        218⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        219⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        220⤵
        Modifies registry class
        
        PID:12336
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        221⤵
        Modifies registry class
        
        PID:12372
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        222⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        223⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        224⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        225⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        226⤵
        Drops file in System32 directory
        
        PID:12552
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        227⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        228⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        229⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        230⤵
        Modifies registry class
        
        PID:12696
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12732
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        232⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        233⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        234⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        235⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        236⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        237⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        238⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        239⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        240⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        241⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        242⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        243⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13204
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        245⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        246⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        247⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        248⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        249⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        250⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        251⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        252⤵
        Modifies registry class
        
        PID:12612
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        253⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        254⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        255⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        256⤵
        Modifies registry class
        
        PID:12868
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        257⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        258⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        259⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        260⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        261⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        262⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        263⤵
        Modifies registry class
        
        PID:12328
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        264⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        265⤵
        Drops file in System32 directory
        
        PID:12540
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        266⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        267⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        268⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        269⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        270⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        272⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        273⤵
        Modifies registry class
        
        PID:13048
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        274⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        275⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        276⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        277⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12848
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        279⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        280⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        281⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        282⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        283⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        284⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        285⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13236
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        287⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        288⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        289⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        290⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        291⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        292⤵
        
        PID:13424
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        293⤵
        Modifies registry class
        
        PID:13460
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13512
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        295⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        296⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        297⤵
        
        PID:13640
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        298⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        299⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        300⤵
        Drops file in System32 directory
        
        PID:13772
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13828
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        302⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13924
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        304⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        305⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        306⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        307⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        308⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        309⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        310⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14216
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        312⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        313⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        314⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12404
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        316⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13416
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        318⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        319⤵
        Drops file in System32 directory
        
        PID:13532
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        320⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        321⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        322⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        323⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        324⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        325⤵
        Drops file in System32 directory
        
        PID:13868
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        326⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        327⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        328⤵
        Modifies registry class
        
        PID:14056
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        329⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        330⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        331⤵
        
        PID:14260
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        332⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        333⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        334⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        335⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        336⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        337⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        338⤵
        Modifies registry class
        
        PID:13844
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        339⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        340⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        341⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        342⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        343⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        344⤵
        
        PID:13488
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        345⤵
        
        PID:13768
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        346⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        347⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        348⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        349⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        350⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        351⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        352⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        353⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        354⤵
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        355⤵
        
        PID:14344
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        356⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        357⤵
        
        PID:14416
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        358⤵
        
        PID:14452
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        359⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        360⤵
        
        PID:14524
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        361⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        362⤵
        
        PID:14596
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        363⤵
        
        PID:14632
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        364⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        365⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        366⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        367⤵
        
        PID:14776
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        368⤵
        
        PID:14812
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        369⤵
        
        PID:14848
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14884
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        371⤵
        
        PID:14924
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        372⤵
        
        PID:14960
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        373⤵
        
        PID:15000
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        374⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:15072
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        376⤵
        
        PID:15108
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        377⤵
        
        PID:15144
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:15180
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        379⤵
        
        PID:15216
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        380⤵
        
        PID:15252
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        381⤵
        
        PID:15288
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        382⤵
        Modifies registry class
        
        PID:15324
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        383⤵
        Modifies registry class
        
        PID:12204
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        384⤵
        Drops file in System32 directory
        
        PID:14400
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        385⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        386⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        387⤵
        
        PID:14584
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        388⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        389⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        390⤵
        Drops file in System32 directory
        
        PID:14796
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14904
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        392⤵
        Modifies registry class
        
        PID:14996
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        393⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        394⤵
        Drops file in System32 directory
        
        PID:15152
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        395⤵
        
        PID:15236
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        396⤵
        
        PID:15356
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        397⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        398⤵
        
        PID:14728
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        399⤵
        
        PID:14868
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        400⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        401⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        402⤵
        Drops file in System32 directory
        
        PID:15208
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        403⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        404⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14836
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        406⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        407⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        408⤵
        
        PID:14652
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        409⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        410⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        411⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        412⤵
        
        PID:4888

C:\Windows\SysWOW64\Oihagaji.exe
C:\Windows\system32\Oihagaji.exe
1⤵
PID:3280
- C:\Windows\SysWOW64\Pefhlaie.exe
  C:\Windows\system32\Pefhlaie.exe
  2⤵
  PID:4500

C:\Windows\SysWOW64\Ohiemobf.exe
C:\Windows\system32\Ohiemobf.exe
1⤵
PID:4548

C:\Windows\SysWOW64\Objpoh32.exe
C:\Windows\system32\Objpoh32.exe
1⤵
PID:1344

C:\Windows\SysWOW64\Nolgijpk.exe
C:\Windows\system32\Nolgijpk.exe
1⤵
PID:2772

C:\Windows\SysWOW64\Nbcjnilj.exe
C:\Windows\system32\Nbcjnilj.exe
1⤵
PID:1756

C:\Windows\SysWOW64\Pkenjh32.exe
C:\Windows\system32\Pkenjh32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2756
- C:\Windows\SysWOW64\Aeddnp32.exe
  C:\Windows\system32\Aeddnp32.exe
  2⤵
  PID:448
- - C:\Windows\SysWOW64\Aakebqbj.exe
    C:\Windows\system32\Aakebqbj.exe
    3⤵
    PID:1060
  - - C:\Windows\SysWOW64\Ajbmdn32.exe
      C:\Windows\system32\Ajbmdn32.exe
      4⤵
      PID:1240
    - - C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        5⤵
        
        PID:4564
      - C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        6⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        7⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        8⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        9⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        10⤵
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2136
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4100
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        13⤵
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        14⤵
        
        PID:5080

C:\Windows\SysWOW64\Cjnffjkl.exe
C:\Windows\system32\Cjnffjkl.exe
1⤵
- Drops file in System32 directory
PID:1644
- C:\Windows\SysWOW64\Dfefkkqp.exe
  C:\Windows\system32\Dfefkkqp.exe
  2⤵
  PID:3220

C:\Windows\SysWOW64\Cofecami.exe
C:\Windows\system32\Cofecami.exe
1⤵
PID:3884

C:\Windows\SysWOW64\Ebhglj32.exe
C:\Windows\system32\Ebhglj32.exe
1⤵
PID:1356
- C:\Windows\SysWOW64\Emmkiclm.exe
  C:\Windows\system32\Emmkiclm.exe
  2⤵
  PID:3756

C:\Windows\SysWOW64\Efepbi32.exe
C:\Windows\system32\Efepbi32.exe
1⤵
PID:3300
- C:\Windows\SysWOW64\Elbhjp32.exe
  C:\Windows\system32\Elbhjp32.exe
  2⤵
  PID:2816

C:\Windows\SysWOW64\Efafgifc.exe
C:\Windows\system32\Efafgifc.exe
1⤵
PID:3344

C:\Windows\SysWOW64\Dflmlj32.exe
C:\Windows\system32\Dflmlj32.exe
1⤵
PID:4756

C:\Windows\SysWOW64\Dmdhcddh.exe
C:\Windows\system32\Dmdhcddh.exe
1⤵
PID:2264

C:\Windows\SysWOW64\Gbmingjo.exe
C:\Windows\system32\Gbmingjo.exe
1⤵
PID:5840
- C:\Windows\SysWOW64\Gigaka32.exe
  C:\Windows\system32\Gigaka32.exe
  2⤵
  PID:4932

C:\Windows\SysWOW64\Gljgbllj.exe
C:\Windows\system32\Gljgbllj.exe
1⤵
PID:2380
- C:\Windows\SysWOW64\Gfokoelp.exe
  C:\Windows\system32\Gfokoelp.exe
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\Gingkqkd.exe
    C:\Windows\system32\Gingkqkd.exe
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\Gbfldf32.exe
      C:\Windows\system32\Gbfldf32.exe
      4⤵
      PID:5528
    - - C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        5⤵
        
        PID:5268

C:\Windows\SysWOW64\Gfkbde32.exe
C:\Windows\system32\Gfkbde32.exe
1⤵
- Drops file in System32 directory
PID:3352

C:\Windows\SysWOW64\Fbjmhh32.exe
C:\Windows\system32\Fbjmhh32.exe
1⤵
PID:1084

C:\Windows\SysWOW64\Idahjg32.exe
C:\Windows\system32\Idahjg32.exe
1⤵
- Drops file in System32 directory
PID:1972
- C:\Windows\SysWOW64\Iphioh32.exe
  C:\Windows\system32\Iphioh32.exe
  2⤵
  - Drops file in System32 directory
  PID:5248
- - C:\Windows\SysWOW64\Inlihl32.exe
    C:\Windows\system32\Inlihl32.exe
    3⤵
    PID:5200
  - - C:\Windows\SysWOW64\Icknfcol.exe
      C:\Windows\system32\Icknfcol.exe
      4⤵
      Drops file in System32 directory
      PID:5472
    - - C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        5⤵
        
        PID:5140

C:\Windows\SysWOW64\Hmbfbn32.exe
C:\Windows\system32\Hmbfbn32.exe
1⤵
PID:5604

C:\Windows\SysWOW64\Hpofii32.exe
C:\Windows\system32\Hpofii32.exe
1⤵
PID:6004

C:\Windows\SysWOW64\Hmnmgnoh.exe
C:\Windows\system32\Hmnmgnoh.exe
1⤵
PID:3476

C:\Windows\SysWOW64\Jgeghp32.exe
C:\Windows\system32\Jgeghp32.exe
1⤵
PID:6056
- C:\Windows\SysWOW64\Knooej32.exe
  C:\Windows\system32\Knooej32.exe
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\Kggcnoic.exe
    C:\Windows\system32\Kggcnoic.exe
    3⤵
    PID:4568
  - - C:\Windows\SysWOW64\Kdkdgchl.exe
      C:\Windows\system32\Kdkdgchl.exe
      4⤵
      PID:6480

C:\Windows\SysWOW64\Jcgnbaeo.exe
C:\Windows\system32\Jcgnbaeo.exe
1⤵
PID:6232

C:\Windows\SysWOW64\Kkgiimng.exe
C:\Windows\system32\Kkgiimng.exe
1⤵
PID:1324
- C:\Windows\SysWOW64\Kqdaadln.exe
  C:\Windows\system32\Kqdaadln.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6728
- - C:\Windows\SysWOW64\Kmkbfeab.exe
    C:\Windows\system32\Kmkbfeab.exe
    3⤵
    - Modifies registry class
    PID:6832
  - - C:\Windows\SysWOW64\Lddgmbpb.exe
      C:\Windows\system32\Lddgmbpb.exe
      4⤵
      PID:6924
    - - C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        5⤵
        
        PID:5380

C:\Windows\SysWOW64\Knchpiom.exe
C:\Windows\system32\Knchpiom.exe
1⤵
PID:6560

C:\Windows\SysWOW64\Nnkpnclp.exe
C:\Windows\system32\Nnkpnclp.exe
1⤵
PID:6244

C:\Windows\SysWOW64\Njinmf32.exe
C:\Windows\system32\Njinmf32.exe
1⤵
PID:6904

C:\Windows\SysWOW64\Mgehfkop.exe
C:\Windows\system32\Mgehfkop.exe
1⤵
PID:4796

C:\Windows\SysWOW64\Albpkc32.exe
C:\Windows\system32\Albpkc32.exe
1⤵
PID:7136
- C:\Windows\SysWOW64\Bepmoh32.exe
  C:\Windows\system32\Bepmoh32.exe
  2⤵
  PID:7256

C:\Windows\SysWOW64\Aonoao32.exe
C:\Windows\system32\Aonoao32.exe
1⤵
PID:5208

C:\Windows\SysWOW64\Amjillkj.exe
C:\Windows\system32\Amjillkj.exe
1⤵
PID:7120

C:\Windows\SysWOW64\Dooaoj32.exe
C:\Windows\system32\Dooaoj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2040
- C:\Windows\SysWOW64\Eecphp32.exe
  C:\Windows\system32\Eecphp32.exe
  2⤵
  PID:7620

C:\Windows\SysWOW64\Cohkokgj.exe
C:\Windows\system32\Cohkokgj.exe
1⤵
PID:7976

C:\Windows\SysWOW64\Fpgpgfmh.exe
C:\Windows\system32\Fpgpgfmh.exe
1⤵
PID:5760
- C:\Windows\SysWOW64\Iohejo32.exe
  C:\Windows\system32\Iohejo32.exe
  2⤵
  PID:5180
- - C:\Windows\SysWOW64\Ilqoobdd.exe
    C:\Windows\system32\Ilqoobdd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:512
  - - C:\Windows\SysWOW64\Jpaekqhh.exe
      C:\Windows\system32\Jpaekqhh.exe
      4⤵
      PID:5700
    - - C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        5⤵
        
        PID:8580

C:\Windows\SysWOW64\Kgkfnh32.exe
C:\Windows\system32\Kgkfnh32.exe
1⤵
PID:5164
- C:\Windows\SysWOW64\Kjjbjd32.exe
  C:\Windows\system32\Kjjbjd32.exe
  2⤵
  PID:5732
- - C:\Windows\SysWOW64\Kpcjgnhb.exe
    C:\Windows\system32\Kpcjgnhb.exe
    3⤵
    PID:5352
  - - C:\Windows\SysWOW64\Kofkbk32.exe
      C:\Windows\system32\Kofkbk32.exe
      4⤵
      PID:8328

C:\Windows\SysWOW64\Knqepc32.exe
C:\Windows\system32\Knqepc32.exe
1⤵
PID:7736

C:\Windows\SysWOW64\Koodbl32.exe
C:\Windows\system32\Koodbl32.exe
1⤵
- Drops file in System32 directory
PID:3788

C:\Windows\SysWOW64\Kjblje32.exe
C:\Windows\system32\Kjblje32.exe
1⤵
PID:2604

C:\Windows\SysWOW64\Jlolpq32.exe
C:\Windows\system32\Jlolpq32.exe
1⤵
PID:5156

C:\Windows\SysWOW64\Kcbfcigf.exe
C:\Windows\system32\Kcbfcigf.exe
1⤵
- Modifies registry class
PID:3460

C:\Windows\SysWOW64\Lflbkcll.exe
C:\Windows\system32\Lflbkcll.exe
1⤵
PID:3312
- C:\Windows\SysWOW64\Ljhnlb32.exe
  C:\Windows\system32\Ljhnlb32.exe
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\Lncjlq32.exe
    C:\Windows\system32\Lncjlq32.exe
    3⤵
    PID:9196
  - - C:\Windows\SysWOW64\Mqafhl32.exe
      C:\Windows\system32\Mqafhl32.exe
      4⤵
      PID:8836
    - - C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        5⤵
        
        PID:6588
      - C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        6⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        7⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        8⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        9⤵
        
        PID:6984

C:\Windows\SysWOW64\Mmkdcm32.exe
C:\Windows\system32\Mmkdcm32.exe
1⤵
PID:532
- C:\Windows\SysWOW64\Mcelpggq.exe
  C:\Windows\system32\Mcelpggq.exe
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\Mgphpe32.exe
    C:\Windows\system32\Mgphpe32.exe
    3⤵
    PID:8272
  - - C:\Windows\SysWOW64\Mfchlbfd.exe
      C:\Windows\system32\Mfchlbfd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7088
    - - C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
      - C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        6⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        7⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        8⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        9⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        10⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        11⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        13⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        14⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        15⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        16⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        17⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        18⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        19⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        20⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        21⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        22⤵
        Modifies registry class
        
        PID:9508
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        23⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        24⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        25⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        26⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        27⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        28⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        29⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        30⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        31⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        32⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        33⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        34⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        35⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        36⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        37⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        38⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        39⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        40⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        41⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        42⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        43⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        44⤵
        
        PID:9320

C:\Windows\SysWOW64\Pnplfj32.exe
C:\Windows\system32\Pnplfj32.exe
1⤵
PID:10148
- C:\Windows\SysWOW64\Qaqegecm.exe
  C:\Windows\system32\Qaqegecm.exe
  2⤵
  PID:8160

C:\Windows\SysWOW64\Phfcipoo.exe
C:\Windows\system32\Phfcipoo.exe
1⤵
PID:10908

C:\Windows\SysWOW64\Qmgelf32.exe
C:\Windows\system32\Qmgelf32.exe
1⤵
PID:10188
- C:\Windows\SysWOW64\Amjbbfgo.exe
  C:\Windows\system32\Amjbbfgo.exe
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\Ahofoogd.exe
    C:\Windows\system32\Ahofoogd.exe
    3⤵
    PID:9956
  - - C:\Windows\SysWOW64\Aknbkjfh.exe
      C:\Windows\system32\Aknbkjfh.exe
      4⤵
      PID:10448
    - - C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        5⤵
        
        PID:10360
      - C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        6⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        7⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        8⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        9⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        10⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        11⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        13⤵
        Modifies registry class
        
        PID:10828
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        14⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        15⤵
        Drops file in System32 directory
        
        PID:11200
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        16⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        17⤵
        
        PID:10244

C:\Windows\SysWOW64\Bobabg32.exe
C:\Windows\system32\Bobabg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7796
- C:\Windows\SysWOW64\Bpdnjple.exe
  C:\Windows\system32\Bpdnjple.exe
  2⤵
  - Drops file in System32 directory
  PID:10560
- - C:\Windows\SysWOW64\Bgnffj32.exe
    C:\Windows\system32\Bgnffj32.exe
    3⤵
    PID:10672
  - - C:\Windows\SysWOW64\Bacjdbch.exe
      C:\Windows\system32\Bacjdbch.exe
      4⤵
      PID:6116
    - - C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        5⤵
        
        PID:7884
      - C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        6⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        7⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        8⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        9⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        10⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11848
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        12⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        13⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        15⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        16⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        17⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        18⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        19⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        20⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        21⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        22⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        23⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        24⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        25⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        26⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        27⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        28⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        29⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        30⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        31⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        32⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        33⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 404
        34⤵
        Program crash
        
        PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7648 -ip 7648
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajhniccb.exe

Filesize
68KB

MD5
413b08378a25c22457f175d51e71cbeb

SHA1
99f335bcc05fc495219ab0970cb5b2a0576a4d4d

SHA256
ec77ea9734dc47a21b87eb12c4365686e9d7a12d59b665427207b1917b446f3d

SHA512
a081e3a4ff1c8e43e2a61b94ca64c43b19daecacc2c76322c7045edcd3d304d995c537ed4589285b818901aec1a7a434fc11865bf8947624251d49d57ea81be5

Download Submit
C:\Windows\SysWOW64\Amodep32.exe

Filesize
324KB

MD5
c82270ed21dc75f92fcf4107466e8209

SHA1
7c5efa7131d3bfd54a0221c4bf98e00828a235a3

SHA256
72c5265d377ee1d90bce1d12cbd4aa9e4c002b5dcf36b29b4718c01ac9f424da

SHA512
49521956d616f6fdf9669e0d5f5e5e09b483705d48553f88500ff26324503cb8dd55d77e05d79b99120c7bcf0fb25b90a2f6b14357152f2cff193775eadf26b7

Download Submit
C:\Windows\SysWOW64\Bcghch32.exe

Filesize
324KB

MD5
be920d590b46fd87b0a51c7be3098d60

SHA1
3bc5c9605872786109fb19653041154fdd7e798d

SHA256
c08163482463f36a7b44d8ff9247a3d7c34fb533717142da883732e1c65d27c3

SHA512
359a9f8c289d710b9612da34c9cfc2fec7084dafd8e99c017be02e7d3505e9a99b9399cc48f3617c2537e4cd546e67eee32dbfa2d2ca732a3a780305428be703

Download Submit
C:\Windows\SysWOW64\Bjfjka32.exe

Filesize
324KB

MD5
b2dd27ea0041bcc4ce1504de971936b9

SHA1
9cd67e8c616ee54859b226faf655266d73bbff6e

SHA256
a6c3803a3f2411e0d3af0ba5522a73cfbf2f04879037e56aeaca2a64458ffc94

SHA512
84f922c3ee770f2f2fc7db5459e5c994e2ac67a29ecfb804ba93648074f3282e6c1debc6735f0247df7afeae694cc8f4658b98c5ca03d747f97037d4254ce91d

Download Submit
C:\Windows\SysWOW64\Bopgjmhe.exe

Filesize
324KB

MD5
1830c278891f4b377f16cd9b1e96c75e

SHA1
9c31f58dbe531ece2933f0257bf48b44ca0867ec

SHA256
dfa427396bbea813fea05379e633e5749fa9e58fdae2329a4743e59943478c58

SHA512
1cf023f59294d301a9198052993d944b5292f236dc2702cf1e1d3acfdb97cc31525dbb66c6a28741837f2787515be60cb2597dee56d9225d3fbc1ed629cf6527

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
324KB

MD5
45036c0197cd52c46a7f9d3b9a8077ce

SHA1
50b3b16bdf4a8e9c47e939a8c44a058407593a0d

SHA256
40204854f149be322e2c6bf1d65dcffdefb3566f72643eb6fe088cddf509a572

SHA512
648f47cfd03d3287aae2ff9a1e83016409a69e480df5034fb4ac65140101a97147139a7dc6a2aae60588728b0e43723001d115ab1976b3fe0c225fcdfb25265c

Download Submit
C:\Windows\SysWOW64\Dfjgaq32.exe

Filesize
324KB

MD5
c65e9f2a6e34ec4a10cf3ee16f9a8a71

SHA1
64df8e70b63b0c88e0303e7aeb6867066d75a2cf

SHA256
fb878efa89db831e1cee0f2c6712caaee3d6242e5aac832087dedb42bd791623

SHA512
f88923a2ebd8548af64ece0a1aea8ad37778962eb5ff1b68764a0eda672939d4eb4375dcf5bc087171966f234e27b93bacfae51bc3745b6b58ef97c15be48e91

Download Submit
C:\Windows\SysWOW64\Dmpfbk32.exe

Filesize
324KB

MD5
78b0c1048c9b8d0ebc7ffafe8fc66349

SHA1
cf215ae8e243da39666bc8e3eed4891e01748b5c

SHA256
b15be754396c443b8dc64ebcf698f2e36d797d8866a21bff7675ec4dd1567d00

SHA512
0f68f5e51d85498cc6c5f09b896e09492a2e65f47ac3b777086add074a9e3fda5b8968d88fc232076dd6d1e63b9c02075a3d633012f135c63ad88f9a1699fb1d

Download Submit
C:\Windows\SysWOW64\Efmmmn32.exe

Filesize
324KB

MD5
66f2bfc3593d1b2e91168f1d897cccb2

SHA1
3910e96b52c3ee35f7ed3115dd565a128ab15776

SHA256
798a393754bd280b58e215842170aa2cb909f3b87d3724e7981b55f429ef1bd1

SHA512
847f0dc8dcb3d85a441700edf25b48fbaee4872bb11c7c986f2eeae2935b5b8e5a7ce721d4a5964a8fab0c1e5034193457d8ea9069e18cbcbf4aa097453f3a48

Download Submit
C:\Windows\SysWOW64\Epagkd32.exe

Filesize
324KB

MD5
21122536dc3d3e0b0ae17c7d4f532487

SHA1
f66693123db30bb96fc464750d1a614802c85639

SHA256
c2afd8a82a5800d74d8718839730e342a64ccb34ea96e11ffec0af4d3c22ecb3

SHA512
617f6b6932bd9489045d33c7c1610cff5f67f96d50dd9e7b75b356429099fe4f0175193e8c0c261cb5ccaf1d30bfef7079e044771b31ee12ccc9ab4774e355be

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
324KB

MD5
c5a6c1dd1ff5ca0fcbf4e460baa41249

SHA1
7af9bbc4f66fd5b3796d0d820e7a0cadfcd525de

SHA256
20dbb4b31fc5cd0ac6c3fd75b9fa7486c75a45872b3e7273726c5bcafe5156d5

SHA512
57f8d78bcaddfa25178c6245b2af64e35f1303deb200c943c75495aa63401b90143e3fc372092fd580069412c11455713574b93b0b5a0e94dc951d924e211ff0

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
324KB

MD5
7b9795d294ec415e9d0baf79c1d68ca8

SHA1
0f631db227d08bba05de9cccab37b788e246f12e

SHA256
0041be2218052cfa39c528f52e998ae0cc5c96d435e824452a0c0a327a346228

SHA512
2bca5b449f4d3377a0480244bdc5a44aa9f45a01c57017891e069ae551c2c686a2bd0e5125c052302b154ea28fd328d624cfa812b3fae5ee7eca5ca77cd3dba3

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
324KB

MD5
33cd5355a41674c98e10db717e5461c4

SHA1
66f29fcf07074bd18396b8e5718548440227f689

SHA256
b21cee7bea56db10ec0e1def8d9a282215c000ddd2fb0b0628c77dcfea0668da

SHA512
810a0ffb6ab121f60d7acf79d6f5d39b5fed3d2a080abf1d712b4fef4fe67789b8b1c5d2b346b2f325cff11f2371cf06d44f4deb4beb53bf2fecb9024e76c592

Download Submit
C:\Windows\SysWOW64\Ggbook32.exe

Filesize
324KB

MD5
59155087cbddf341ecfb25b91e48fe72

SHA1
7dc7e202aec770c9f96328b05a653a4490b83bbb

SHA256
ff594b0560e0bcaba7a4403ef62da0de3177e9f8b99a6102eabdd3c152bee85d

SHA512
f4f98ae5bb91c3bfcb7890d3c01ad6a57744e6e9887a9692a5b8afa6fddc7a01903bd4c63b69b15365129e064a62a2b391eb02f11ad690d26f50b0a3b6e2c42a

Download Submit
C:\Windows\SysWOW64\Hdnldd32.exe

Filesize
324KB

MD5
013aa7917a7ec2a02cb80792c47d8b1f

SHA1
139dbc954750f9872f6b11a467fc2dbb48bbbd3b

SHA256
2ebcac21ed892d953c6f8dd8dc62117200fc7143375a908559b7d85272fc1607

SHA512
c41a8243f846032210418ea289814adeaedc1e534e75d32a3eb14ccf91110bedadad4be80d267955022181db034b94fd12ed52f1d22d50762373ba21c6d819c4

Download Submit
C:\Windows\SysWOW64\Hdpiid32.exe

Filesize
192KB

MD5
aed3588d6253f64e0ca632de45f31a19

SHA1
a7f4865baf2cd426da14766d5ad6e497ce969a15

SHA256
6055ecee0d4c61b757fc83ea3dc60c936540dbd9237ffb55da7387d097ddff27

SHA512
769b1d26daf8179fb88019d27829c3c57847f5daaf811356f644972cb01b510a6cbf5224a308d42cf3f3b1368c48a0624148fdf70b5612584b64afc7b5291f11

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
324KB

MD5
1a6c20e5d4ff5b8016b43ae4ec985f00

SHA1
c300a0e3e2f8c4be348edfc83f28637a9d4d0a49

SHA256
36c697e1162d69fa625b9e4163fbdb97199c8b172d6b241e82695dfa66b43e5b

SHA512
ba374c8591850c43b67de49fb9866f94ae62772ab4dbf4d9276e190bc7266d287b86a12957ddebc1b16df9b7b1ee85ceddd60a127df094d432db0c45c78cd0bc

Download Submit
C:\Windows\SysWOW64\Hghoeqmp.exe

Filesize
324KB

MD5
f0a1435b4d022a897b386e2cb55c4a81

SHA1
5c96c326d3f6d798507235a0085715a202b3b102

SHA256
4037d167f55840a2744e5f468ebcf50a103aa1310aad46aa72d47e75a74be305

SHA512
48b784586802edafce93455aae8972c21770fafd7fc0041bf6e0e3f6d80b0b687c22525bdfa39ff582b03d128e7133fb368ce4da56adfce3826d283efad0deef

Download Submit
C:\Windows\SysWOW64\Hjhalefe.exe

Filesize
324KB

MD5
c2e1c3eecc096beeafeb8d8b5bb6854d

SHA1
d3d7e489379d1ff52b36eee144250a88c2a4bd6c

SHA256
32db90984fb0ac4b3d5db817944a1a5875217c5051a7cd6b3ccb4d15b0db394d

SHA512
dbb6216dab397782476cbfd3cd4e23393e662c580a336c73511b5e1ba4e2a7b9eb14e217100602eab4b21c421d05637005b924a8f2a28e5cce795d621e4a5961

Download Submit
C:\Windows\SysWOW64\Ibffhhek.exe

Filesize
324KB

MD5
8cc35b8a772d9f54ebbe71c0ff85b084

SHA1
4338c3990a70b78b4cb0978d284d83e93f66d0a2

SHA256
7cb2a6243bfdbbb0dd7fe17707f3df5a4117fb7a25a149dd1adc85dd13617a85

SHA512
d9edbf2bf741a74a78fa89905c5f6caa2cd5c890246da3bd14686c2a6b6cb54308c4147e129e561290c2a140052162337b0cfcbae238dfce82cdbb4f7673d075

Download Submit
C:\Windows\SysWOW64\Ibpiogmp.exe

Filesize
324KB

MD5
13406b9f23f8645cb256ef0fecbada39

SHA1
2e9b3e8129ad903d48384d71cae5a4a0f922b8aa

SHA256
0c8415cad2da39acafee103f5f9f5156073df928da56e293a694fd94cf0900a0

SHA512
aa03598d0c22cc8974eb360cbcfadcecf5911e7266aab59ac4ebcab399877917020fd3a6956cd5c2bca79bc6af5e5f008937f7e9c21a41d2ef261059e130975d

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
324KB

MD5
734d7cb0f2e4caa83f82359d8d10f127

SHA1
9428188ded82d000c5f4820c93be88db8f4fc087

SHA256
e17a94c9aeeff7116fb922d9fe2017d24d05461569edd4e47a24008b03d02044

SHA512
50562d1ca4949c28bd73fe12989c45066ab001d7b101b86e7fcc9afe1cda4076a094f8eb8eac01a512d932542d4bd4385cf84d62da9e02db44b6d87fe2d483f6

Download Submit
C:\Windows\SysWOW64\Ifihif32.exe

Filesize
128KB

MD5
9c571506c6c22454567e98a03c5c44b3

SHA1
71dd74fc78bdbd82ae1b2edd8aae09d53588cf44

SHA256
b480bd10c3b81470385d8cb525150b7a7ac99b8f3fe99aa087874a6e6bd1b414

SHA512
45f1a7d9bb15d8ad2f20dcb14be915cf29ad22425c828d0e1b2c7b90fff15aa84c10c2fe66cd78d5d53cca6150b3cbb44e11593e33f6700d53a56217f8b9918c

Download Submit
C:\Windows\SysWOW64\Iiehpahb.exe

Filesize
324KB

MD5
14aea296758a2be4923ba39ab27edd77

SHA1
afa121c499c26451668a294134e4cf58186fb87a

SHA256
ad328607dcf5c5503ebd9b961fa0bde27d4722b8980be36e0a1373ef29c5f9fa

SHA512
3a9880509406fd821c27a302783b6616503ffb8871ccd4b00c695d4d0e996a907a72e15b0625d15f04f55296a52ac51cb44b5d42dcc83eb0aa4965d04b0377ac

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
324KB

MD5
667df18a5133c3b0ae189c87b8d9fdef

SHA1
878a300cadcd1fc60d17026d4b4a5cf24c9b0776

SHA256
1e0cc7381ade724126900c7efbadf4f1deeafe78b0d88a68dedfec51ca7a6fb4

SHA512
f74f4842364e2fa13c2b8879505fa3a7abc28131958e1d069e4f71238e9c1d328a317d36f0290685974f1d24d3ccfbea5225f1ac5024f0a9cc34b990239fa8b3

Download Submit
C:\Windows\SysWOW64\Jfgdkd32.exe

Filesize
324KB

MD5
c2849839649f73af2be4ef1800abc134

SHA1
92fbfe21ca3f9fc8908a5bcd006ea93da2b59a0b

SHA256
92bf7b518d0d4549fbc89439a94689630cbc25b5795d2c75e75a4cf617755e8b

SHA512
fe61aad21ac70fcd8bc66b926d10fdf382721b50407005a91c9e052e281f4bb3d24772bacb414e4ec8068b4aaca183332be7ae5dd67607a5ca9bd0cb3119f7fa

Download Submit
C:\Windows\SysWOW64\Jgenbfoa.exe

Filesize
324KB

MD5
34b425470c687db3c3b86125fbbaa480

SHA1
80f97785cec02f31733dac553952fb9895f3fbe1

SHA256
2174042cae4343e5524082e260ea51b8839cac5d1d374983a7f3acb9a8221037

SHA512
abcf73f0d2c1ca0638d15c3de7b6df0a9eca287ca50408929d29347faa2e5e00e60e31feb35dbb72e0315a5d79b4962ab9e4dcca1476d8c35ae70d2a4f53fc6a

Download Submit
C:\Windows\SysWOW64\Jgonlm32.exe

Filesize
324KB

MD5
dc457490777ce9d369c9a4793b29126e

SHA1
06c0d9f34771515cc92b16db432dcc434d5c2541

SHA256
bcf472a0fe6ff1689adcf9398467ee314908d9d6ab0b73905ff1b4840ca45dfa

SHA512
bc8ad4316922175bb98598df5c898e11322aca060789bdd616e7e436048dfa555fa955f785fbf0e12fc27c39c44ff40e8a784fc2c4d26e8de1f60de292550f1a

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
324KB

MD5
0efe391d8723dbc998983573d0453a1c

SHA1
32965759e14ea217eef967cebdc53aa63f71cf14

SHA256
fed5c6c3e4051341b8f19d5e73f8cd1ddbae5b55bc889338a80098245e7489cc

SHA512
51ce09ea5a454f8940ab4903a1511a6c429161afafbb98a8b059f6171a689f905dfba76f008e209ce94e1d8802d75050a85f6877d633237911199c7ec4d84ef0

Download Submit
C:\Windows\SysWOW64\Jnnpdg32.exe

Filesize
324KB

MD5
6124bc650c1adc8c162d0db56f096fca

SHA1
a82f24239836ca21a5251c2935c49e21170f900d

SHA256
4e57b7b2a572a1dd2ea5e74085ce422788e4d440cfb1792f0a43ce74f8a3e361

SHA512
33f0c13d7e99702bfc82f87b043365710752202514757f424b30e2cc38d8171938ffa8a38e43c595c410ab481c3df397811076db34755af608df7b7d3b56a9b9

Download Submit
C:\Windows\SysWOW64\Jqiipljg.exe

Filesize
324KB

MD5
c2b581e8489ce6c52972ab48aa8fb475

SHA1
6e163c160d6ca0ee3cb0b6738de484655b0f701c

SHA256
f20e3ab5f0062827f53670356d151fed9b438df93bc1ea05d037f573b0a66b64

SHA512
47d1a03c7874b81477f45f44a898db65c899965c866fb756c66494fc3b605b5d0c2734b59f2a44617a932ba844260c682ef74208c7b9315fd0042fe6ec2cb3d3

Download Submit
C:\Windows\SysWOW64\Kgknhl32.exe

Filesize
324KB

MD5
2b4d0008ef0dca09b03803dbf5b738f1

SHA1
7d0eb0221b26605177f0e8574fadf15979a36ed0

SHA256
839634662ed8c299e7f4847b8e97421411507828b9f9b440b0c6b919f543cb00

SHA512
9d73d4eb025646329b8a62367723386590fc6437b2261214a49124a656b31de931a00ca378e143db9d4a8856cbaa1f94b3a98d4c19cf32cc59ec8e78ca077016

Download Submit
C:\Windows\SysWOW64\Kgopidgf.exe

Filesize
324KB

MD5
f5f39f9e7744e48e2e4838a3dbd03746

SHA1
f43afe9e1d13a4bc8f9720cb60be680be11535b3

SHA256
855f80100d3c5cfdaf6fa95de0be0cc776c96a07b3c6613978c308efd99732f1

SHA512
05b51d187cb43f9f557ffc62edfad077d889df772eeaab6ea067424b664dcd7b1dd03a4db1134a368dd4adcddd8d3bb715e4d28fe7184bf0b119f706bfa86a50

Download Submit
C:\Windows\SysWOW64\Kijjbofj.exe

Filesize
324KB

MD5
4493c67c2af0f2af68c42f3dc64e9213

SHA1
7a6462bc8dbbc065bb309867daffe096589f21d5

SHA256
d1f6daeb09a3201780916283896cef49be4352f3af569752174407a31c473447

SHA512
e3858ae6116eeaf6f09aebf007ff586f7791aa2b8621e9527bae1555d1fe474e619fdfdba043a6dcd1d0be209144692a0fe4723c5dce65727d582a45daac0ebc

Download Submit
C:\Windows\SysWOW64\Kpiljh32.exe

Filesize
324KB

MD5
a04ee9e8efbaab33a32960816cb681d2

SHA1
dad2cd094685d8a211792241c673a945a7cfc80e

SHA256
d43922b644b2c2c9e22d4c639fcbdb302058244b0180b45a63e64e0dd73a716d

SHA512
931f679d223a4a0b454b343b9cf799d2d49691b6a6ccb3ae0dc7a527d0ce85683c79b8f5cbfc779647b588113e85ef8b779f12e0ddcf1633710785d702c8c923

Download Submit
C:\Windows\SysWOW64\Leoghn32.exe

Filesize
324KB

MD5
1620437cfa7f92864169c329ecd005d4

SHA1
9f0f1d3fcc9d75fc22519fc728533d677c57b8d5

SHA256
3f67c35d3d8d309d885af7ae005d2937b324039bf51b393a3858425923bc658a

SHA512
1eb4ecfa5bd6670357254cd2e019dd967b6050641eee089812b948e30d107b37229ba4b76aba9efc84c3d0aca5fa9d309eef59158d2eb5d2a201c26cc5a123a3

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
324KB

MD5
6993f88c77a927abbe8d9fa0710a73b2

SHA1
10f956916584ad17fe4d9d443b8b41fb664170cb

SHA256
ccc30eb7f1e7911e88d41c68069be3eda12bfbfda36987b65aad036fc18a7083

SHA512
545f240ae1338138eaa5761f226bd3838ca9761829e594bcff55f2fdddde696411fbc4cfa84a5a8a2c6502cd40d44a647a22785b8c63b7feb7d806122de64eb8

Download Submit
C:\Windows\SysWOW64\Lifjnm32.exe

Filesize
324KB

MD5
20ea4af7845cfd1a7fdece0e66826a64

SHA1
53567893ac0f821bd89f7d2d6cc47855850368a7

SHA256
b63a7754fda081026a9b9d53efc2ba49379779e30e327aa09254270b89bbed8b

SHA512
c476f0da50f83e3c474df4096257613c79e7b65cb655e866cdd27f3a3e3dd0c428a12d372f4f6c39152bb69979791d5edd010bde1dcfd263610bbf3b5237b34e

Download Submit
C:\Windows\SysWOW64\Ljilqnlm.exe

Filesize
324KB

MD5
74118ad74a5996628f9a2010ea79895a

SHA1
f770530d99f80c419a60964bf4dd450dab0bbd39

SHA256
a0187c6e11491d2c53d22bd0881ef6a382a68183b6bbe8e977cb11dc477f99ea

SHA512
fd1879bc559e07ef03a7b4162fb5f504f1dd194147da39e3f2418a7ec3ba2be7a2d7b96f9492a40e042bf5948d211a1e8c8a7c6dd49e297b44e5a9e76e16d46d

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
324KB

MD5
9d4286c357efa23de25d9366bc603066

SHA1
bcd18f257b342beeccb470b9d9aaeb1854dfc975

SHA256
201dcb4ed714397de663cc08a51f465068a18684fc784280562211c594645278

SHA512
020b8444dfae2aafec72f617a97badec4a1be2fecb887183d215beba4829f332e859e84746635e665b21c719c117c47dfcad36b5e4a6d83a9e8defea3edece4e

Download Submit
C:\Windows\SysWOW64\Majjng32.exe

Filesize
324KB

MD5
bbe2592c7ab0b8836ed66463b313888d

SHA1
0fc9d6e98ff6abccf0b2b89e767793fb27118957

SHA256
b6a031bb89f4d52b8ac17428127522342acebeca24a6112d97d644fee42d6f42

SHA512
7b03e8df9cfd4ab45bfb8a6e66edb9e4db20aa448e50eebd7c30d186c6496763939c85be0a98b1c14e671ac7fde2426f83bce498b3d1ba059f4f1718868e1cf3

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
324KB

MD5
9082634c61f6731deabd1f6f10dbc13b

SHA1
0da34081a83fc45c4486ca67faf6e4a0c46d9bcf

SHA256
2eac5726e748593237d018b03c6569384038b79902a33e307934e4b4b46e1586

SHA512
229037a438a03667c430846bcbdd46cf195cb2b820477f2f31c10d5ead2f5f629554ed62718a8bf1644cfabdd44ab28a3e852e7cab57a8c654c52ac3c727c699

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
324KB

MD5
2e827bca433094ec8402283e6e4d0c8b

SHA1
d27eeab7c79acccc42b51f0da52cfc3c81c90d7e

SHA256
d434fec7d802fd55416a596187323c215bd2f22498a73d3976e4dd1f9dcbe535

SHA512
ecef526874133c5f01f455a1509336738eb6a3fb67966aa4713b74f10cdc713de89f16c3cbd2effbf78d804890c8b3a044178c8575761c1774a455893df58bca

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
324KB

MD5
7260ed883f0f4f7ac434d54659cec969

SHA1
dd600cb5d51249ed83aa914800a18c663c624c0f

SHA256
794684a4e588db6bb70477b113da5c69634f55d720c6c79a83bb4c950a10cdec

SHA512
676f9cd2ee2af0e324eed2e6a036b886a9170c6739cb06c5b8c8f435d2b95418affa86de263e33a030e5c7ca4b75af5e899738ee37db94fe910495118bc6f245

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
324KB

MD5
a2f308ebe11038b49b46886d771c07e5

SHA1
8a624ad5d4c889cf0f297d5eed9017197b4bc4c6

SHA256
f7ab2e781ff5eeab7d39d9f16e1f4978d7b338adda71a15a593f906c44a37d21

SHA512
33dae64c0ca308384480b83938a6652830a0a40b89e7e6d925b7d586dc91d97e4118e32fd1009f2d4d5c9bcff124c6e944513643c6397b3d0264799a755faa9b

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
324KB

MD5
74959f2fcc6e93f91256970e60437cc9

SHA1
281c1fa66e551cde476a75dc5360c687d10598bd

SHA256
b355cbb226b8ec58f5f7545700073eea5efbe193ee382bc56189840e83bce73d

SHA512
de2c3d45318881eed5c386819541230c9f14a46329208281f4ec7ca40158a22db49a4ea19dbc9adf8e304cf443114a2422c15cc636cc7935ec00aa0932caa830

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
324KB

MD5
9d37bdb1592cc412166de444263ae64a

SHA1
495555a3bd32cc212cf960e218e5239e9d40864d

SHA256
fb17ea9f063f906cd0b39cd86cae8de4064e77f4e8bb17f19ebb9ce97da7886b

SHA512
78c10f833d3f9432a74b601a5a23314c34dd3bf8f9f4af3f49106c173e7ceefee341804f25f4ebc60109b5217c45d73fda478a021690181280f1bf5bc3811f5c

Download Submit
C:\Windows\SysWOW64\Meamcg32.exe

Filesize
324KB

MD5
89cc9e303c0f75eccb05716ce03af95c

SHA1
a0d0c06f2376a337664b28cdc5ce02650f1fa806

SHA256
efa5796324def90c543f48cc3fdfd9c233d9b7f1bfca5eec89c7de107b81486d

SHA512
e3855d86e1bd9ff124ca8c8ec48ab74f097f6e3780fc03e9febfe041fb7051975cf95f949f824d12b8586a1958417d72499cb1b9f21a90f93eb8e4c3cd84ed85

Download Submit
C:\Windows\SysWOW64\Mfjcnold.exe

Filesize
324KB

MD5
a0b9e8ca6495d442355828a1141a11c6

SHA1
bf050c049131dab393e0f3404499858ad748a44d

SHA256
82491d76fe9dbc6501f17449dfad0bce1e88cc645edc71fac7cc5572c02c322f

SHA512
82874ea87517187fbb328b82dc233435d106fc3712d3de38482a1132aa76b7f1d2961395dd502526b9c0f7fe8fd72c4fbae3464d723b5eaf57a7a6e61ed110cc

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
324KB

MD5
9a0f2777a6431f3ba21a8f6bb1e3c210

SHA1
23e519cfc035b30708a4d2d8d90ef25e92b87b39

SHA256
32d24786821e7f9a3c6213db9403bb4135af5cde2e057a2e9c678a91e9ecbded

SHA512
f1b97b83f4c18d247447e2d9f29e230afdafa9b0842b391dd6da94e2d4a1722b7d9e62a15cc311884391dccb4e8d891cdfd07f017d18d9ceab935dd06f33e80f

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
324KB

MD5
8cbc8ffd7fe8d50be1895f6efa5cbd0f

SHA1
57a4fbee4ea2a499e0ea1df2a57ba04006f63051

SHA256
325a4aadaa37c52dbe67a19b135e14ae4fc6cd7df8d5f157d11b43226a4315a7

SHA512
a4babae6173e9dfd8f263864b13e965a095cc21478e614428a9228e35125b1526663e9a16ea1197830b0604f05edca2b985cb31752cb8be8d5a9701cede10eae

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
324KB

MD5
b35e590be57884d73cc38902d64f0eba

SHA1
b7a1b9e3a94709f1a5ddc6ca4b70da80153559d8

SHA256
ca98bf6d01a54db1f4abc68bce1782dd92ab162e1d2d4d53ddd41182ab318111

SHA512
a96d40f6fa4e18a1220f5dcdf105aae215ff748230346535d70c3115bed4c528d821e6a32cbfc138e916be20953ea265099172528e3c3e651d82cae242b7929b

Download Submit
C:\Windows\SysWOW64\Mifljdjo.exe

Filesize
324KB

MD5
2fc26e95be08fce06be3f56c35e89272

SHA1
226e860664aee968f29719d38a83cb94aa66cc4d

SHA256
46adb901423da6f90c4fd12beabcb74e30a15e9a93813cb5f528ec8cf1a6b760

SHA512
f5ab8fbef7533ccf1d3d929274cd670681ab17977cba6d31a673b061f559e4bb27a08e24fe409273c6368ae4437965002965e8ba2833a13eaff9cdc556223a46

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
324KB

MD5
a012a2a15a6ffea726b0c35b853d632b

SHA1
c58fa6b1dbacb0a1cca56e62a9f283a1cf1b596f

SHA256
a8cf320a976b8a22b3d3afd8ad9528d8501c0670cd62e5a92f194c3643ad1343

SHA512
62f2e37dd5ca279ff949d20eece2bded2cf7f9580b35a62a32eff6957f0b99d6a867bb4b7c403eef1968942d63b7cc7ff21533f82fd22dfecf70832798b6fc33

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
324KB

MD5
9b15e40d342205bda365b66a69868f78

SHA1
c0dab74b36dfc7f6a5c4ea47d7c6b612a9f1e203

SHA256
7c21dd42c8b110a7456be558b46854d4c5ab60265284f45fd8386f551411d4c7

SHA512
bfc57b80d5210ea639cf73ad694fe3340153a45bf599149731039b862106e2f5b945e4fabd41c53f61450421978b4cc3ddc590055d522731859a9ae74213aba4

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
320KB

MD5
8597635887fdfd237446fabf3c1507fa

SHA1
a42f5178d480af4461f53a04f2867168a2c3c508

SHA256
210899be87215e3d33e0bfc3d216b06ea6c2279edcf9940d99b21b7cea118b6e

SHA512
a73e0f85df6948ef901896efce06901875147773afc9ecd2c534f9df6d87b9ff53366d558cb9f70f93eeab0b35c6ec07b5ac51c37738b57a12260783a170185e

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
324KB

MD5
da3661c8d637df6054db516286e7e07b

SHA1
20a71a5bd87a82ba30c5b10cffbb4206f408ee57

SHA256
d1263cc2529efa49d22780a8bdaa460b5a38953c49672275200a20b52e61e47a

SHA512
2b67c0371e88faa39a066ff740613fc28a5434d1e12b88c47e9e00b72a2ecee0153edc5a655a10fc1485b9bfd9ec263067a2c01f7608cd9cd002277193954990

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
324KB

MD5
16b40afb66f6e496baf22ec4226bf264

SHA1
3c774259b4ce6b95ec3ea9ce271c3a39dfb5a321

SHA256
d534dc51378d3f3ea2f23eb76a95f5bab000a705085e772f2958c508592f44e4

SHA512
1a62fc63e22318ae49f88fd3aeb6d21cea72351297c8edeecc05fa2f31e4477cd0a55a4305000b8b225c092c0bb94a6e9cd40e2caaabfaa3dd8d55d614d63d10

Download Submit
C:\Windows\SysWOW64\Mnnkgl32.exe

Filesize
64KB

MD5
e1797b45ef96b8e151104f1b56993637

SHA1
755b5b569d0809f4e0caafb0069c545efe467b79

SHA256
84452b13139ab418362442ccdb2f24599baeacbbca04e817cdee2282ee8b24ac

SHA512
b690114d6a666b9e40dc5354e0c7dbda49a06bc9589aa3bd4d72a3501e243b365193a91d94b309c7e29fa471a7ff72bbe20f39cd31d58882e2dc51f591467eaa

Download Submit
C:\Windows\SysWOW64\Molelb32.exe

Filesize
324KB

MD5
13036ad57a0807c8f972948b518d5637

SHA1
38064a732b5fae2a9e1116073e0b568e6c9fbc15

SHA256
f9029c61d06d50a20466bbd9220672bdf16812fdb7b5cda36d28a1de83ee04aa

SHA512
44cc80e2910ab65a1efd79ef5fff4cab925848b9bf2e69e48446a44d010b79333302e3358df7b102afe2ab75fc147402d42025be766c9d183b2c1a9e0f99da98

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
324KB

MD5
b450aedfa57da8e6567fd4e056adf09e

SHA1
91dce28585c29f8403b0902a19b0e02bc744b9c2

SHA256
c39bf49e0c299cda340017bd3f8b23c6b127ce1989fa6eff5544ab7c1a027c39

SHA512
e647d1b1026d86b7f46d5d8fc2ca517c82c279805ac634c5a13b3ef0e745d5487c17652a6b386da30e8f5fd7411ee87d733be5e21811f5c186db237070d4c01d

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
324KB

MD5
592427ee5792d2cd5b58746cc220e9bb

SHA1
3897d1b4f41313f2ec72893d45788407d9de2858

SHA256
375195e1763675bf0a22a199decaa5c911cfe7d9a42b4b6960971775e6dd22d2

SHA512
a068a5605b20f4ee2ac8feeace1b2529459666ec579b59b1b13b264e8529d2e45da5c404ac45e44d5c79fb7a2ac8788282965231201523404cb9b28967df2d75

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
324KB

MD5
c58e8aec7ad026180e3a43b529a452be

SHA1
67761b0984ca8006181fbc37f45917ae75fae8ca

SHA256
6bda1f8afa627f3b76d5e9ece9352c47cebee1b27a26975a7f5f466300c45d3b

SHA512
96e39a68fb2bd13a9a0af31b59ca4e82a203bb41e8b3f0812e6ac5b0f3d9c8189f286ba082e856d45520cad13fed85cbd0d23be8b786ed2a852e6a714222f6e9

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
324KB

MD5
04eaee127a61958e952b1f9bcc2dbb69

SHA1
c9029569ff0acfae51b48bc1877562012b3b3226

SHA256
2ce941aeec8897593f614e9b63f4c2c1b53bc4cc7f8bfb9e4d40a5ffff444ef1

SHA512
868daea77e4accca962c92b7ce5c3f83fc8ab125091b2c5d2de85a6fb7298c365ec7eef4db723e5a2f26375406e31f25f341c79407227eab4bf1763fe707895a

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
42KB

MD5
5939804def224d9bb20312c0a6720e95

SHA1
92e4dc8095b604346398e199eda9bf79003cfb2d

SHA256
b15a99214370437c1bf73ebcab0ed02304a78be4620836bee052a8b050d08e16

SHA512
7dac612c554513b7832dbcf5762995ef0382949016eeb50583f7263d41e0f3529fdc7febaf925971068ccef9213e275f66cf50a2ffc99580896589ce30cee1fe

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
324KB

MD5
814239b0c057014c04006ac9780f8709

SHA1
d5020693ae02a0a3d3b6f66b3850d15446e1ea3a

SHA256
cbeed0b2f741093c9770d46506f9f08f70d5c2a7c4611500ed23f785b7b2980a

SHA512
114bdb130c714ca3986724bc8c7e1ba85cb1d678c2ef57e14b3beaa815750d125108e55626503e2331bc7a2a4f457d250c657348fd05bc8a366977d4f9015d82

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
324KB

MD5
dcdd21a2ec511f9d97e7345660ed7816

SHA1
066ef59cb609ea7e08678f5017562ce044ed65e1

SHA256
892b4b0aa9edc15ee7dca59f36da221b74134d8bd25a90ca9e9dd1c5dbb8b652

SHA512
c2d20c488d71aa29ee86f457ba75ff140059fc6b5f89ccadff1a73831f4ccec0cecc333d4ac94a9ce55aea6a39c8fd3c4871516c8cabc8f98bc69d18143d2786

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
324KB

MD5
a00bd30a313757659129336d8e0016df

SHA1
b6853c46c1b70dc26154ca461e85c7077cae9d77

SHA256
a1eb92b56d3689cdd6a22fdf9e411d940a6b8c5e349a33fb4c8e9e729fc7d1e4

SHA512
5efc97ac217b8b4bb5b52f289d852e27c89e6e6e9b09e087d3ea073b29f624d5b0395d78f2d02749068dad54c3a7f7bfac1a07b3f40b24fadde50941c7bfa3cd

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
324KB

MD5
919825fb70aae1b33027682214d6b7bd

SHA1
97234a2db18d9e82abe295cf0991e3b58615f8f5

SHA256
39e0106f7593f3e8784094d027720fe56634c90be44bb9499b6df68069c42c7c

SHA512
36d5e663d2605b3d6a76035567d507e0f4104e51a978008a8eb924ca5085e1305ee28c9e4efabb2782ccc1e809c3ac4eddff66d4caeee852845ccf8360b23e8e

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
324KB

MD5
f2d53e0d20832f28b696157dc9b373f6

SHA1
a2e063ac9db343a8912757c7778b8dc82bd07d4e

SHA256
8bb95c2adad1d42b2034b3b3ecf55e6745db5605f7295f53adf268e1b17d0399

SHA512
09ec54fd83947cce006aa1fd58e448949f5c544326a1d6a17c54ac2ba9115ff1d078c17310a0cc3f2a2a7a5d6c7c7b02d18efda5eed3db316bb0aabeb15f4e72

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
324KB

MD5
8ab5350dc6db71a952f6d9dcfec07996

SHA1
9c858f1c9dc0f837fd58b3c003989b6b4141550f

SHA256
097699f33bf084cebf218a6dd9c47ba2422c0b83126b43e1c3f0b31481c8a493

SHA512
0a1626866cc4f2f0bef420ae57684fb18dcb89c78235858201b9d410a4bbe44f3076ff21f3837655e56ff84c9a2c4397abca02c6684395695febcb3ef29f0f61

Download Submit
C:\Windows\SysWOW64\Nhnlkfpp.exe

Filesize
324KB

MD5
887f50febb6f3de67a0aaf65ad2a0f56

SHA1
82a99fa7b3b01e18f32565650d1b3c9060795b95

SHA256
d6e501563c9898d9aa6cfea8931602e99dc6daab6ef14c34d69804ad8662d2b5

SHA512
ed027e1d9e23f22297e94a1b0d9ff8386efc400960563ecd7768468f98360fcef7fdf0ecaadb5b7231243dace064810ed314b014cba5686bcaaa948eb2723da6

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
324KB

MD5
f7e702822fbf29a4243600c80fce35f9

SHA1
9771af7a5ac5303f6ec5b2bc8cb8b1740ad58cac

SHA256
79b191b1020c2e44efd40d5039b6eb264398a48dd9bca53cc25f8b218c14e2c6

SHA512
24fd5995df68fbcd2a6f8a781dfa507f4d509edc18e46e174fe9a225359dc11174665832ab25852010bd4db2ddc4bb6af31e4dcbef108569755469d89e58a158

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
324KB

MD5
3dbd2cfb06ee714293fbfa5a847a3025

SHA1
585313e656a73f6159d7e311cc1755b5108d5ab2

SHA256
f3cb76d7f6ba11e79ce069b6a460c7bb62dc0b6fdc018f3926191b4489721be4

SHA512
3e4f1956d83d2c7b13078e2704dad2c6111be0d7d25f212bce480027f9c893041088f8f175275f0e0d0814a23b7b4b4e5c266ca19c66948375497110e87527cd

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
324KB

MD5
5f90411b9f74f8b48fcea29ff54ef883

SHA1
01442cf05779cf7191011d160cf28cd93da0cf91

SHA256
a843d48aba24139f53bffad294180de6076f630c8425f6127c0aed83095dc4a3

SHA512
3d70a6cf80971e41227a0caab27f2ca84e70bfbfa84ce4184288bc70086694d4fe0b5d803c705e2a0914a7e8a3723732c6e7f0149fb95af05b4557b6cf9bc95f

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
324KB

MD5
a023c8febbe4bb57a9b5ee98768fe3c3

SHA1
80eb2e744ee1f24be06ed5bcbe156fd8addfb741

SHA256
38f192d3d9aa56f92ce8351ccb0f30e320863d72ffc9307a340b1615fa001037

SHA512
6a50714e960b0957ef59b6641c439715d5906af608e5f90beeb3b0ff8c46857db9a4c40181a71fdaf2cd6ce5c8d066c88cdabfe1425ea90c11ed9e3ad36bb9df

Download Submit
C:\Windows\SysWOW64\Nlnbgddc.exe

Filesize
324KB

MD5
8750e91c121a10f62db66ea0684067aa

SHA1
5042590c8bee2ebf1edb865a4d58613a4b326ea1

SHA256
8308fd2bf002325f7715ef57ce16a93a7283dd75f4f6d2a8763904cf4b3c3d3b

SHA512
1193083c89094fd2240b3b39e97346d4f888b54249f83347fb1e426ebe268d5d910957b7d5fdb000521441e14fa7d9668dafb36bb550f07a327dc9a135f9820c

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
324KB

MD5
a79119d143c40f46f419c58944b62010

SHA1
a1151a76f9056040353a47fa4b875f527ccc3aaa

SHA256
6d22fd9485794dc0206e5aa20dedef62adef30ded2b971a8e46555f133b6c16e

SHA512
53ad8f61786547785162d64b3df64c52b59e9c05b60c76a95ec6ce3d2d33d4630ff41edf99dcdc7b12b6237584e4d4a1554412cadb417ebad8231c5f97b46d21

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
324KB

MD5
b1504c0daa03d5e78f2a5c62cb3f65f0

SHA1
ad20f2afbfc3434c26d2b1f5cd0805400296846f

SHA256
88120594082a771872edc5c758ab2d72f87c9aaffb79f603a6c102018361b2e8

SHA512
b044c756e340aa102437147fbe68dec84a317f8d33b38d0979bfb5f4bc5e0a98ebae1e660d51b45121483dcc574c9843e57619016c269ba1f0925d85cd71fcd8

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
324KB

MD5
35612aa54b63f23e9a3599022c3d0e44

SHA1
f85f7c6f58555504e236b88e1e9be8ccda5809b3

SHA256
aa8292d1d89f0e4f1da76b050c855b81ba549afcbcb4805c3690ef2bbaae2c84

SHA512
c32f27275c6bc0a698406f974edbf55adb0d27322825ccb9f90aa93484c6a31c9ea6574b757511256df56bdb20abc2894b4c2d7fe876397e4a1a7caf986c5d4e

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
324KB

MD5
fc226c3e4eaafef21882e02180011107

SHA1
091da3283f2cbc9972be83b44c1344f5a3f9110e

SHA256
afe2beb871bb76e451b74b39f252b08425fbe92f27ee7391f573de58bff6002a

SHA512
cf33477573407b7359f484812cb5f55aa056ed2e97886f58bd810f8af32ae1bf59a32d686b23bd576c079247f538c447b401a895bf266d2d14f995037783e126

Download Submit
C:\Windows\SysWOW64\Opcqnb32.exe

Filesize
324KB

MD5
3246615c36dc324a4346d877c1d89d4b

SHA1
99d21d69d4ee66be9192937ebf883f369460d4ad

SHA256
058f2b111e3b2e8eb0f813b295830bc43caecdbb16864f0f8271f9c3fc158213

SHA512
e39ea877b7540d15116aa7674d042e30aeee99d691cbd11172f408dd700901d9d43e3e4dce32e73130926c4dcd9d7500f96401138509831472279f46f2f21b6d

Download Submit
C:\Windows\SysWOW64\Qljjjqlc.exe

Filesize
324KB

MD5
0eb66430255848d692f82933f9247b20

SHA1
51e96efbe4f703aa7c142544739c873fe77e6bae

SHA256
bc43aee01df4f463ce3aa57c5f083e908825ec5766917c081c9492a15936785d

SHA512
2bc46c10e168fd30b6ae001d53ee02f9031a0cbe562270162e287f48bf4e1fde46c54fe1baf86642583ad8daf20e7d3c989e01b98418f7844db009e9935a22fb

Download Submit
memory/184-475-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/344-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/372-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-547-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/764-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/776-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/864-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-470-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1076-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1240-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1340-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1408-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2136-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2256-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2280-469-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2328-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-499-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2368-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2460-523-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2832-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2892-517-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2924-541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3048-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3256-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3476-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3504-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3804-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3928-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4600-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads