fa61f7dca683809df63ba093ab731e7a5b7a6d7f0b1a4c68d9bc0f6df1439c96

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Proxy.Win32.Qukart.exe
Size

1.2MB
MD5

22d038931d80e870dd47ef99fb30b3a2
SHA1

e3aeebf9ba6c613e06bd4169f0645d5778f7d5aa
SHA256

fa61f7dca683809df63ba093ab731e7a5b7a6d7f0b1a4c68d9bc0f6df1439c96
SHA512

fe72a4bcd54226499721b3d7b56ab2fbad3d44bdcaf51407073da00e13b9530b69951b7147ea91487b99530541992b73ab48137606a52d6190d3e6fb7001cc82
SSDEEP

24576:5KvHPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHR:5KvXbazR0vKLXZR

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcfjfqah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maodigil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqhafffk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chiigadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmimai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajohfcpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jogqlpde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehailbaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijegcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imnocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpanan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabkbono.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aocmio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkgpbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnmkfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblgon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dimcppgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paoollik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohejo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhgjcmfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehailbaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibaeen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlhccj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdheded.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diamko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jifhaenk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coknoaic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hladlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alkijdci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doccpcja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbfjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eikpan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlimed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghqeihbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeddlco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnhcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njpdnedf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jncoikmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phincl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjicdmmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhnichde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjjjghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbfema32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe

Executes dropped EXE 64 IoCs

pid	Process
4024	Iikhfg32.exe
1488	Jeaikh32.exe
4040	Jcbihpel.exe
4908	Jmknaell.exe
728	Jfcbjk32.exe
4940	Jbjcolha.exe
3492	Jifhaenk.exe
3484	Lenamdem.exe
2348	Lpcfkm32.exe
3100	Lpebpm32.exe
1264	Lingibiq.exe
2696	Nngokoej.exe
4772	Pfolbmje.exe
1732	Pfaigm32.exe
4792	Adgbpc32.exe
3324	Afhohlbj.exe
1268	Ajkaii32.exe
548	Bchomn32.exe
5072	Bhhdil32.exe
3380	Bcoenmao.exe
872	Cfdhkhjj.exe
1832	Cmqmma32.exe
716	Dmcibama.exe
2148	Dhocqigp.exe
3332	Edhakj32.exe
3472	Ealadnik.exe
2152	Eaakpm32.exe
552	Ekiohclf.exe
2060	Fefjfked.exe
1064	Gdncmghi.exe
3584	Ggnlobej.exe
4604	Gafmaj32.exe
3436	Hdicienl.exe
3060	Hhgloc32.exe
3448	Hdnldd32.exe
1764	Hdpiid32.exe
5052	Hgabkoee.exe
3080	Ikokan32.exe
3788	Lifjnm32.exe
5056	Ohlimd32.exe
840	Oepifi32.exe
2308	Ocffempp.exe
2668	Pgdokkfg.exe
2172	Poaqemao.exe
1160	Pjgebf32.exe
4340	Pgkelj32.exe
4496	Dhlpqc32.exe
3364	Dfamapjo.exe
3616	Ehailbaa.exe
3568	Efffmo32.exe
2852	Ehfcfb32.exe
5036	Epagkd32.exe
3256	Eiildjag.exe
3176	Fkihnmhj.exe
3780	Fmjaphek.exe
3172	Fkbkdkpp.exe
3532	Gigheh32.exe
4168	Giqkkf32.exe
3888	Hkpheidp.exe
1836	Hkbdki32.exe
4356	Hgiepjga.exe
1844	Hnfjbdmk.exe
2924	Hhknpmma.exe
3604	Hacbhb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fijbhpbc.dll	Abdoqd32.exe
File created	C:\Windows\SysWOW64\Efcpkeke.dll	Bnfoac32.exe
File created	C:\Windows\SysWOW64\Addaif32.exe	Amjillkj.exe
File opened for modification	C:\Windows\SysWOW64\Paeelgnj.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Jfegnkqm.dll	Dokgdkeh.exe
File created	C:\Windows\SysWOW64\Mkkgmlcm.dll	Gigheh32.exe
File created	C:\Windows\SysWOW64\Hbhijepa.exe	Hloqml32.exe
File created	C:\Windows\SysWOW64\Fkccgodj.dll	Fnipbc32.exe
File created	C:\Windows\SysWOW64\Iidphgcn.exe	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Ncpgam32.dll	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Mcjmel32.exe	Mmpdhboj.exe
File created	C:\Windows\SysWOW64\Ihbjebjh.dll	Paoollik.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Kgflcifg.exe
File opened for modification	C:\Windows\SysWOW64\Hkbdki32.exe	Hkpheidp.exe
File opened for modification	C:\Windows\SysWOW64\Jnelok32.exe	Jkgpbp32.exe
File created	C:\Windows\SysWOW64\Fbfcmhpg.exe	Fbcfhibj.exe
File created	C:\Windows\SysWOW64\Fhgcme32.dll	Boeebnhp.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Ppjbmc32.exe
File opened for modification	C:\Windows\SysWOW64\Fbmohmoh.exe	Eghkjdoa.exe
File created	C:\Windows\SysWOW64\Alkeifga.exe	Aimhmkgn.exe
File opened for modification	C:\Windows\SysWOW64\Maodigil.exe	Ihbdplfi.exe
File created	C:\Windows\SysWOW64\Cbgnemjj.exe	Ckkiccep.exe
File created	C:\Windows\SysWOW64\Qabjcina.dll	Gdaociml.exe
File created	C:\Windows\SysWOW64\Qgjamboa.dll	Iebngial.exe
File opened for modification	C:\Windows\SysWOW64\Hajkqfoe.exe	Hhaggp32.exe
File created	C:\Windows\SysWOW64\Bjhkmbho.exe	Bpcgpihi.exe
File created	C:\Windows\SysWOW64\Bmddajlf.dll	Hodqlq32.exe
File created	C:\Windows\SysWOW64\Cefofm32.dll	Jcbihpel.exe
File opened for modification	C:\Windows\SysWOW64\Phincl32.exe	Pkenjh32.exe
File created	C:\Windows\SysWOW64\Phiekaql.exe	Pncanhaf.exe
File created	C:\Windows\SysWOW64\Jfcbjk32.exe	Jmknaell.exe
File opened for modification	C:\Windows\SysWOW64\Pijcpmhc.exe	Obpkcc32.exe
File opened for modification	C:\Windows\SysWOW64\Aimhmkgn.exe	Apddce32.exe
File opened for modification	C:\Windows\SysWOW64\Kmieae32.exe	Kkeldnpi.exe
File created	C:\Windows\SysWOW64\Pjmdlh32.dll	Holfoqcm.exe
File created	C:\Windows\SysWOW64\Mgclpkac.exe	Mmnhcb32.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Efffmo32.exe	Ehailbaa.exe
File created	C:\Windows\SysWOW64\Bfllfd32.dll	Kkeldnpi.exe
File opened for modification	C:\Windows\SysWOW64\Kkeldnpi.exe	Kkconn32.exe
File created	C:\Windows\SysWOW64\Kpjccmbf.dll	Eoepebho.exe
File opened for modification	C:\Windows\SysWOW64\Eiokinbk.exe	Efpomccg.exe
File created	C:\Windows\SysWOW64\Gjnjammf.dll	Kjdqhjpf.exe
File opened for modification	C:\Windows\SysWOW64\Qlgpod32.exe	Qemhbj32.exe
File created	C:\Windows\SysWOW64\Anmfbl32.exe	Alkijdci.exe
File created	C:\Windows\SysWOW64\Lmnbjama.dll	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Aioebj32.exe	Afqifo32.exe
File created	C:\Windows\SysWOW64\Flhkmbmp.dll	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Pmikmcgp.dll	Ogekbb32.exe
File opened for modification	C:\Windows\SysWOW64\Qadoba32.exe	Pabblb32.exe
File opened for modification	C:\Windows\SysWOW64\Hckeoeno.exe	Hibafp32.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hlhccj32.exe
File created	C:\Windows\SysWOW64\Eonklp32.dll	Jdfjld32.exe
File opened for modification	C:\Windows\SysWOW64\Akccap32.exe	Adikdfna.exe
File created	C:\Windows\SysWOW64\Ckclhn32.exe	Bheplb32.exe
File created	C:\Windows\SysWOW64\Hhgloc32.exe	Hdicienl.exe
File opened for modification	C:\Windows\SysWOW64\Hgiepjga.exe	Hkbdki32.exe
File opened for modification	C:\Windows\SysWOW64\Diopep32.exe	Dimcppgm.exe
File created	C:\Windows\SysWOW64\Hfmbha32.dll	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Pneclb32.dll	Gpdennml.exe
File opened for modification	C:\Windows\SysWOW64\Bmidnm32.exe	Bbdpad32.exe
File opened for modification	C:\Windows\SysWOW64\Ealadnik.exe	Edhakj32.exe
File opened for modification	C:\Windows\SysWOW64\Hibafp32.exe	Hbhijepa.exe
File created	C:\Windows\SysWOW64\Ijagjini.dll	Emdajb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8604	5136	WerFault.exe	693

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgiepjga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnmkfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhpopokm.dll"	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ainnhdbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dimcppgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcefei32.dll"	Ioffhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Allpejfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hipmfjee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnmmnbnl.dll"	Jogqlpde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oogpjbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fflohaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iofeei32.dll"	Jnelok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjinodke.dll"	Adkgje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhbih32.dll"	Fganqbgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iodjcnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klinjgke.dll"	Akamff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnghhqdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmhgok32.dll"	Efffmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iljpij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfcae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijngkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Becnaq32.dll"	Hhknpmma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmemlfol.dll"	Hdmoohbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acdioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjgpfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebagdddp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdnchk32.dll"	Hlogfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giqkkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgpcohcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eblgon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkjaopom.dll"	Gbabigfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkefnho.dll"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hahqkaaa.dll"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpoqijhk.dll"	Ealadnik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olbdhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqbijpeo.dll"	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkafdjmc.dll"	Acdioc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekiohclf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efffmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aijqqd32.dll"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hggimc32.dll"	Anncek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhgccijm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihmnldib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahgamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chiigadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkimho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqpika32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kioodcbn.dll"	Pldcjeia.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4024	4540	Trojan-Proxy.Win32.Qukart.exe	89
PID 4540 wrote to memory of 4024	4540	Trojan-Proxy.Win32.Qukart.exe	89
PID 4540 wrote to memory of 4024	4540	Trojan-Proxy.Win32.Qukart.exe	89
PID 4024 wrote to memory of 1488	4024	Iikhfg32.exe	90
PID 4024 wrote to memory of 1488	4024	Iikhfg32.exe	90
PID 4024 wrote to memory of 1488	4024	Iikhfg32.exe	90
PID 1488 wrote to memory of 4040	1488	Jeaikh32.exe	91
PID 1488 wrote to memory of 4040	1488	Jeaikh32.exe	91
PID 1488 wrote to memory of 4040	1488	Jeaikh32.exe	91
PID 4040 wrote to memory of 4908	4040	Jcbihpel.exe	94
PID 4040 wrote to memory of 4908	4040	Jcbihpel.exe	94
PID 4040 wrote to memory of 4908	4040	Jcbihpel.exe	94
PID 4908 wrote to memory of 728	4908	Jmknaell.exe	92
PID 4908 wrote to memory of 728	4908	Jmknaell.exe	92
PID 4908 wrote to memory of 728	4908	Jmknaell.exe	92
PID 728 wrote to memory of 4940	728	Jfcbjk32.exe	93
PID 728 wrote to memory of 4940	728	Jfcbjk32.exe	93
PID 728 wrote to memory of 4940	728	Jfcbjk32.exe	93
PID 4940 wrote to memory of 3492	4940	Jbjcolha.exe	95
PID 4940 wrote to memory of 3492	4940	Jbjcolha.exe	95
PID 4940 wrote to memory of 3492	4940	Jbjcolha.exe	95
PID 3492 wrote to memory of 3484	3492	Jifhaenk.exe	97
PID 3492 wrote to memory of 3484	3492	Jifhaenk.exe	97
PID 3492 wrote to memory of 3484	3492	Jifhaenk.exe	97
PID 3484 wrote to memory of 2348	3484	Lenamdem.exe	98
PID 3484 wrote to memory of 2348	3484	Lenamdem.exe	98
PID 3484 wrote to memory of 2348	3484	Lenamdem.exe	98
PID 2348 wrote to memory of 3100	2348	Lpcfkm32.exe	100
PID 2348 wrote to memory of 3100	2348	Lpcfkm32.exe	100
PID 2348 wrote to memory of 3100	2348	Lpcfkm32.exe	100
PID 3100 wrote to memory of 1264	3100	Lpebpm32.exe	99
PID 3100 wrote to memory of 1264	3100	Lpebpm32.exe	99
PID 3100 wrote to memory of 1264	3100	Lpebpm32.exe	99
PID 1264 wrote to memory of 2696	1264	Lingibiq.exe	101
PID 1264 wrote to memory of 2696	1264	Lingibiq.exe	101
PID 1264 wrote to memory of 2696	1264	Lingibiq.exe	101
PID 2696 wrote to memory of 4772	2696	Nngokoej.exe	102
PID 2696 wrote to memory of 4772	2696	Nngokoej.exe	102
PID 2696 wrote to memory of 4772	2696	Nngokoej.exe	102
PID 4772 wrote to memory of 1732	4772	Pfolbmje.exe	103
PID 4772 wrote to memory of 1732	4772	Pfolbmje.exe	103
PID 4772 wrote to memory of 1732	4772	Pfolbmje.exe	103
PID 1732 wrote to memory of 4792	1732	Pfaigm32.exe	104
PID 1732 wrote to memory of 4792	1732	Pfaigm32.exe	104
PID 1732 wrote to memory of 4792	1732	Pfaigm32.exe	104
PID 4792 wrote to memory of 3324	4792	Adgbpc32.exe	105
PID 4792 wrote to memory of 3324	4792	Adgbpc32.exe	105
PID 4792 wrote to memory of 3324	4792	Adgbpc32.exe	105
PID 3324 wrote to memory of 1268	3324	Afhohlbj.exe	106
PID 3324 wrote to memory of 1268	3324	Afhohlbj.exe	106
PID 3324 wrote to memory of 1268	3324	Afhohlbj.exe	106
PID 1268 wrote to memory of 548	1268	Ajkaii32.exe	107
PID 1268 wrote to memory of 548	1268	Ajkaii32.exe	107
PID 1268 wrote to memory of 548	1268	Ajkaii32.exe	107
PID 548 wrote to memory of 5072	548	Bchomn32.exe	108
PID 548 wrote to memory of 5072	548	Bchomn32.exe	108
PID 548 wrote to memory of 5072	548	Bchomn32.exe	108
PID 5072 wrote to memory of 3380	5072	Bhhdil32.exe	110
PID 5072 wrote to memory of 3380	5072	Bhhdil32.exe	110
PID 5072 wrote to memory of 3380	5072	Bhhdil32.exe	110
PID 3380 wrote to memory of 872	3380	Bcoenmao.exe	111
PID 3380 wrote to memory of 872	3380	Bcoenmao.exe	111
PID 3380 wrote to memory of 872	3380	Bcoenmao.exe	111
PID 872 wrote to memory of 1832	872	Cfdhkhjj.exe	112

C:\Users\Admin\AppData\Local\Temp\Trojan-Proxy.Win32.Qukart.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Proxy.Win32.Qukart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\Iikhfg32.exe
  C:\Windows\system32\Iikhfg32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\Jeaikh32.exe
    C:\Windows\system32\Jeaikh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\Jcbihpel.exe
      C:\Windows\system32\Jcbihpel.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4908

C:\Windows\SysWOW64\Jfcbjk32.exe
C:\Windows\system32\Jfcbjk32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\Jbjcolha.exe
  C:\Windows\system32\Jbjcolha.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\Jifhaenk.exe
    C:\Windows\system32\Jifhaenk.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\SysWOW64\Lenamdem.exe
      C:\Windows\system32\Lenamdem.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
      - C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3100

C:\Windows\SysWOW64\Lingibiq.exe
C:\Windows\system32\Lingibiq.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\Nngokoej.exe
  C:\Windows\system32\Nngokoej.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\Pfolbmje.exe
    C:\Windows\system32\Pfolbmje.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\SysWOW64\Pfaigm32.exe
      C:\Windows\system32\Pfaigm32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
      - C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        12⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        13⤵
        Executes dropped EXE
        
        PID:716
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        14⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        17⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        19⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        20⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        21⤵
        Executes dropped EXE
        
        PID:3584
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        22⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        24⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        25⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        26⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        27⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        28⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        29⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        30⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        31⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        32⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        33⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        34⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        35⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        36⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        37⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        38⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        41⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        42⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        43⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        44⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        45⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        46⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        52⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        54⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        55⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        56⤵
        Drops file in System32 directory
        
        PID:3912
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:640
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        58⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        59⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        60⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        61⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        62⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        63⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        64⤵
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        65⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        66⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3180
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2024
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2112
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        70⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        71⤵
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        72⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        73⤵
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        74⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        75⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        76⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2156
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        78⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        79⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        80⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        81⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        82⤵
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        83⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        84⤵
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        85⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2424
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        87⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        88⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        89⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        90⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        91⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        93⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        94⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        95⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        96⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        97⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        98⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        99⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        100⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        101⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        102⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        103⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        105⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        106⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        107⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        108⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        109⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        110⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        111⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        112⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        113⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        116⤵
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        118⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        119⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        120⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        122⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        124⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        126⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        127⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        128⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        129⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        130⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        131⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        133⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        134⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        136⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        138⤵
        Drops file in System32 directory
        
        PID:1320
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        139⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        140⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        141⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        143⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        144⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        145⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        146⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        147⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        148⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        149⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        150⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        151⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        152⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        153⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        155⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        156⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        157⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        158⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        159⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        160⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        162⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        163⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        164⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        165⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        166⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        167⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        168⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        169⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        170⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        171⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        172⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        173⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        174⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        175⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5584
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        178⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        179⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        181⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        182⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        183⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        184⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        186⤵
        Drops file in System32 directory
        
        PID:2680
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        187⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        189⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        191⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        192⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        193⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        194⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        195⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        196⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        197⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        198⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        199⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        200⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        201⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        202⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        203⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        204⤵
        
        PID:908
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        205⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        206⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        207⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        208⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        209⤵
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        210⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        211⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        212⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        213⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2948
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        215⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        216⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        217⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2212
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        219⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        220⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        221⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        223⤵
        Drops file in System32 directory
        
        PID:2600
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        224⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        225⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        226⤵
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        227⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        228⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        229⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        230⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        231⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        232⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        233⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        234⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        235⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        236⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        237⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        238⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        239⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        240⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        241⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        243⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        244⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        245⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        246⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        247⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        248⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        250⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        252⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        253⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        255⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        256⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        257⤵
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        258⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        259⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        260⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        261⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        262⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        263⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        264⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        266⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Aocmio32.exe
        
        C:\Windows\system32\Aocmio32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        108⤵
        
        PID:3388

C:\Windows\SysWOW64\Iohejo32.exe
C:\Windows\system32\Iohejo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7260
- C:\Windows\SysWOW64\Iebngial.exe
  C:\Windows\system32\Iebngial.exe
  2⤵
  - Drops file in System32 directory
  PID:7356
- - C:\Windows\SysWOW64\Illfdc32.exe
    C:\Windows\system32\Illfdc32.exe
    3⤵
    PID:3508
  - - C:\Windows\SysWOW64\Iipfmggc.exe
      C:\Windows\system32\Iipfmggc.exe
      4⤵
      PID:7488
    - - C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        5⤵
        
        PID:4520
      - C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        6⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        8⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        9⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        10⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        12⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        13⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        14⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        15⤵
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        16⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        17⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        18⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1388
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        20⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        21⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        22⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        23⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        24⤵
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        25⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        26⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        28⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7188
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        30⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        31⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        32⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        33⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        34⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        35⤵
        
        PID:716
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        36⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        37⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        38⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        39⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        40⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        41⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        42⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        43⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        44⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        45⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        46⤵
        Drops file in System32 directory
        
        PID:4392
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        47⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        48⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        49⤵
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        50⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8384
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        52⤵
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        53⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        54⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        55⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        56⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        57⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        58⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        59⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        60⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        61⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        62⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        63⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        64⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        65⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        66⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        67⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        68⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        69⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        70⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        71⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        72⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        73⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        74⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        75⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        76⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        77⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        78⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        79⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        80⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        81⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        82⤵
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        83⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        84⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        85⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        86⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        87⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        89⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        90⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        91⤵
        Drops file in System32 directory
        
        PID:8512
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        92⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        93⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        94⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        95⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        96⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        97⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        98⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        99⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        100⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        101⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        102⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        104⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        105⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        106⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        107⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        108⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        109⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        110⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        111⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        112⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        113⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        114⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        116⤵
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        117⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        118⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        119⤵
        Drops file in System32 directory
        
        PID:9156
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        120⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        121⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        122⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        123⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        124⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        125⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        126⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        127⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        128⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        129⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        130⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        131⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:744
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        133⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        134⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        135⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        136⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        137⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        138⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        139⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4472
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        141⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        142⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        143⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4920
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        145⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        146⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        147⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        148⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        149⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        150⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        151⤵
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        152⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        153⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1164
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        155⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        156⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        157⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5724

C:\Windows\SysWOW64\Ocknbglo.exe
C:\Windows\system32\Ocknbglo.exe
1⤵
PID:5204
- C:\Windows\SysWOW64\Ofijnbkb.exe
  C:\Windows\system32\Ofijnbkb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5828
- - C:\Windows\SysWOW64\Okfbgiij.exe
    C:\Windows\system32\Okfbgiij.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5936
  - - C:\Windows\SysWOW64\Obpkcc32.exe
      C:\Windows\system32\Obpkcc32.exe
      4⤵
      Drops file in System32 directory
      PID:5268
    - - C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        5⤵
        
        PID:5008
      - C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        6⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264

C:\Windows\SysWOW64\Pilpfm32.exe
C:\Windows\system32\Pilpfm32.exe
1⤵
PID:5644
- C:\Windows\SysWOW64\Pbddobla.exe
  C:\Windows\system32\Pbddobla.exe
  2⤵
  PID:5800
- - C:\Windows\SysWOW64\Pcdqhecd.exe
    C:\Windows\system32\Pcdqhecd.exe
    3⤵
    PID:5868

C:\Windows\SysWOW64\Pkoemhao.exe
C:\Windows\system32\Pkoemhao.exe
1⤵
PID:2724
- C:\Windows\SysWOW64\Piceflpi.exe
  C:\Windows\system32\Piceflpi.exe
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\Pcijce32.exe
    C:\Windows\system32\Pcijce32.exe
    3⤵
    PID:2384
  - - C:\Windows\SysWOW64\Qejfkmem.exe
      C:\Windows\system32\Qejfkmem.exe
      4⤵
      PID:1148
    - - C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        5⤵
        
        PID:5672
      - C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        6⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        7⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        8⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        9⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        10⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        11⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        12⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        13⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        14⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        15⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        16⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        17⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        18⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        19⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        20⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        21⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        22⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        23⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        24⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        25⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gfjfhbpb.exe
        
        C:\Windows\system32\Gfjfhbpb.exe
        26⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        27⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hmbkfjko.exe
        
        C:\Windows\system32\Hmbkfjko.exe
        28⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        29⤵
        Drops file in System32 directory
        
        PID:1212
        
        C:\Windows\SysWOW64\Mgpcohcb.exe
        
        C:\Windows\system32\Mgpcohcb.exe
        30⤵
        Modifies registry class
        
        PID:6820

C:\Windows\SysWOW64\Pfbfjk32.exe
C:\Windows\system32\Pfbfjk32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4152
- C:\Windows\SysWOW64\Qffoejkg.exe
  C:\Windows\system32\Qffoejkg.exe
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\Qnbdjl32.exe
    C:\Windows\system32\Qnbdjl32.exe
    3⤵
    PID:6028

C:\Windows\SysWOW64\Anncek32.exe
C:\Windows\system32\Anncek32.exe
1⤵
- Modifies registry class
PID:6644
- C:\Windows\SysWOW64\Aeglbeea.exe
  C:\Windows\system32\Aeglbeea.exe
  2⤵
  PID:5556
- - C:\Windows\SysWOW64\Bghddp32.exe
    C:\Windows\system32\Bghddp32.exe
    3⤵
    PID:7688
  - - C:\Windows\SysWOW64\Bijncb32.exe
      C:\Windows\system32\Bijncb32.exe
      4⤵
      PID:3876
    - - C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        5⤵
        
        PID:6772
      - C:\Windows\SysWOW64\Bbbblhnc.exe
        
        C:\Windows\system32\Bbbblhnc.exe
        6⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        7⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        8⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Clmckmcq.exe
        
        C:\Windows\system32\Clmckmcq.exe
        9⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        10⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        11⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        12⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        13⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Diopep32.exe
        
        C:\Windows\system32\Diopep32.exe
        15⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        16⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        17⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2892
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        19⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        20⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Dblnid32.exe
        
        C:\Windows\system32\Dblnid32.exe
        21⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        22⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ebagdddp.exe
        
        C:\Windows\system32\Ebagdddp.exe
        23⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Eikpan32.exe
        
        C:\Windows\system32\Eikpan32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        25⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ehpmbj32.exe
        
        C:\Windows\system32\Ehpmbj32.exe
        26⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Ebeapc32.exe
        
        C:\Windows\system32\Ebeapc32.exe
        27⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        28⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        29⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Fghcqq32.exe
        
        C:\Windows\system32\Fghcqq32.exe
        30⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        31⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        32⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        34⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        37⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        38⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        39⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Glchjedc.exe
        
        C:\Windows\system32\Glchjedc.exe
        40⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ggilgn32.exe
        
        C:\Windows\system32\Ggilgn32.exe
        41⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        42⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        43⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        44⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hhobjf32.exe
        
        C:\Windows\system32\Hhobjf32.exe
        45⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        46⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        47⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        48⤵
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        49⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Igghilhi.exe
        
        C:\Windows\system32\Igghilhi.exe
        51⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        52⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Iobmmoed.exe
        
        C:\Windows\system32\Iobmmoed.exe
        53⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        54⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        55⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        56⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        57⤵
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        58⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        59⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        60⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        61⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        62⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        63⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        64⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        65⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        66⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        67⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        68⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        69⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        70⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        71⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        72⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Qggebl32.exe
        
        C:\Windows\system32\Qggebl32.exe
        73⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        74⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Aqpika32.exe
        
        C:\Windows\system32\Aqpika32.exe
        75⤵
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        76⤵
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        77⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        78⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        80⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        81⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        82⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        83⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        84⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        85⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        86⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        87⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Bglgdi32.exe
        
        C:\Windows\system32\Bglgdi32.exe
        89⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        90⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7704
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        92⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        93⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        94⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        95⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        96⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Capkim32.exe
        
        C:\Windows\system32\Capkim32.exe
        97⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        98⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        99⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        100⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        101⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        102⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        104⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        105⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        106⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        107⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        108⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        109⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        110⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        111⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        112⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Ejdonq32.exe
        
        C:\Windows\system32\Ejdonq32.exe
        113⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        115⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        116⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 400
        117⤵
        Program crash
        
        PID:8604

C:\Windows\SysWOW64\Ainnhdbp.exe
C:\Windows\system32\Ainnhdbp.exe
1⤵
- Modifies registry class
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5136 -ip 5136
1⤵
PID:5772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
1.2MB

MD5
882edc39ebe33c749fb167cfb5d06cd1

SHA1
21cc795e2ec9502afa4bcd9d74f78dbce1117b9e

SHA256
4d26d6ac1ac5793e2dcac285b156ae049461e19f14d382ea12bd8d3dc265ba66

SHA512
de31246ac7256e4b5f1d1b3e328bd60e24cc019ba425eb0460263f0a27e751af5191908769ba1d26a5c23d4548cbce995b82bd5d943d508779553a9fba0923fe

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
1.2MB

MD5
468a709f2c6a31bb1f4ff69809f752df

SHA1
a8c87824438a51a327086aab310829b7bbb6d829

SHA256
04737558e6e4a3f200ffb9b07df95367ca8d3d5b16772bb1117176434a2c206b

SHA512
07d29161e01bb037762e145bd2a9a260835e2f8c92e2d842431c6868325efe0c5c08b0d466cc11c2e4c2d81f9a54e6a9b6497512c86b8ba01007129b211ea219

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
1.2MB

MD5
88a97f37d5dcb622702ed70c4e85853b

SHA1
6dc4e80ebffe8af3f489f72665fbc89d30084042

SHA256
e17c25e00420beaf2282b31220fe642a7799ce12ef304baca5dc5c313b744fa6

SHA512
b1169219222f787de47f47e7526b8dca183846d3299ca8684f5d5e1922235c8715cbabecfbcb8bafed0d216836c30c92770b0430e3d3167cb39485cce584c2ba

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
1.2MB

MD5
71e542c6177733d39ffb6518ed7d3d11

SHA1
dbb18aba736c46f8d74fddf7d6d60592f82cd6b0

SHA256
b048cc4161fe28a21f9e50e231a560b9e4896fe04c1ded9f157db49bdf0d9454

SHA512
699e5abeba8df2e5d3b537922497fb6463a25f6da410b17ab640adbef3e2a1cf7cff860f7463b79b580e4bedfbc2c0062d6f71ad87a87c20b3bca7ba6fdc6a5a

Download Submit
C:\Windows\SysWOW64\Allpejfe.exe

Filesize
1.2MB

MD5
ce8764f294a02af13ad6ec9772f23b50

SHA1
015aff42dc9c6cc5609e0a9e8af40ca75cd60f92

SHA256
a5e01b639cb544de924b776569a3d906906f7f5605f3bcb2f1d5734c885783f3

SHA512
de3ca831d465d96601e8104e4aa27dea9f118b742df8a36a92354951947eee80d8fcb45d69178bbed46a4b85fddd22ace55a083cc35794d5665b7a5e7d1712b4

Download Submit
C:\Windows\SysWOW64\Bbdhiojo.exe

Filesize
832KB

MD5
dacc822e856819e99ab5c9be9ccc2452

SHA1
1ea508904665cf8fb74678d1db256b533e94ae4a

SHA256
fa14e09d98ce88962e6864a80d43051f7dd8c8aeeeb4a2994ea15ce19003ccb8

SHA512
2696a1a22b408e1ae4ad01e78e063753f5312a444b1a4eb9be14eddf5910de4d4e609ed2e29ac57f8d18fdaf3adda75364201ac9c242f84c526241f3b904cdc6

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
1.2MB

MD5
2e63659daffbd130146cbace71a398c9

SHA1
23b5f74262a22e201bf4e5f4cf2c703f05bd6d80

SHA256
d89e95540adc714f64e60d7e19e02362165ca40e57eda5666171bf42b463e99b

SHA512
34db8ed1eaa901efbcbd5bb39b33321ecbb037bb4b1e67e7331ba337c38d0cbd02f06d78ee6b5d6d70d42ca339a5ff2fffb127ca952d6ee9c281cc946fdea3df

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
1.2MB

MD5
9885afe7069e189cc35e313638527fa5

SHA1
ab22519fb0ba7e037693a14ed1d9e7146e812d8a

SHA256
5afecc5fb3a365cffe7a31bd4c80f549f0ebb0798d46fe9299fa626c01327d9e

SHA512
7d7e9dcb851e8d465d76ceb82c71fb977f9cfbdc344e90531c6de96a974dac2ac584797d08393d5e7c503d87dc8d8cdf8c03c8e2e56f83c65f879cb9731c8c11

Download Submit
C:\Windows\SysWOW64\Bfendmoc.exe

Filesize
1024KB

MD5
4b71a7ea03fb37cb572f2272a10871c4

SHA1
9ea56ff2b2a56541794f38b17b003384a2f2a534

SHA256
8dd30f06b0e0e31f518dd8fc77a52180c9427da11a057d1630c408fa2de966c6

SHA512
10dd64805765cd4e4667a21d07269bda25a37436f9c6a3d335d7e7e52b680f4f62cc7509ae67392280e0edff1cce360e2cc695c9dfd6f4ba0dd5adf33769b1f9

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
1.2MB

MD5
692bcd745aeae773d3a8dfa6f710df05

SHA1
bdd840437058f25693450b565270e959b285144a

SHA256
8d8e1e61894a5dfaf363001bf4441216ff405d0d0ed5d99518457cc765fb7bbf

SHA512
7c33fcc9cec6c88c4119c131064402ce9bfb9be3628fc51e17d7a1ffe6c6482c8efca886d54fc43d4f8dac453a1d2bcfe924bb4cd69be39e1b0bc89c8bd75f4a

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
896KB

MD5
4c13748019b483c18a72f077d03f6f6d

SHA1
3c619cc5939e4124c16c295b69b694c743f763d2

SHA256
d9a70b6e8f155ec8c796aa42cde292c3f604caf5cd9a65b84051dbf6c6c367aa

SHA512
0543c477848eb4a1c7ebcd6ba8628ef94be21080a774f0b984adfb8919548b39485cfad2d3fc463e781603b0f77af45b2f8f92a2f95050d7185a43629963cf57

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
576KB

MD5
a28c9eb53fe16d2d8e9edd3640124310

SHA1
32a1b54d88f3b35ca294e19929d105c7e1469b5b

SHA256
5077787d785fbff9bbafa7c2fc472d0d740ffe5ae07d654c1a28457e25ec1fbf

SHA512
9c3076b840ed7bd4fac16686e2daaff2456296246bd2bc62591a0649ff6eabe26c845a77d3893df15f88d0f2663df2a1d0fd9c0a67fb80fe8204c9c930b50b1a

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
1.2MB

MD5
a3e4118b6dd0069ce4711851c71e8bfb

SHA1
8f2a4b804d5f729142e79022383edb209fe6e4c4

SHA256
9fef6ec036937972155df5a6cae7915375ca52a53106dcb3f96d7d9c440a5ba4

SHA512
dee36bb9a04da8d0a6390ffce3f5fd6d0b0f83ef81fcf8e95490cabf0d2fd8186a8887ad7fed03a1ead4aaa335905a4e83cd2841289876e5a3d4db761c463a76

Download Submit
C:\Windows\SysWOW64\Dfamapjo.exe

Filesize
1.2MB

MD5
29fa661c7745cd6b6b56e034d8c42ba9

SHA1
77a2cde10ab905d2446f32a4cd09b5f6feaf4480

SHA256
ff5bf8a780f35a57b3d77a6b86b77efd819380b26b52a3e78f5b91d280f4465c

SHA512
abcd1a3a3e5a55a2d65b5cf12c4038a06b6df165402abcd12008d1d27e4c1d2d0114d66717d12683c88cf858b7532cd047466d883bf99e8dba759eedbe1c50ea

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
1.2MB

MD5
6a76343ff40a7af15fe9e0047387565c

SHA1
28b042b4ec6c97695a37d3a6ff7b4c8254aab553

SHA256
ec6f16c8932a055960f2d1d5044110845e7b99cb3fce4230cd8c36dc88f3843d

SHA512
ceb6c2d709a40d38a3668b7b5669e4a20e015625abb83804ae9eab249fe26363d67064640d8362e9b7b339fc585630b3a8a1a3da5b47e45189c18b81ad68aaf6

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
1.2MB

MD5
00fff460135ca2cf4c07d044760356f6

SHA1
ae10151cdc9903eed9c3f8e290c639b0e8029288

SHA256
ec7cc76bbcb3b2c77edbc2f877315d46d1b53f79204bef2bede15225cfb9d9a7

SHA512
f689123914a71a0175acb67782f3bbb27de51122c4795957997f7a57b0107a1ae507263b36c3331b69c1b961205b5ea96fbd686b7080a70ba940c56f2771667d

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
1.2MB

MD5
bd660ab6d9281d665b499df4978ecafb

SHA1
8618afb29ff03325729d514f988c3fb0e160944b

SHA256
72e948999e41a6ec5eeecf698cab899f758380a42ee48a0915503472fecba360

SHA512
9fccfd83cc793fbcc2ae66c56dc03f9e7575f1e388870e8dbfb84ec172f44a42407b36d8007b253ce4e535ce702dc113fb3d3d5240745a6341d5c3c859704134

Download Submit
C:\Windows\SysWOW64\Ealadnik.exe

Filesize
1.2MB

MD5
50129ad9f21ce3a1eb47ac4c4359c916

SHA1
7569b632fc1194cbc27b9e037efe75ed14d9a6f5

SHA256
2b5f542b28dcd8cc523e8f3878283602cb4ec32188cda0499ef595840945f2cf

SHA512
74def19bbace433df8719f3982924818580753bd3a8b539a9980dd796c61224363b0d2e10230cd24e039c820fb400296ad28f33df4fa8df36dd8da63f7893894

Download Submit
C:\Windows\SysWOW64\Edhakj32.exe

Filesize
1.2MB

MD5
60896757a6d93d3e7faed0f4f4e347c3

SHA1
3253deaa197fbb2e1cd5eb8b5504260dd06b512e

SHA256
15a96c7655de82e222326e1d0263dffed3272ffb1e1a4aaa8fd3fab267e6e06a

SHA512
69502da5484adbd95d1f5b5cf574bfbf33ed3833d5a9fc86195349f139b875e866001035748ae7991ff5c2ea13c9a0cf544d8193a324884be5c138ab66020e0b

Download Submit
C:\Windows\SysWOW64\Ekiohclf.exe

Filesize
1.2MB

MD5
befe6292426a723acb3218a4f9b9c7d2

SHA1
05689b0d42a0671b66a29dbbb5e271f8616184b5

SHA256
091b3771c97e0b9a0e8f4fc61dbb6c5a145b69d9022c623b765e03bbcada0925

SHA512
e15f8a85441582677d85fab371035aae262744fb2fb97dc4327ed5036634b587af4c9bf4d44a69f02c3026d51f0b20800e35937a30e81640b827fb47bbb77e30

Download Submit
C:\Windows\SysWOW64\Embddb32.exe

Filesize
1.2MB

MD5
a6577dfabbf344d063cc000ef3dea39a

SHA1
6ed0e546bf988f6cffedfb58a83c523c87b7f641

SHA256
fe25b76971dbb64f07ce72f501038dacf5fa4259bccfe86f1eb55cadb9e5c91c

SHA512
b0207adb491f7cba8d606c49208ce45d894ba5808599e1d630cd718235430ac29b2d8dff7e368cb9f6c348e2c5edb627efd850e4a34602222c00ef0039a14d0d

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
1.2MB

MD5
bf68399bed42b58e1b51234d256c80b6

SHA1
7b1833a7a9d111fd08d530501f119a324350fa45

SHA256
a4c43c1d5dbb6f62097caf5d7638ae82177152f488ff98a51de53115c71f4481

SHA512
4cdc2edba24972f31900012b2ef7f41fa2be405c6f8a51f3f11e98687b957a8e49133474a962f784833ca10eb7984e15feb57206cf5f4da0f5ab9e99fbc949ae

Download Submit
C:\Windows\SysWOW64\Fefjfked.exe

Filesize
1.2MB

MD5
8906a896afa2260b35bbfbaefad9aac0

SHA1
699b0dd3d7d43c80798f959c6735ba9570dbf4f2

SHA256
a5faaa3bd34cb9ee6c0888b5367ec3d9f654e3ce8e14fb0f530301ef12eba8fa

SHA512
2c645bff44cc8a9de9d7f4c9464e90174b66b25c654c7ce0367e9c6ddecbab819b649e8338b4de212584d38e208434eace4ddfc1cfa1a58c54ad2b9894b29e17

Download Submit
C:\Windows\SysWOW64\Fefjfked.exe

Filesize
1.2MB

MD5
4cdcaefd7592afebdd7f8ff52125cd52

SHA1
3604859bf451c75e777224fffa7069ed40d8d2ca

SHA256
bd08fcdaf80ac479ba0aac38fe3e47d181253e9c0ecd5bcfe1f4274952632603

SHA512
e86a2b51c9a128107a733ded58f23598e2945c799889508dd7dc7d4f46b825e8bfd8781cb647d0617c828e6a6dc0d64a65b468eb2f5a66f1905882c9d19822b3

Download Submit
C:\Windows\SysWOW64\Fmjaphek.exe

Filesize
1.2MB

MD5
cf4988099999cd9770b0f135a7830fe3

SHA1
3f3292a26bb529478ee6e883019001d682734865

SHA256
ec745126fc9365c8300be9fcbce310848fc1f53ea0aec0215649bdb62d0084f0

SHA512
5144a4ab9e51fd74c55fd14ed5219be52b8afd8189941c2897327bbfc612efad1fc5b7c283cdb5d219111c0d5cba5c0b0f280869d30b76da48c478ac395b5913

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
1.2MB

MD5
4266af20e4b6ad16243550682f5a355e

SHA1
de9f6f8696ba7364a293cd1c58fe79af402f4403

SHA256
07da7c4f3d64852e9c84f8f0367957bbdd994686a8285e3d7a8f6fa2bd96a57c

SHA512
25aca5959d58760e23e50a7827a5a03c73dea734a12734290eb3d64ce8fdef4a5f3037c861635aeb3a0bff147cee156096cd6fd73c20f37962eb3252069938f3

Download Submit
C:\Windows\SysWOW64\Gdncmghi.exe

Filesize
1.2MB

MD5
4a660a5545f4b6fbb65c61eb04e8835a

SHA1
7c0d2192d875d7cd5597530f77fe44667d9d8fc8

SHA256
7b5b04f8ffe2bc8f88e4244db0c35aa5982958fe71f95db02e59f072b15fd778

SHA512
0b4b3f82da9fc6a227eedf2b70d153bcb39748db1670e7073c99b1bd9d0e590a7ce34abd33c9b7df246a99760063ac960299b5d01bbd5a919a8362221d9d79bf

Download Submit
C:\Windows\SysWOW64\Ggnlobej.exe

Filesize
1.2MB

MD5
6623a833e1bae37f14f9adf02f1a2321

SHA1
8706cd990d034ac112fa27a8ff79f438057e87d6

SHA256
3630223017cc68b531933de35eb0731d073d580bfac8508dab5de3aeefd2e2a4

SHA512
afad1bbb530feeec7fc40d95905ae8ea2b7d30c1fcb0cf00aad09b708d478cee174a51659fd84b6a3569099c45886de46bbc2df02a21909737cdbc97fe312226

Download Submit
C:\Windows\SysWOW64\Ghojbq32.exe

Filesize
1.2MB

MD5
54d39278174712450b456904f6e628ea

SHA1
26817a8a9b3474b2e5d8b90c7bce5bca02e421da

SHA256
cef3124459ee991141bde5ec643c01e42993ca78141b81811c56c0eafed9cb89

SHA512
34d61d4c7f7a1880c98ffb77f6c80e8e2e076ed7c1fca50722f95adf70fb39906a0a97956502bf9dc9edb048f656e086ec1b0ef74c637d2f17e61a87c5de0a21

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
1.2MB

MD5
86c1cfc3cde591a0d7523453b42fa456

SHA1
95a0521c09cdf900dd3090b105871995b3149c43

SHA256
e30a4903c3974cb2588fa216c5e4606ebea40f31f5cfad9ad54cfe68496dd9d5

SHA512
b579801cfc0f461229ad14c026485330dc12cd64d7e271b5e572cd9492fd5cbb2c40a22ff2e809d37e6e52dffe713e786c12fb243f14b4f77eeb535cfd27501a

Download Submit
C:\Windows\SysWOW64\Hacbhb32.exe

Filesize
1.2MB

MD5
cfe0d020c2a3515e2f53719d774f977b

SHA1
333347544fca1b24931f03016aa5936ce2f4e8a9

SHA256
27c505371524d1d747b40f256370da3e1fe7252ab19bb2a140645b4a70fd016c

SHA512
4b50ed9d47595618ee3a39edbe0715fe4e3e994deb9a0b0824ecf0e1df76ae54dd29c8f56c9bd561881cd239adfcbb1937ffb5151c001bda603f531d97066dcb

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
1.2MB

MD5
c9677feffec8fe5aff64d4791adc0a09

SHA1
290c4b7adb6f5cde764eb225a6dc31d01fd8cd34

SHA256
c2dfe405289576eb8cde4064f045c4b6cb588b5ad8e2f0a07ae6124b65a7639e

SHA512
a2f560b5d41a78b6be4c2efa17d12ef3eb516a8875472356b06704ac20dea2164e32b441111179bffe53fda61f5d552d91681b9d5c27fe80dc0d8ec9b0d90fc7

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
1.2MB

MD5
2866a2ecc4cebf926950b03ece63c615

SHA1
13e1ce89cd5cab128dd66d44c20292af04b5be0f

SHA256
8c69b5364d47c80e95c08a0c4916d5688588cfe068b6e0967f41ef512f8af184

SHA512
94b0bb9d0f58795ad23d36f96c84c485f2ea97749c87d159d97816d7fe6854656105aee9fa6d903b09aeb0fba9f28d88eb7da37739c24f4c650b35b6752aaa08

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
1.2MB

MD5
6b20b679aa9dcfc175f0e5d54f30816f

SHA1
ad5641c3b31d42f8956446f2113e44b96f37423f

SHA256
ea2b4594a7b2ad08d3e4b7432414f5e05d0a079925d8eee25df91e46db751ed0

SHA512
41282fd1f52172766b28b7d544160b61217f97aa03b46da6f2c5bcb42cac308213cbd007f43d8dda358726df0d02a93bcf0f3ec9ee77a6c45dcd23e342c79f31

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
1.2MB

MD5
d1b5d439553c6bf13fa322bca8630f5d

SHA1
4a7cbfd50ff740c7c082e58fc36db3309f526b89

SHA256
935697b6694c68e0a350ddac0cb4e4250eb98c39aeb830bb027f93e8b9e8b6f7

SHA512
b8cccf76fd228aa25776869d73b535b17b53e7b00a67e2de4145ac9b7755dbcabb961046ee20f2aac11c7be645b3c0ede323810ed86ccc8c0bbbecfa5024dea2

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
1.2MB

MD5
dbe774d67cf74395f997aaf016dfe04c

SHA1
727c8b051176648ced4fe40eae843a0c105f57d6

SHA256
4497672b49494c829c8fb095c1ca1cf4e756a0abd6f0594f776fc6c5714b47c6

SHA512
a8d53052ec32cb9d13a81a6994d71dca9ee367e4eb552bbb941fc729e8211543cd601fb6dc5dbd22cde0a150b2c8e83726997bbc3b00e488851095b52124a5b8

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
1.2MB

MD5
90a61f86784188a1f350bb8e12adafd7

SHA1
69bdd0cf759bd4a60fc960f6acd99fb72bb717f5

SHA256
883d431d6c9b562e3e9eed6bb458b88a6246662c6902aad77b0808f13ed9cae8

SHA512
e64e5def73d2e55c7b2540c8da2cccc320e06496299a8aa7f32f97d0c25446a3a3c347204695ad3b40988b7dc77d06e035dd730b91adcdf2cba9116ed9a1f6ce

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
1.2MB

MD5
fb85d5905825176b6fea1255abb0d853

SHA1
3f85d8b3ebe609cee2e32425ca5cec6426889c45

SHA256
3946cd406c4df4def52a10a3c4da8794e76ed65268b293f2c72fcf77bd80ffd8

SHA512
95c70d822ff9edcfac5c18c3e9b02435466ff82c590afe2999d081cb540c6558bde0a16d084b0d2c8b0cd4444c108cfb3933413abd6b882175a992ca3357e1ba

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
1.2MB

MD5
0ca0acd21695a1a40263bbeb9ad17900

SHA1
75e05e30194ba005983e248322df75de5d467614

SHA256
c0acfad5e446e96c07a8d56d49e925bbc6f2c4d10a20a0b6bd3f27d615505219

SHA512
900b717f555965cc349171dda77904d23304b1e4cb0d86d7a370baf8f40c7b86a80af4e5f69f03b8dc80fc489c9c96d1f0aa58c7607cdfc967fea8b8bb767906

Download Submit
C:\Windows\SysWOW64\Lcgpni32.exe

Filesize
1.2MB

MD5
8e24c9e782ffebaa75493d2666369fc5

SHA1
77212d5d4d3d479fabdd7b9592413be66f810a29

SHA256
23ac78b020e33ace27c526abfa152af381964cce17672721afc93c215d3aec72

SHA512
2013290cd9e32d5ec7733078821f1dd8fcab188ac10be8c05bb2cb865f947d33608b2643f1e535934b3636e84efd02858c48e5292558d3fd20bf78cdfeddcd37

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
1.2MB

MD5
42d3a499b6efe9ac810c8b5289702559

SHA1
eb097c2c7d487bfacfa3d3679e6241f215454f59

SHA256
a5046974a5604eca1fb3896585fa2eccecc4f0712e5d792d191d11592e31999c

SHA512
ab4aa9356b0d98423ae7bf6072b3277d9e6aa3dd0341214882ab22267df2dca86b15260cc3dee1df57fd507cedc0ba2047acd260527a45b1f6f7ff0ea8f12d48

Download Submit
C:\Windows\SysWOW64\Lifjnm32.exe

Filesize
1.2MB

MD5
02103f395275c86eed36c74071aa5ba7

SHA1
3d65cd3c97552154f9126271b2e3f9297ff96758

SHA256
54ce8717ea20e8f77b4bdeb9c4826e828d62522bb14cdca43683053609d3400c

SHA512
b6ba1a37491aca02198c929242fedb4271c08f234402081a11b2d19578514c2fec35d27476fc1bacd6c2a1f69c0024a3013f8e643190fd04226e5de436467830

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
1.2MB

MD5
8af133e48edb34cfc092b82cd0b31eef

SHA1
04f5d393e5fe91e438fdbc405ccb752c304d69b7

SHA256
2b670d68abdafdd0ba8f1bee101a076fe14322ab1d507b13b516ad3f3c78a6c4

SHA512
23ea636c8e8acd4c8ab2cb9d3c2b9add4878041bb1e3b91e99abd4d3c78c3ecca9aad821efd73169374b899b44512fc05cdafda0e0bded582ba332e227f8ee9f

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
1.2MB

MD5
0e3ed1365fc74e30e101c02f42967944

SHA1
a9be68d9f321942469964f7fd23c7c5a388501c4

SHA256
e4774982de7678356cd24ccaa3909eeed28d26e1ddaa5abfa0a7a052fb7f0bae

SHA512
b1c30b2f1287256944d4f496e23ce7b9ae8077747f04e2d129dd270289e2e93265787ee38fd853f48b9aa134cbe5d1b8ae65ba3ff3d9c52502a8781a5c35f57e

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
1.2MB

MD5
5dc3e40d18f1cdebe05d9a63873c51c8

SHA1
fcc607920d9bd3576aaadfb3590e793862c105f1

SHA256
a071526f503e959510c3f4a992a3f8b21a40df5a1ea01fb5addf9e65d6e8d4a1

SHA512
6bca9e554e0184c34e3bb5d3007621f5f50c41e58664fe90c44db55918b428e05cb161c63dbce8c2a277cfa749681ec77db20baf2f7461de7d939852bca76964

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
1.1MB

MD5
c04285477ae301a573acbdea97279c5f

SHA1
f0bb545124a89742bb8a6b2fbcbd9028e0836432

SHA256
02992adb5dc691a67bc9488062bdd8d9a54b1b11eacc6a901fc8efda7dc938b1

SHA512
a84a0a06926f055acaf0ede1968f79b8b2b7ea9df2dbd48652148b80403112deb035cc07418539762f20b5405604ed9e07ef170618d2f7f28d3ceda26b358f3e

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
1.2MB

MD5
8e70791f79f848243b775c8a7e3095f1

SHA1
fdac8f7ce9cbf9f47c27901a0530fc3344991263

SHA256
7e7e1fb4c62dfdf998a37202f55317895a34fd6727c2b9e32954981a6b545b0d

SHA512
6146e749917571e9c17484a1ceb8a1d4a299b762bc6ed715e14830bcd3c503acdd24b6953a6957b0479418f6bac6ea4011271885a87fa83a463adea8508aaa39

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
1.2MB

MD5
5c04b59a07ba133052bb456f42f23f59

SHA1
b13b81c9bdd9d0e372bcf6c0436a9a29eae97534

SHA256
d54c35ef5a0317ffafdc77fb5e0caec6cb9676971e7d289a3fe61caa0ed7d5e5

SHA512
56fa1b135c3a98bf7687cfc2e77d9c165a410c785a4b1b10741bcb207c1fa2fc2c92ee78ba35a8ae0e69258aed03c6d274a48b96f1cb8c7aaa8bd8af2ba5d007

Download Submit
C:\Windows\SysWOW64\Maodigil.exe

Filesize
1.2MB

MD5
4bb47d9cfbb0e14a0a9aa871351e2dfc

SHA1
0693054ff2bca918f78fdcc19aced63e29aa01bd

SHA256
d25b305d58e17c292a3ae7a820dbf85d575a75323850cc51c5e7bd7b3332feed

SHA512
66206056e5c00fdb6066af0874b974cbc0abda4702d4a94c3535f0d97a485d505f5667e1b0dbc5f08035002001a34f7329a39a0ff6da1fb7c1e89991a11fa9b9

Download Submit
C:\Windows\SysWOW64\Mcjmel32.exe

Filesize
1.2MB

MD5
4248191d41967ab15b00623de5ed584b

SHA1
9f20af4919ef40b84db64f08427cdb4101ff2bf6

SHA256
3b49f651e2e79a5c38e1d63fd8fba9705ea8c8bd5f7995e42f8ae1644a468056

SHA512
f7c66e16ac5d25dbb9bc74c8c08f252004a33c68cc59ca5ac65f4975c9910dbe24b43617ab450b6f73890b2fff497585bea12376d962edf07e13bff8cc1e1783

Download Submit
C:\Windows\SysWOW64\Mfqlfb32.exe

Filesize
1.2MB

MD5
db16ea9dc6bffe9bcb582e1e7d912d3f

SHA1
d1626b3676167635b3f7dc42ab5cafccb4e543bc

SHA256
48513968829fb92d00b30022b4b5ecd1f149fab0158d8a6db77656fe13d7e011

SHA512
6d0ab29a0a34dccfef3d881efe89ada1274964ae7dc85ba2572107847559b69e9d8dcd86b4001207f183f1de508230289c7b8bdca2629c4f2d60e3341801246d

Download Submit
C:\Windows\SysWOW64\Nacmdf32.exe

Filesize
1.2MB

MD5
1067d4d41f1a93cf6bb492e46dab0086

SHA1
f937553a103893c80fc98bc59346c3780a332392

SHA256
6b1505947cb47803d9f1ec44434b5111de06ee1da037fa22c78ca3698d55ab48

SHA512
18d4a01efe25104831373683e53ec7e362cb619ac1df04000474a22bd35714ae3e7564da1e40a1eeb79f65b228135e866582bcf851ad2e68da763949e23f6776

Download Submit
C:\Windows\SysWOW64\Nahgoe32.exe

Filesize
640KB

MD5
7c5c0c6ee935cbf9f0fe4e57d1c94545

SHA1
bb00d49dc0da6eac04198845bdf7929b618bd9ba

SHA256
70e16a63a2090098a91578254ef69412ab9f2d4c628e09c7615f1d0f8dd1b2bc

SHA512
2492e7eb363873e6872ccd2dc5b9768ba26f234dd8283fed32b133e2d77929f287425bf59f45c00cc7b0a179b2a15c6bdd556b1319050bccdbc39c47c4eb6fdd

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
1.2MB

MD5
549d978dcf3d006e6b87b771948d8e44

SHA1
87b07955979f83824efa743f13d1da64d1a07dac

SHA256
93e96f63cc50595e4297105fc33a322078686c1ecc9fbb790d7db10be834c93b

SHA512
be9b926e36f01ef7459286f9518ccfb5e9e69c5c4bb515bfaf709b62fe7a34c156d85106b3a463e3639ac0b6efe504603ad065ef50eccaa985898e797b645ee3

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
1.2MB

MD5
f59bccb257672a90cf8e46c2c6743cb1

SHA1
efee3c3bbb397d212bb8a5b36fb860af1024a66a

SHA256
c8e1acf3c50aeb89fd6ef4f9b9d631997e0f98c4703bc832f564ad145fe6aa84

SHA512
049976094abf4f16d44797274a1501829dce513593d2d924a4f8dcc89d31eaaf85b219c261c437d3782052f70627d9d29b2553f01c801d37fbb62c7546c7570d

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
1.2MB

MD5
5e2e2eea590aad6b6fbf0714be7fd160

SHA1
9207733d8349f350ef4afd72ecc1f2e18ba78745

SHA256
ab3807b5dd75e49580ae3d14d97514d99098ff43e4aca0e5b32c322fe200ac60

SHA512
5c3b4ad8de53a00166dddf5bdde54002068f1a223b20c6aaf74035b6b1a1582380c2a207e1b82928f2b87c89151cb296b26c4cbef99a580b12420bbfa28cb7ca

Download Submit
C:\Windows\SysWOW64\Oaompd32.exe

Filesize
64KB

MD5
1a4bb3c343364ae13cf56677b056a157

SHA1
a3bc74527874f509604dbf23af99396dc4122ffb

SHA256
b9c930c688fee774be78ad5c98a26604d79e6cc9cf82bbc7cda652c3a890fa0b

SHA512
a1c70c23666b07824405641f8c6f37e91dd73d524ff01a0075b25e65cc6c62635e7f8570fd818d52679d7134ce13aa25ffc206e13b9c9cc4fefadc48a567497d

Download Submit
C:\Windows\SysWOW64\Ocffempp.exe

Filesize
1.2MB

MD5
5ebb18cc688a427ed2721a4e6f27fae9

SHA1
e137fbe3138451d436c8dc4ba1bdcd1aa18a21ab

SHA256
993e4dca9a157d567019ab12f8866193083bb7ab184d1e7a6984d800568f6f35

SHA512
ef4efab443863c9b74a94e603be5afd3445886d2be1cd0ce8933ca8e6e5717f9778168fa9cb5980e4d9d069bd39bbdb9c66eaadbfdb0a69231f20dbdc9a90a17

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
1.2MB

MD5
2cb48a78bb20e22ac0e1efae22523550

SHA1
16454ee8eec6c7c66ac4841f2eab4f860a07ac31

SHA256
e50d66a4391c5767e64500b5831aa9dab541b1af6a37d98fc4d910b31fe669e7

SHA512
05fcc44b2276ead5601e06d9eba8707a017c54951224360ba7a66458701f2f93d33581288b4b0ff04183cdbaa3ae2e6379e42963484719496f8528aad4f83a01

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
1.2MB

MD5
5952be6f6602c753d6c06ec3d612f6cd

SHA1
171b75ad65d04fb248f2269e719a72154f89d569

SHA256
2dc4381ea9e34ac62cb58d98026212ec72ba1691b3f01c1c303c07822276220f

SHA512
59fd104175088d1424d7531ea6c7896623c352b4b9c3f9c394ed1866606a6d2c91d45c60e62efeaf2de042b53bc0f2164e4d20b0bdecd4cc019d5e01eb40cf9f

Download Submit
C:\Windows\SysWOW64\Qadoba32.exe

Filesize
1.2MB

MD5
460b5c868200e35c4df573fb6b4a4765

SHA1
044e9ab1436eaf459dfee631036c4a7766a6b144

SHA256
c8274fa7975e21dd93cad8c4930329a9f44921999a5654b7b5c9cc6767910a7e

SHA512
1d9a89585cc0c13527537db5a4574c3c3d3e6b2d16b4817df053319cc537d005d52e7892346723abb1ca27b0614c8d4fb44ff91c916ea504e807a48e6bc40fa3

Download Submit
memory/548-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/552-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/552-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-43-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/840-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-35-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2348-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2668-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2852-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3256-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3324-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3324-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3364-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3448-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3472-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3472-392-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3584-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3584-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3780-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3788-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4168-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5036-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads