51b7b1839f74d43760de9a72346f1c0d697868c05d2a93d3184372d3181fc433

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d180c280310c6702c2e69305796bdc8_JC.exe
Size

110KB
MD5

8d180c280310c6702c2e69305796bdc8
SHA1

a06e32e4d180c829b10631cf6e07f11ffc3b86a5
SHA256

51b7b1839f74d43760de9a72346f1c0d697868c05d2a93d3184372d3181fc433
SHA512

6f093348684f3edc1e5f8512ccae32d9901dc03a66f3797bf96600158feadf3c4920da22d1d6ea02b25dcce248a241c0e27146d5090b80519433bfc9bd82d80a
SSDEEP

3072:0rGT58WHSA7jLkiINlaHjpcRvlID/9aFvlp:0ri97jLkikIpYvlID/0Fvlp

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjnkcekm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgnffp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajnmjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfeplh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgieajgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehfjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldiiio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phaahggp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcngfgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnlfqngm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bidlqhgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inkjhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmbflm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncofplba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkckeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poidhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foqdem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akbjidbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmbflm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkmmbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkobjpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eonmkkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffeaichg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nejkfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nofmndkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckfofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oodcdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdfndpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkldlgok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdbdah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfpbmfdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipgkjlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aljefena.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgkelj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnhppa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdlhoefk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iajkohmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmahknh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emdjjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfpgmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggnlobej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjahe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpimgjbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooangh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjkqpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkobjpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmpkqqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okcccdkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehfjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inkjhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfjeckpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnaolm32.exe

Executes dropped EXE 64 IoCs

pid	Process
4116	Oncofm32.exe
1276	Ofnckp32.exe
4240	Odocigqg.exe
4896	Ofqpqo32.exe
4820	Odapnf32.exe
4212	Onjegled.exe
1528	Ocgmpccl.exe
1736	Pqknig32.exe
4140	Pgefeajb.exe
2268	Pmannhhj.exe
2256	Pclgkb32.exe
2404	Pcppfaka.exe
4940	Pnfdcjkg.exe
4712	Pgnilpah.exe
3972	Qceiaa32.exe
1500	Qnjnnj32.exe
4608	Daconoae.exe
4584	Dfpgffpm.exe
4648	Dmjocp32.exe
1588	Dhocqigp.exe
3280	Doilmc32.exe
1956	Edfdej32.exe
2248	Eajeon32.exe
3344	Eggmge32.exe
1424	Emaedo32.exe
4984	Ehfjah32.exe
1456	Ekefmc32.exe
3164	Edmjfifl.exe
1112	Ekgbccni.exe
4748	Eemgplno.exe
2188	Egnchd32.exe
4728	Emhldnkj.exe
1512	Foghnabl.exe
4468	Feapkk32.exe
2876	Fknicb32.exe
4316	Fedmqk32.exe
544	Fkqeib32.exe
5088	Fajnfl32.exe
1232	Fhdfbfdh.exe
1592	Fnaokmco.exe
3188	Fdkggg32.exe
4124	Fkeodaai.exe
4368	Gaogak32.exe
4692	Gdncmghi.exe
3400	Gochjpho.exe
1580	Ggnlobej.exe
3388	Gadqlkep.exe
1584	Ggqida32.exe
872	Gohaeo32.exe
4072	Gfbibikg.exe
1116	Gkobjpin.exe
1436	Gnmnfkia.exe
1968	Ghbbcd32.exe
2224	Hakgmjoh.exe
4220	Hdicienl.exe
4788	Hkckeo32.exe
648	Hgjljpkm.exe
2324	Hbpphi32.exe
4964	Hhihdcbp.exe
5024	Hdpiid32.exe
316	Hofmfmhj.exe
712	Hdbfodfa.exe
1944	Hkmnln32.exe
2352	Inkjhi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Khoana32.dll	Nhokljge.exe
File opened for modification	C:\Windows\SysWOW64\Oobfob32.exe	Ohhnbhok.exe
File opened for modification	C:\Windows\SysWOW64\Olfghg32.exe	Odoogi32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Ppbeie32.dll	Bclppboi.exe
File created	C:\Windows\SysWOW64\Jkefjhnn.dll	Faopah32.exe
File created	C:\Windows\SysWOW64\Dbkpkdlk.dll	Ejjgic32.exe
File created	C:\Windows\SysWOW64\Fnhppa32.exe	Egnhcgeb.exe
File created	C:\Windows\SysWOW64\Deboiojb.dll	Kknhjj32.exe
File opened for modification	C:\Windows\SysWOW64\Mgebfhcl.exe	Mojmbf32.exe
File opened for modification	C:\Windows\SysWOW64\Nhokljge.exe	Nmigoagp.exe
File created	C:\Windows\SysWOW64\Jlobem32.dll	Nfjola32.exe
File opened for modification	C:\Windows\SysWOW64\Ejnbdp32.exe	Ejglcq32.exe
File opened for modification	C:\Windows\SysWOW64\Kknhjj32.exe	Khplnn32.exe
File created	C:\Windows\SysWOW64\Lhiodm32.exe	Lqbgcp32.exe
File created	C:\Windows\SysWOW64\Lgmdfppj.dll	Fnaokmco.exe
File created	C:\Windows\SysWOW64\Gohaeo32.exe	Ggqida32.exe
File opened for modification	C:\Windows\SysWOW64\Bdhkchlg.exe	Blabakle.exe
File created	C:\Windows\SysWOW64\Ehfljn32.dll	Jkkbnl32.exe
File created	C:\Windows\SysWOW64\Jhjnik32.dll	Kkqepi32.exe
File created	C:\Windows\SysWOW64\Qjfoohmp.dll	Lhkkjl32.exe
File created	C:\Windows\SysWOW64\Lkldlgok.exe	Lqfpoope.exe
File opened for modification	C:\Windows\SysWOW64\Edmjfifl.exe	Ekefmc32.exe
File opened for modification	C:\Windows\SysWOW64\Gfbibikg.exe	Gohaeo32.exe
File opened for modification	C:\Windows\SysWOW64\Odjeljhd.exe	Omqmop32.exe
File created	C:\Windows\SysWOW64\Ngllodpm.dll	Cehlcikj.exe
File created	C:\Windows\SysWOW64\Jhhgefed.dll	Dehgejep.exe
File created	C:\Windows\SysWOW64\Ipcakd32.exe	Ikgicmpe.exe
File created	C:\Windows\SysWOW64\Alnakngf.dll	Okcccdkp.exe
File created	C:\Windows\SysWOW64\Diicml32.exe	Dfjgaq32.exe
File created	C:\Windows\SysWOW64\Lhnhajba.exe	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Blqlgdhi.exe	Begcjjql.exe
File opened for modification	C:\Windows\SysWOW64\Cfbcfh32.exe	Cjlbag32.exe
File created	C:\Windows\SysWOW64\Icdmcm32.dll	Egnhcgeb.exe
File opened for modification	C:\Windows\SysWOW64\Cjmpkqqj.exe	Ccchof32.exe
File opened for modification	C:\Windows\SysWOW64\Lhbkac32.exe	Hgapmj32.exe
File opened for modification	C:\Windows\SysWOW64\Hmbpbk32.exe	Hfhgfaha.exe
File created	C:\Windows\SysWOW64\Djnkap32.dll	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Ffhnocfd.exe	Fcibchgq.exe
File created	C:\Windows\SysWOW64\Iokbekgb.dll	Idhgkcln.exe
File created	C:\Windows\SysWOW64\Cojfaj32.dll	Lncjgddf.exe
File opened for modification	C:\Windows\SysWOW64\Lhnhajba.exe	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Hgapmj32.exe	Cdolgfbp.exe
File opened for modification	C:\Windows\SysWOW64\Cmdmpe32.exe	Cfjeckpj.exe
File opened for modification	C:\Windows\SysWOW64\Mgkjch32.exe	Gcimfg32.exe
File opened for modification	C:\Windows\SysWOW64\Eonmkkmj.exe	Ejaecdnc.exe
File created	C:\Windows\SysWOW64\Kjinplje.dll	Joikdk32.exe
File created	C:\Windows\SysWOW64\Eeokad32.dll	Flmhclod.exe
File created	C:\Windows\SysWOW64\Haphiiee.exe	Hjfplo32.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Ofqpqo32.exe
File opened for modification	C:\Windows\SysWOW64\Pfgogh32.exe	Ikcdlmgf.exe
File created	C:\Windows\SysWOW64\Hlmidl32.dll	Aodfajaj.exe
File opened for modification	C:\Windows\SysWOW64\Eobffk32.exe	Emdjjo32.exe
File created	C:\Windows\SysWOW64\Chfbhe32.dll	Jhapmphg.exe
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Pqknig32.exe
File opened for modification	C:\Windows\SysWOW64\Dgejpd32.exe	Dpnbog32.exe
File opened for modification	C:\Windows\SysWOW64\Eangjkkd.exe	Elaobdmm.exe
File created	C:\Windows\SysWOW64\Lhjafhlf.dll	Qgdabflp.exe
File created	C:\Windows\SysWOW64\Fgfqmlko.dll	Qibmoa32.exe
File opened for modification	C:\Windows\SysWOW64\Ddadpdmn.exe	Dmglcj32.exe
File created	C:\Windows\SysWOW64\Ikbekfli.dll	Bgdjicmn.exe
File created	C:\Windows\SysWOW64\Pekkhn32.exe	Poqckdap.exe
File created	C:\Windows\SysWOW64\Oaeghn32.dll	Pemhmn32.exe
File created	C:\Windows\SysWOW64\Hjimaole.exe	Hhjqec32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7652	7552	WerFault.exe	558

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lceajc32.dll"	Cjofambd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppblkffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aglnbhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acicqigg.dll"	Mafofggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgkhgb32.dll"	Pqcjepfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcqmpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodeje32.dll"	Omhpcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehkga32.dll"	Nmgjia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppdpcn32.dll"	Dnghhqdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnkdpgnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oildaf32.dll"	Pfenga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbahgbfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	8d180c280310c6702c2e69305796bdc8_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phpmopfk.dll"	Gochjpho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amcmpodi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccigpbga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfdfinl.dll"	Kpfggang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjnkcekm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgjglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjofambd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdfndpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iomcgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmlngh32.dll"	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flodilma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofnhfbjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djgcci32.dll"	Ikgicmpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igcoqocb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmigoagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mafofggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnndbecl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqbgcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdolgfbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qecnjaee.dll"	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jahbefmn.dll"	Negoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kefjdppe.dll"	Mhiabbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dagajlal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajinq32.dll"	Bckddn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eonmkkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqdcio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfooa32.dll"	Hbpphi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbemjj32.dll"	Dmbbhkjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmnbej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bidlqhgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggldde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omcjep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddnobj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmkehicj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpodmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oodcdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbjebjh.dll"	Pkegpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aplpihjd.dll"	Dpnbog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Diicml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omqmop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iomcgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plagcbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lefqkm32.dll"	Pgkelj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egnchd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4116	4864	8d180c280310c6702c2e69305796bdc8_JC.exe	82
PID 4864 wrote to memory of 4116	4864	8d180c280310c6702c2e69305796bdc8_JC.exe	82
PID 4864 wrote to memory of 4116	4864	8d180c280310c6702c2e69305796bdc8_JC.exe	82
PID 4116 wrote to memory of 1276	4116	Oncofm32.exe	83
PID 4116 wrote to memory of 1276	4116	Oncofm32.exe	83
PID 4116 wrote to memory of 1276	4116	Oncofm32.exe	83
PID 1276 wrote to memory of 4240	1276	Ofnckp32.exe	84
PID 1276 wrote to memory of 4240	1276	Ofnckp32.exe	84
PID 1276 wrote to memory of 4240	1276	Ofnckp32.exe	84
PID 4240 wrote to memory of 4896	4240	Odocigqg.exe	85
PID 4240 wrote to memory of 4896	4240	Odocigqg.exe	85
PID 4240 wrote to memory of 4896	4240	Odocigqg.exe	85
PID 4896 wrote to memory of 4820	4896	Ofqpqo32.exe	87
PID 4896 wrote to memory of 4820	4896	Ofqpqo32.exe	87
PID 4896 wrote to memory of 4820	4896	Ofqpqo32.exe	87
PID 4820 wrote to memory of 4212	4820	Odapnf32.exe	88
PID 4820 wrote to memory of 4212	4820	Odapnf32.exe	88
PID 4820 wrote to memory of 4212	4820	Odapnf32.exe	88
PID 4212 wrote to memory of 1528	4212	Onjegled.exe	89
PID 4212 wrote to memory of 1528	4212	Onjegled.exe	89
PID 4212 wrote to memory of 1528	4212	Onjegled.exe	89
PID 1528 wrote to memory of 1736	1528	Ocgmpccl.exe	90
PID 1528 wrote to memory of 1736	1528	Ocgmpccl.exe	90
PID 1528 wrote to memory of 1736	1528	Ocgmpccl.exe	90
PID 1736 wrote to memory of 4140	1736	Pqknig32.exe	91
PID 1736 wrote to memory of 4140	1736	Pqknig32.exe	91
PID 1736 wrote to memory of 4140	1736	Pqknig32.exe	91
PID 4140 wrote to memory of 2268	4140	Pgefeajb.exe	92
PID 4140 wrote to memory of 2268	4140	Pgefeajb.exe	92
PID 4140 wrote to memory of 2268	4140	Pgefeajb.exe	92
PID 2268 wrote to memory of 2256	2268	Pmannhhj.exe	93
PID 2268 wrote to memory of 2256	2268	Pmannhhj.exe	93
PID 2268 wrote to memory of 2256	2268	Pmannhhj.exe	93
PID 2256 wrote to memory of 2404	2256	Pclgkb32.exe	94
PID 2256 wrote to memory of 2404	2256	Pclgkb32.exe	94
PID 2256 wrote to memory of 2404	2256	Pclgkb32.exe	94
PID 2404 wrote to memory of 4940	2404	Pcppfaka.exe	95
PID 2404 wrote to memory of 4940	2404	Pcppfaka.exe	95
PID 2404 wrote to memory of 4940	2404	Pcppfaka.exe	95
PID 4940 wrote to memory of 4712	4940	Pnfdcjkg.exe	96
PID 4940 wrote to memory of 4712	4940	Pnfdcjkg.exe	96
PID 4940 wrote to memory of 4712	4940	Pnfdcjkg.exe	96
PID 4712 wrote to memory of 3972	4712	Pgnilpah.exe	97
PID 4712 wrote to memory of 3972	4712	Pgnilpah.exe	97
PID 4712 wrote to memory of 3972	4712	Pgnilpah.exe	97
PID 3972 wrote to memory of 1500	3972	Qceiaa32.exe	98
PID 3972 wrote to memory of 1500	3972	Qceiaa32.exe	98
PID 3972 wrote to memory of 1500	3972	Qceiaa32.exe	98
PID 1500 wrote to memory of 4608	1500	Qnjnnj32.exe	100
PID 1500 wrote to memory of 4608	1500	Qnjnnj32.exe	100
PID 1500 wrote to memory of 4608	1500	Qnjnnj32.exe	100
PID 4608 wrote to memory of 4584	4608	Daconoae.exe	101
PID 4608 wrote to memory of 4584	4608	Daconoae.exe	101
PID 4608 wrote to memory of 4584	4608	Daconoae.exe	101
PID 4584 wrote to memory of 4648	4584	Dfpgffpm.exe	102
PID 4584 wrote to memory of 4648	4584	Dfpgffpm.exe	102
PID 4584 wrote to memory of 4648	4584	Dfpgffpm.exe	102
PID 4648 wrote to memory of 1588	4648	Dmjocp32.exe	103
PID 4648 wrote to memory of 1588	4648	Dmjocp32.exe	103
PID 4648 wrote to memory of 1588	4648	Dmjocp32.exe	103
PID 1588 wrote to memory of 3280	1588	Dhocqigp.exe	104
PID 1588 wrote to memory of 3280	1588	Dhocqigp.exe	104
PID 1588 wrote to memory of 3280	1588	Dhocqigp.exe	104
PID 3280 wrote to memory of 1956	3280	Doilmc32.exe	105

C:\Users\Admin\AppData\Local\Temp\8d180c280310c6702c2e69305796bdc8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8d180c280310c6702c2e69305796bdc8_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\Oncofm32.exe
  C:\Windows\system32\Oncofm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\Ofnckp32.exe
    C:\Windows\system32\Ofnckp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\SysWOW64\Odocigqg.exe
      C:\Windows\system32\Odocigqg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4896
      - C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        23⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        24⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        25⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        26⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        29⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        30⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        31⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2188
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        33⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1748
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        35⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        36⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        37⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        38⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        39⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        40⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        41⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        43⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        44⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        45⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        46⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3400
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        49⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:872
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        52⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        54⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        55⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        56⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        57⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        59⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        61⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        62⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        63⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        64⤵
        Executes dropped EXE
        
        PID:712
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        65⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        67⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        68⤵
        Modifies registry class
        
        PID:3704
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        69⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        70⤵
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        71⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        72⤵
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        73⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        74⤵
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        75⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        76⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3416
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        79⤵
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3624
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        81⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        82⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        83⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        85⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        86⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        87⤵
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        88⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        89⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        90⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        91⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        92⤵
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        93⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        94⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        95⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        96⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        97⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        98⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        99⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        100⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        101⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        102⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        105⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        106⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        107⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        108⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        109⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        111⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        112⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        113⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        115⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        116⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        117⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        119⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        120⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        121⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        123⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        124⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:768
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        126⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        127⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        128⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        129⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        131⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        132⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        133⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        134⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        135⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        136⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        137⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        138⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        139⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        140⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        141⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        142⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        143⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        144⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4372
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        146⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        148⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        151⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        152⤵
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        153⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4548
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        61⤵
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        62⤵
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        63⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        64⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        66⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        67⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        68⤵
        Drops file in System32 directory
        
        PID:2616
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        69⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        70⤵
        
        PID:484
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        71⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        72⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        73⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        74⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        75⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        76⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        77⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        78⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:564
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        80⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        81⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4908
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        83⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        84⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1984
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        86⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Eiijfd32.exe
        
        C:\Windows\system32\Eiijfd32.exe
        87⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Emgblc32.exe
        
        C:\Windows\system32\Emgblc32.exe
        88⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Mgkjch32.exe
        
        C:\Windows\system32\Mgkjch32.exe
        90⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        91⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        92⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        93⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        94⤵
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Ljhchc32.exe
        
        C:\Windows\system32\Ljhchc32.exe
        95⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        96⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        97⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        99⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        100⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        101⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        102⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        103⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        104⤵
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        105⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        106⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        107⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        108⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        109⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        110⤵
        Drops file in System32 directory
        
        PID:1120
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        111⤵
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        112⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Ejnbdp32.exe
        
        C:\Windows\system32\Ejnbdp32.exe
        114⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Eiobbgcl.exe
        
        C:\Windows\system32\Eiobbgcl.exe
        115⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Fhbbmc32.exe
        
        C:\Windows\system32\Fhbbmc32.exe
        116⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Folkjnbc.exe
        
        C:\Windows\system32\Folkjnbc.exe
        117⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Fhdocc32.exe
        
        C:\Windows\system32\Fhdocc32.exe
        118⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        119⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Fehplggn.exe
        
        C:\Windows\system32\Fehplggn.exe
        120⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Foqdem32.exe
        
        C:\Windows\system32\Foqdem32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3420
        
        C:\Windows\SysWOW64\Faopah32.exe
        
        C:\Windows\system32\Faopah32.exe
        122⤵
        Drops file in System32 directory
        
        PID:3464
        
        C:\Windows\SysWOW64\Fbnmkk32.exe
        
        C:\Windows\system32\Fbnmkk32.exe
        123⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Qgdabflp.exe
        
        C:\Windows\system32\Qgdabflp.exe
        124⤵
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Qibmoa32.exe
        
        C:\Windows\system32\Qibmoa32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Qpmfklbq.exe
        
        C:\Windows\system32\Qpmfklbq.exe
        126⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Qckbggad.exe
        
        C:\Windows\system32\Qckbggad.exe
        127⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Akbjidbf.exe
        
        C:\Windows\system32\Akbjidbf.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Apobakpn.exe
        
        C:\Windows\system32\Apobakpn.exe
        129⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Acmomgoa.exe
        
        C:\Windows\system32\Acmomgoa.exe
        130⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Akdfndpd.exe
        
        C:\Windows\system32\Akdfndpd.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Apaofk32.exe
        
        C:\Windows\system32\Apaofk32.exe
        132⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Agkgceeh.exe
        
        C:\Windows\system32\Agkgceeh.exe
        133⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Angleokb.exe
        
        C:\Windows\system32\Angleokb.exe
        134⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Apfhajjf.exe
        
        C:\Windows\system32\Apfhajjf.exe
        135⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Ajnmjp32.exe
        
        C:\Windows\system32\Ajnmjp32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1384
        
        C:\Windows\SysWOW64\Bknidbhi.exe
        
        C:\Windows\system32\Bknidbhi.exe
        137⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Bnlfqngm.exe
        
        C:\Windows\system32\Bnlfqngm.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3452
        
        C:\Windows\SysWOW64\Bpkbmi32.exe
        
        C:\Windows\system32\Bpkbmi32.exe
        139⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Bgdjicmn.exe
        
        C:\Windows\system32\Bgdjicmn.exe
        140⤵
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\Blabakle.exe
        
        C:\Windows\system32\Blabakle.exe
        141⤵
        Drops file in System32 directory
        
        PID:3740
        
        C:\Windows\SysWOW64\Bdhkchlg.exe
        
        C:\Windows\system32\Bdhkchlg.exe
        142⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Bckknd32.exe
        
        C:\Windows\system32\Bckknd32.exe
        143⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Bkbcpb32.exe
        
        C:\Windows\system32\Bkbcpb32.exe
        144⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Bnaolm32.exe
        
        C:\Windows\system32\Bnaolm32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Bcngddao.exe
        
        C:\Windows\system32\Bcngddao.exe
        146⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        147⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        148⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ckiipa32.exe
        
        C:\Windows\system32\Ckiipa32.exe
        149⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Cmkehicj.exe
        
        C:\Windows\system32\Cmkehicj.exe
        150⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Ccendc32.exe
        
        C:\Windows\system32\Ccendc32.exe
        151⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Cjofambd.exe
        
        C:\Windows\system32\Cjofambd.exe
        152⤵
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Cnjbbl32.exe
        
        C:\Windows\system32\Cnjbbl32.exe
        153⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Ccgjjc32.exe
        
        C:\Windows\system32\Ccgjjc32.exe
        154⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Cgbfka32.exe
        
        C:\Windows\system32\Cgbfka32.exe
        155⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cjabgm32.exe
        
        C:\Windows\system32\Cjabgm32.exe
        156⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        157⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Ccigpbga.exe
        
        C:\Windows\system32\Ccigpbga.exe
        158⤵
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Dcqmpa32.exe
        
        C:\Windows\system32\Dcqmpa32.exe
        159⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Dkgeao32.exe
        
        C:\Windows\system32\Dkgeao32.exe
        160⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Dgnffp32.exe
        
        C:\Windows\system32\Dgnffp32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Debfpd32.exe
        
        C:\Windows\system32\Debfpd32.exe
        162⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Dmnkdfce.exe
        
        C:\Windows\system32\Dmnkdfce.exe
        163⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Eljknl32.exe
        
        C:\Windows\system32\Eljknl32.exe
        164⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Febogbhg.exe
        
        C:\Windows\system32\Febogbhg.exe
        165⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Flmhclod.exe
        
        C:\Windows\system32\Flmhclod.exe
        166⤵
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\Fnkdpgnh.exe
        
        C:\Windows\system32\Fnkdpgnh.exe
        167⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Faiplcmk.exe
        
        C:\Windows\system32\Faiplcmk.exe
        168⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Fchlhnlo.exe
        
        C:\Windows\system32\Fchlhnlo.exe
        169⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Flodilma.exe
        
        C:\Windows\system32\Flodilma.exe
        170⤵
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Oemofpel.exe
        
        C:\Windows\system32\Oemofpel.exe
        171⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Olfgcj32.exe
        
        C:\Windows\system32\Olfgcj32.exe
        172⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Oflkqc32.exe
        
        C:\Windows\system32\Oflkqc32.exe
        173⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Opdpih32.exe
        
        C:\Windows\system32\Opdpih32.exe
        174⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        175⤵
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Omhpcm32.exe
        
        C:\Windows\system32\Omhpcm32.exe
        176⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Oecego32.exe
        
        C:\Windows\system32\Oecego32.exe
        177⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Opiidhoj.exe
        
        C:\Windows\system32\Opiidhoj.exe
        178⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Oefamoma.exe
        
        C:\Windows\system32\Oefamoma.exe
        179⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Ommjnlnd.exe
        
        C:\Windows\system32\Ommjnlnd.exe
        180⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Pfenga32.exe
        
        C:\Windows\system32\Pfenga32.exe
        181⤵
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Pidjcm32.exe
        
        C:\Windows\system32\Pidjcm32.exe
        182⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Plbfohbl.exe
        
        C:\Windows\system32\Plbfohbl.exe
        183⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Poqckdap.exe
        
        C:\Windows\system32\Poqckdap.exe
        184⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Pekkhn32.exe
        
        C:\Windows\system32\Pekkhn32.exe
        185⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        186⤵
        Drops file in System32 directory
        
        PID:2392
        
        C:\Windows\SysWOW64\Ppblkffp.exe
        
        C:\Windows\system32\Ppblkffp.exe
        187⤵
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Pbahgbfc.exe
        
        C:\Windows\system32\Pbahgbfc.exe
        188⤵
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Pikqcl32.exe
        
        C:\Windows\system32\Pikqcl32.exe
        189⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Pohilc32.exe
        
        C:\Windows\system32\Pohilc32.exe
        190⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Pllieg32.exe
        
        C:\Windows\system32\Pllieg32.exe
        191⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Qednnm32.exe
        
        C:\Windows\system32\Qednnm32.exe
        192⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Qbhnga32.exe
        
        C:\Windows\system32\Qbhnga32.exe
        193⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Qibfdkgh.exe
        
        C:\Windows\system32\Qibfdkgh.exe
        194⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Qmnbej32.exe
        
        C:\Windows\system32\Qmnbej32.exe
        195⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        196⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Abjkmqni.exe
        
        C:\Windows\system32\Abjkmqni.exe
        197⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Aidcjk32.exe
        
        C:\Windows\system32\Aidcjk32.exe
        198⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Albpff32.exe
        
        C:\Windows\system32\Albpff32.exe
        199⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Aemqdk32.exe
        
        C:\Windows\system32\Aemqdk32.exe
        200⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Amdiei32.exe
        
        C:\Windows\system32\Amdiei32.exe
        201⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Aofemaog.exe
        
        C:\Windows\system32\Aofemaog.exe
        202⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Aepmjk32.exe
        
        C:\Windows\system32\Aepmjk32.exe
        203⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Aljefena.exe
        
        C:\Windows\system32\Aljefena.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3392
        
        C:\Windows\SysWOW64\Aohbbqme.exe
        
        C:\Windows\system32\Aohbbqme.exe
        205⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Agojdnng.exe
        
        C:\Windows\system32\Agojdnng.exe
        206⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        207⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        208⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Bipcei32.exe
        
        C:\Windows\system32\Bipcei32.exe
        209⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        210⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Begcjjql.exe
        
        C:\Windows\system32\Begcjjql.exe
        211⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Blqlgdhi.exe
        
        C:\Windows\system32\Blqlgdhi.exe
        212⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        213⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Bidlqhgc.exe
        
        C:\Windows\system32\Bidlqhgc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\Bpodmb32.exe
        
        C:\Windows\system32\Bpodmb32.exe
        215⤵
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Bgimjmfl.exe
        
        C:\Windows\system32\Bgimjmfl.exe
        216⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Bleebc32.exe
        
        C:\Windows\system32\Bleebc32.exe
        217⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Bcomonkq.exe
        
        C:\Windows\system32\Bcomonkq.exe
        218⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Bjielh32.exe
        
        C:\Windows\system32\Bjielh32.exe
        219⤵
        
        PID:648
        
        C:\Windows\SysWOW64\Cpcnhbjj.exe
        
        C:\Windows\system32\Cpcnhbjj.exe
        220⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        221⤵
        Drops file in System32 directory
        
        PID:1112
        
        C:\Windows\SysWOW64\Cfbcfh32.exe
        
        C:\Windows\system32\Cfbcfh32.exe
        222⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Cllkcbnl.exe
        
        C:\Windows\system32\Cllkcbnl.exe
        223⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Cokgonmp.exe
        
        C:\Windows\system32\Cokgonmp.exe
        224⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Cfeplh32.exe
        
        C:\Windows\system32\Cfeplh32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3704
        
        C:\Windows\SysWOW64\Cnndbecl.exe
        
        C:\Windows\system32\Cnndbecl.exe
        226⤵
        Modifies registry class
        
        PID:4160
        
        C:\Windows\SysWOW64\Cckmklac.exe
        
        C:\Windows\system32\Cckmklac.exe
        227⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        228⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Dlcaca32.exe
        
        C:\Windows\system32\Dlcaca32.exe
        229⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Dgieajgj.exe
        
        C:\Windows\system32\Dgieajgj.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Djgbmffn.exe
        
        C:\Windows\system32\Djgbmffn.exe
        231⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        232⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Dfnbbg32.exe
        
        C:\Windows\system32\Dfnbbg32.exe
        233⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Dmhkoaco.exe
        
        C:\Windows\system32\Dmhkoaco.exe
        234⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Dcbckk32.exe
        
        C:\Windows\system32\Dcbckk32.exe
        235⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Dfqogfjo.exe
        
        C:\Windows\system32\Dfqogfjo.exe
        236⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Dqfceoje.exe
        
        C:\Windows\system32\Dqfceoje.exe
        237⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Dgplai32.exe
        
        C:\Windows\system32\Dgplai32.exe
        238⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Dmmdjp32.exe
        
        C:\Windows\system32\Dmmdjp32.exe
        239⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Dcglfjgf.exe
        
        C:\Windows\system32\Dcglfjgf.exe
        240⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        241⤵
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Eonmkkmj.exe
        
        C:\Windows\system32\Eonmkkmj.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Efgehe32.exe
        
        C:\Windows\system32\Efgehe32.exe
        243⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Emanepld.exe
        
        C:\Windows\system32\Emanepld.exe
        244⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Eckfaj32.exe
        
        C:\Windows\system32\Eckfaj32.exe
        245⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Emdjjo32.exe
        
        C:\Windows\system32\Emdjjo32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4408
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        247⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Ejhkdc32.exe
        
        C:\Windows\system32\Ejhkdc32.exe
        248⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Eqbcqnph.exe
        
        C:\Windows\system32\Eqbcqnph.exe
        249⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Ecpomiok.exe
        
        C:\Windows\system32\Ecpomiok.exe
        250⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Ejjgic32.exe
        
        C:\Windows\system32\Ejjgic32.exe
        251⤵
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Epgpajdp.exe
        
        C:\Windows\system32\Epgpajdp.exe
        252⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Egnhcgeb.exe
        
        C:\Windows\system32\Egnhcgeb.exe
        253⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Fnhppa32.exe
        
        C:\Windows\system32\Fnhppa32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4896
        
        C:\Windows\SysWOW64\Fpimgjbm.exe
        
        C:\Windows\system32\Fpimgjbm.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2932
        
        C:\Windows\SysWOW64\Fjoadbbc.exe
        
        C:\Windows\system32\Fjoadbbc.exe
        256⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        257⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Ffeaichg.exe
        
        C:\Windows\system32\Ffeaichg.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5068
        
        C:\Windows\SysWOW64\Fmpjfn32.exe
        
        C:\Windows\system32\Fmpjfn32.exe
        259⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Fcibchgq.exe
        
        C:\Windows\system32\Fcibchgq.exe
        260⤵
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\Ffhnocfd.exe
        
        C:\Windows\system32\Ffhnocfd.exe
        261⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Fmbflm32.exe
        
        C:\Windows\system32\Fmbflm32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Fclohg32.exe
        
        C:\Windows\system32\Fclohg32.exe
        263⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Fjfgealk.exe
        
        C:\Windows\system32\Fjfgealk.exe
        264⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Fapobl32.exe
        
        C:\Windows\system32\Fapobl32.exe
        265⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ggjgofkd.exe
        
        C:\Windows\system32\Ggjgofkd.exe
        266⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Gmfpgmil.exe
        
        C:\Windows\system32\Gmfpgmil.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Ggldde32.exe
        
        C:\Windows\system32\Ggldde32.exe
        268⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Gjkqpa32.exe
        
        C:\Windows\system32\Gjkqpa32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Gcceifof.exe
        
        C:\Windows\system32\Gcceifof.exe
        270⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Gpjfng32.exe
        
        C:\Windows\system32\Gpjfng32.exe
        271⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Hfhgfaha.exe
        
        C:\Windows\system32\Hfhgfaha.exe
        272⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Hdlhoefk.exe
        
        C:\Windows\system32\Hdlhoefk.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Hjfplo32.exe
        
        C:\Windows\system32\Hjfplo32.exe
        275⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Haphiiee.exe
        
        C:\Windows\system32\Haphiiee.exe
        276⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Hhjqec32.exe
        
        C:\Windows\system32\Hhjqec32.exe
        277⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Hjimaole.exe
        
        C:\Windows\system32\Hjimaole.exe
        278⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        279⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        280⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hhojqcil.exe
        
        C:\Windows\system32\Hhojqcil.exe
        281⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Hoibmmpi.exe
        
        C:\Windows\system32\Hoibmmpi.exe
        282⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Idfkednq.exe
        
        C:\Windows\system32\Idfkednq.exe
        283⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Iajkohmj.exe
        
        C:\Windows\system32\Iajkohmj.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        285⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        286⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        287⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Ikgicmpe.exe
        
        C:\Windows\system32\Ikgicmpe.exe
        288⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Ipcakd32.exe
        
        C:\Windows\system32\Ipcakd32.exe
        289⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Iodaikfl.exe
        
        C:\Windows\system32\Iodaikfl.exe
        290⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Jkkbnl32.exe
        
        C:\Windows\system32\Jkkbnl32.exe
        291⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Jgbccm32.exe
        
        C:\Windows\system32\Jgbccm32.exe
        292⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Joikdk32.exe
        
        C:\Windows\system32\Joikdk32.exe
        293⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Jahgpf32.exe
        
        C:\Windows\system32\Jahgpf32.exe
        294⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        295⤵
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Jalakeme.exe
        
        C:\Windows\system32\Jalakeme.exe
        296⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        297⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Kdmjmqjf.exe
        
        C:\Windows\system32\Kdmjmqjf.exe
        298⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Kkioojpp.exe
        
        C:\Windows\system32\Kkioojpp.exe
        299⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Kpfggang.exe
        
        C:\Windows\system32\Kpfggang.exe
        300⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Kgpodk32.exe
        
        C:\Windows\system32\Kgpodk32.exe
        301⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Koggehff.exe
        
        C:\Windows\system32\Koggehff.exe
        302⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Kafcadej.exe
        
        C:\Windows\system32\Kafcadej.exe
        303⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        304⤵
        Drops file in System32 directory
        
        PID:3092
        
        C:\Windows\SysWOW64\Kknhjj32.exe
        
        C:\Windows\system32\Kknhjj32.exe
        305⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        306⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Kkqepi32.exe
        
        C:\Windows\system32\Kkqepi32.exe
        307⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Lnoalehl.exe
        
        C:\Windows\system32\Lnoalehl.exe
        308⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Ldiiio32.exe
        
        C:\Windows\system32\Ldiiio32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        310⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ldkfno32.exe
        
        C:\Windows\system32\Ldkfno32.exe
        311⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Lncjgddf.exe
        
        C:\Windows\system32\Lncjgddf.exe
        312⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Lhiodm32.exe
        
        C:\Windows\system32\Lhiodm32.exe
        314⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Locgagli.exe
        
        C:\Windows\system32\Locgagli.exe
        315⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        316⤵
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Lhkkjl32.exe
        
        C:\Windows\system32\Lhkkjl32.exe
        317⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        318⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Lqfpoope.exe
        
        C:\Windows\system32\Lqfpoope.exe
        319⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Mnjqhcno.exe
        
        C:\Windows\system32\Mnjqhcno.exe
        321⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Mqimdomb.exe
        
        C:\Windows\system32\Mqimdomb.exe
        322⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Mojmbf32.exe
        
        C:\Windows\system32\Mojmbf32.exe
        323⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        324⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Mdibplaf.exe
        
        C:\Windows\system32\Mdibplaf.exe
        325⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        326⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Mqbpjmeg.exe
        
        C:\Windows\system32\Mqbpjmeg.exe
        327⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Mhihkjfj.exe
        
        C:\Windows\system32\Mhihkjfj.exe
        328⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Nkhdgfen.exe
        
        C:\Windows\system32\Nkhdgfen.exe
        329⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Nbbldp32.exe
        
        C:\Windows\system32\Nbbldp32.exe
        330⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        331⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Nofmndkd.exe
        
        C:\Windows\system32\Nofmndkd.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Nbfeoohe.exe
        
        C:\Windows\system32\Nbfeoohe.exe
        334⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Ngcngfgl.exe
        
        C:\Windows\system32\Ngcngfgl.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7236
        
        C:\Windows\SysWOW64\Nbibeo32.exe
        
        C:\Windows\system32\Nbibeo32.exe
        336⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Negoaj32.exe
        
        C:\Windows\system32\Negoaj32.exe
        337⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Nnpcjplf.exe
        
        C:\Windows\system32\Nnpcjplf.exe
        338⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Nejkfj32.exe
        
        C:\Windows\system32\Nejkfj32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        341⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        342⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 408
        343⤵
        Program crash
        
        PID:7652

C:\Windows\SysWOW64\Pkegpb32.exe
C:\Windows\system32\Pkegpb32.exe
1⤵
- Modifies registry class
PID:4116
- C:\Windows\SysWOW64\Pldcjeia.exe
  C:\Windows\system32\Pldcjeia.exe
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\Ibhkfm32.exe
    C:\Windows\system32\Ibhkfm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:1804
  - - C:\Windows\SysWOW64\Jcmdaljn.exe
      C:\Windows\system32\Jcmdaljn.exe
      4⤵
      PID:4468
    - - C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        5⤵
        Modifies registry class
        
        PID:4432
      - C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        6⤵
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        7⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        8⤵
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        9⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        10⤵
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        11⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        12⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4064
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        14⤵
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        15⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        16⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        17⤵
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        18⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        19⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        20⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        21⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        22⤵
        Modifies registry class
        
        PID:4076
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        23⤵
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        24⤵
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        25⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        26⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        27⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3268
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636

C:\Windows\SysWOW64\Podkmgop.exe
C:\Windows\system32\Podkmgop.exe
1⤵
PID:4544
- C:\Windows\SysWOW64\Pcbdcf32.exe
  C:\Windows\system32\Pcbdcf32.exe
  2⤵
  PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7552 -ip 7552
1⤵
PID:7628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aimkjp32.exe

Filesize
110KB

MD5
1a4e8f4d43108bea1465c47307e42f68

SHA1
f3845b5f625d753b86c4dee2aa0893c1559c2551

SHA256
8a4edf0f664228e10f4a182dd15b03b8548d2cd87a3be5ebcdc4c4f1fdff367c

SHA512
6de33ef10a15353da3867396fffc7adc891dfd7a386c9bbd91d77360d38ee2edcdd6a3713245685af11b739112f2fbc77640efa6130d85d43a0255360432cc9e

Download Submit
C:\Windows\SysWOW64\Amibqhed.exe

Filesize
110KB

MD5
ebd4192fc2c67c73728f60ac4308cdca

SHA1
9e0ee1485ea9b134f274a5139a225de6fca1683d

SHA256
a5495b2253c045abc573b3e63a1ee60f37fa92cc8db1e3f56a21abfdff2f4725

SHA512
efb384cc1687aab14ebc69776ac77fd8c47a86b309962539fab4bc7a50668c57751df00dd5c87196cb12c332932a479d6b63ffd88d75c18096b62d6146cf5bee

Download Submit
C:\Windows\SysWOW64\Bifmqo32.exe

Filesize
110KB

MD5
aa8ef18edb3cd385435a235f64f0b6c1

SHA1
6fa49c3904ba1c1465b92f2ea63271a8731ff834

SHA256
3080c0b9fdb9e477c2afaac2bdf2a8214a08a954a25b53dfe2120b9216a60d54

SHA512
3d266c3d20e78407a8af3f8396c807eecfb8240111fa2a67cd0bb903f4786e934332137dc5ea8026ef78dc12073e687408be31f8c63efa5bff3df131ce14403b

Download Submit
C:\Windows\SysWOW64\Bjielh32.exe

Filesize
110KB

MD5
00f37ef644a3b7609935dac9380566ba

SHA1
bbaec54ca550b9e2a1c3ff004340ecf810b676a9

SHA256
b546ff3f30db96237169ee013dc4918afd04f43052a506add29b82e196f0b67c

SHA512
09e108830dcda673ee4b8ac069e7f0275e301ed1d03a778d0ad7b92c273f59aa0415b53d6517523821179b95c5748e63c533a5abe1303dcd565d311ad2218dff

Download Submit
C:\Windows\SysWOW64\Bleebc32.exe

Filesize
110KB

MD5
eba0b45858c8229c8b3077b1607311b3

SHA1
0653dcd3f06aedc07ac13fe5e3df12f4477a3feb

SHA256
f61fdb2e2df9109784898f8aeac46780821ccdecc9280006b718bf7f4354e071

SHA512
03c1915d07a6034a6a7515fdfaadbe48555284822e134d7cf0332c04eeb7b6ea96cb2edff6f44ec49fbf2c9626d5cbad0c84f0d8e10a692c0c6c68760b65f170

Download Submit
C:\Windows\SysWOW64\Bmimdg32.exe

Filesize
110KB

MD5
031794f59e896fc32e606dcb2e87e236

SHA1
87346b744cc0d570f0725d0aef12c1bcd798068a

SHA256
43a9b931b0b40da84ba6acf75824228001beebfb41aba927f4648ed8117407ae

SHA512
7a0403f559b2670b2608cf9e7d0d6c3efe597f5d35c41be557fb2d6f848ed9c39c30142f49c74a338163c03607bceee1f559747d07a34c9e9c3744a03651124c

Download Submit
C:\Windows\SysWOW64\Bnoiqd32.exe

Filesize
110KB

MD5
461fa78d742b7d083ad2b4494ed05e81

SHA1
41bf98ebff46e8c49e2af022063d1bfd5c061789

SHA256
092778bc7b992af2ac67c836de346fef0587e883bcf0e6a380d57a95519f5745

SHA512
7de1b9a1b5299a544d58c6ff0cae5a8bf2cb65f4d3e0fa6209775e28e2bf30390534be9445e77551788ca3a4acbcf8201b4bdecafcd8d0fd84f82edc0e303818

Download Submit
C:\Windows\SysWOW64\Cfbcfh32.exe

Filesize
110KB

MD5
6e06296cafe428b80be6594d34372eef

SHA1
81a7b7fed8930762ed66d835e342127c419978ac

SHA256
b220e218a3ac8aec211b4aba28fc77d38bfc1db289444bdd21921e24c9d235ef

SHA512
4c7b5d0181570721e0ad74d64af92265478e4536348f88eb9f0f907fc524453fdbb66119627804de157dc6b5746b55760560305b593c3faa957c53eca316a840

Download Submit
C:\Windows\SysWOW64\Cfmahknh.exe

Filesize
110KB

MD5
959c4c7c4f72a85ca5eb01487d877666

SHA1
294daad1684f1a0df8d4a2f9ace14f75e9fb70bf

SHA256
36de7fc7c401d9645f8172a9a4b1d042dee83152eb306b5d305800ad27d9718e

SHA512
57dd6cbbfd6c35a2c6b888a55a6f0fa63c694bbd539c812d22ab1f7931e349c4e21497fbe942ffac8ec5703a13465f7765730a7598b7b96a4b0eee328e9136f3

Download Submit
C:\Windows\SysWOW64\Cnndbecl.exe

Filesize
110KB

MD5
e30692fa3940d7e91066ae21628408a6

SHA1
cbdb4f2dba1ba553bc347e5bbc3a8cc741a8a402

SHA256
6682ef5358a67dd8326a0116e07fea6509105f6be975fdeb683d278e2e8ae0c3

SHA512
91e7303eb6f91bbc95b2523d5588be5fd8be12a6ea12b6383906ce6dd7cc1836e676c510906ddee82b5a63aade7a7e0bba78302a4cea5e1551f7d53d893dbbe3

Download Submit
C:\Windows\SysWOW64\Cokgonmp.exe

Filesize
110KB

MD5
9eccd02e8bc3b5a348e992ec60a17ac5

SHA1
77dad2216269af5729fefe33d6d255500f261f45

SHA256
f3b92c0489cb517797051fdca1f523cbfeeb21db1a517d4901b21db500e2d7a9

SHA512
2673a6327b9b864cd79e9fd3332cd9694029fe58c7ebf3187fbbac44bcb290fa836a13f50d8ca2fc7d6ce6cadcbf5a1fd820f64b665f9ebe1d9363cabd1cee58

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
110KB

MD5
cb8d31d166ce7da2eb5bbbc3f335c09b

SHA1
fcfe10c90a618087a4755a52d8853ecbba56a040

SHA256
15f1569ee390b3da38e3db5159250bc04bd400fe83939f590fe9dcf8baf34804

SHA512
75bdb73a662a69919d76084cf1a736e5a87cd2dd489811b2189fd3e40636b40f4c06e93ae819a93c825bcffbcec4297b59a71df368ccf1150d9c1effaddaaaf6

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
110KB

MD5
0a5c22f0de1af44509e9ffe72886a792

SHA1
c655c2cf590ceac63a359a3b2edfab62afd5f9ba

SHA256
23bcde35760ef0b79bb65fd9733cbc5a74c2053a430991d81cc21af7713450af

SHA512
1e5511f5d432aab6a09371d5bae13b5d61e81cbcb1f206678bd0bb4bc94e653b9d877942670ed84a1a7ac4ceacfffaf1f6817f244042656a24960208c8716c0a

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
110KB

MD5
0a5c22f0de1af44509e9ffe72886a792

SHA1
c655c2cf590ceac63a359a3b2edfab62afd5f9ba

SHA256
23bcde35760ef0b79bb65fd9733cbc5a74c2053a430991d81cc21af7713450af

SHA512
1e5511f5d432aab6a09371d5bae13b5d61e81cbcb1f206678bd0bb4bc94e653b9d877942670ed84a1a7ac4ceacfffaf1f6817f244042656a24960208c8716c0a

Download Submit
C:\Windows\SysWOW64\Debnjgcp.exe

Filesize
110KB

MD5
9b19ce6762d2d640d85bfa32f27011e1

SHA1
39fe9378148c5cea7af19d529f662acc86e2a36d

SHA256
50754c98d0594226b8da4916651df0cca23e65dd04893382998c00876954a8c7

SHA512
7a66ae10f6d3c30a62b6c189d8b5e2993817ad669f182b73992894dfcb710b6aea76a230c46ca4d7ea1f350dcdf6692241ff1df59d40dfa02f344e0c64dc5a0b

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
110KB

MD5
8b5f1c965a71a78e560618c2b45ca147

SHA1
d593c343066c0675ffd774f3cc8e804bc8b4120d

SHA256
0ad7f43f4e310e0650d77c645708d52d435959aa4188722a7cf53dc38f49f497

SHA512
c707d30535cdb35c956aa76ac7e28569294c6da002487eef4e2898c4f28d6bf986a956bd8066331a732e1af1cf70bd38aae8ece2eede188e029ac7564a916ce1

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
110KB

MD5
8b5f1c965a71a78e560618c2b45ca147

SHA1
d593c343066c0675ffd774f3cc8e804bc8b4120d

SHA256
0ad7f43f4e310e0650d77c645708d52d435959aa4188722a7cf53dc38f49f497

SHA512
c707d30535cdb35c956aa76ac7e28569294c6da002487eef4e2898c4f28d6bf986a956bd8066331a732e1af1cf70bd38aae8ece2eede188e029ac7564a916ce1

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
110KB

MD5
b3cafc2c196d01a4dade12564c18e05c

SHA1
e77ac24ee2e32c0f958421edd9cca658fa5cbc42

SHA256
05e479c2767f8b809ec915120463a9fd38604ad443ce7a45b2c07c75f58a6ec9

SHA512
5046c41713d539e30d02c655a7e32402892da5c34f6aeaff7e2b7c40af52d4472e17e7aa4fd399ebf1cdcb3cae9f9b052120bf3755d030dd97ec141fc2dc08d1

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
110KB

MD5
b3cafc2c196d01a4dade12564c18e05c

SHA1
e77ac24ee2e32c0f958421edd9cca658fa5cbc42

SHA256
05e479c2767f8b809ec915120463a9fd38604ad443ce7a45b2c07c75f58a6ec9

SHA512
5046c41713d539e30d02c655a7e32402892da5c34f6aeaff7e2b7c40af52d4472e17e7aa4fd399ebf1cdcb3cae9f9b052120bf3755d030dd97ec141fc2dc08d1

Download Submit
C:\Windows\SysWOW64\Dlobmd32.exe

Filesize
110KB

MD5
a6d7517253b2fe1218ac197d22135395

SHA1
c5620e91198c61a3218f2de3b8801fce6fb144a0

SHA256
1c4dc52ef9a60ac79b97f59d92de672f60938d45bcd13c8b7b67a12c293071cb

SHA512
7c19df3c36f9e59fc5e9bafbed6f1a8faec59af73214143953dad8e07f2b143913970d72ac643196755b32b9eeb072bf7f2717728070072995c4dd4e4e6faab1

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
110KB

MD5
1ac7eca084e54a039f4c9c17819067d9

SHA1
8bcec8951cb4773b4157047242b8606b278857b9

SHA256
5932d65fda15efe87b38e42373a1bc1c652034ac31d8f9e1732e55b090cae94c

SHA512
d56a1ac4f9178ab8fe9337ff373fb362d8a50ada7622ae8e57c1cee4bc54bb6e47ca1ada1c94a4a73d3eaa4a5b1abeb7f92af41948321dce4576597b11e4647b

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
110KB

MD5
1ac7eca084e54a039f4c9c17819067d9

SHA1
8bcec8951cb4773b4157047242b8606b278857b9

SHA256
5932d65fda15efe87b38e42373a1bc1c652034ac31d8f9e1732e55b090cae94c

SHA512
d56a1ac4f9178ab8fe9337ff373fb362d8a50ada7622ae8e57c1cee4bc54bb6e47ca1ada1c94a4a73d3eaa4a5b1abeb7f92af41948321dce4576597b11e4647b

Download Submit
C:\Windows\SysWOW64\Dnghhqdk.exe

Filesize
110KB

MD5
38014028a5e5a4c425ccac15cf71f8c2

SHA1
21a1782c640978b5e048cd7e37cd0468c6c7dc69

SHA256
98d7c253df449405416746eed1228bd0742e61b4dc069e5cce18200a6255f59a

SHA512
9d7746819a323987bc5ee997de5bc89ddc63684d47199eacfd29a34c3dc18ae4eeca2eca88b592760b92192806cff6e7ecc3019ec24bf34ca701f30533ed9a77

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
110KB

MD5
afbabe14c5951fb823b5ee4a02f59707

SHA1
298b7df6190c193d904a66f432ee23b6b6c2eca0

SHA256
57e1a258ee624becaabf688e0ae06c4a33cc79c11141bf6696d3cb50ed74ba3b

SHA512
7dc89908ca0d9dbbf78a05847cf397b19a0f3e2cf71bd21bf2299912a6c228fcd4845435f46b988c6d79b89746db3074ce83ddbe6862740ffeb266ce95efae61

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
110KB

MD5
afbabe14c5951fb823b5ee4a02f59707

SHA1
298b7df6190c193d904a66f432ee23b6b6c2eca0

SHA256
57e1a258ee624becaabf688e0ae06c4a33cc79c11141bf6696d3cb50ed74ba3b

SHA512
7dc89908ca0d9dbbf78a05847cf397b19a0f3e2cf71bd21bf2299912a6c228fcd4845435f46b988c6d79b89746db3074ce83ddbe6862740ffeb266ce95efae61

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
110KB

MD5
f92645bf1a05c04d110b3699d41d7d57

SHA1
61f6a174a6d43c3ddb5789fdc40454e91b464ba9

SHA256
1602ba60f391402f4f53ef24f9263621e8943ea0ebd351144cc889958638d706

SHA512
b2e514f7619669d7ffd4282324a5f41a93f21bd67aec60c127493d12c5c3f35efc49802610fbdca0dec7c4b17234d743420a166e6b0d744fd8d4ff62bdc44e5c

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
110KB

MD5
f92645bf1a05c04d110b3699d41d7d57

SHA1
61f6a174a6d43c3ddb5789fdc40454e91b464ba9

SHA256
1602ba60f391402f4f53ef24f9263621e8943ea0ebd351144cc889958638d706

SHA512
b2e514f7619669d7ffd4282324a5f41a93f21bd67aec60c127493d12c5c3f35efc49802610fbdca0dec7c4b17234d743420a166e6b0d744fd8d4ff62bdc44e5c

Download Submit
C:\Windows\SysWOW64\Eckfaj32.exe

Filesize
110KB

MD5
6d4e8922a630d05059a0f7d08461d190

SHA1
73465f53a27d652f4a3e1f8fbe927e1b2fa70842

SHA256
01edf204e5673917878357e050b498fc6cdf581ed081ab395c83cab5c7768c6c

SHA512
235db6a5969e4f85ed1add3b99b8c50d6000c0eee59ea7320f6e3261039fd209914c77af220b181cd561ea04ee8f8f4035fc5c6ff095fcfbabb6779f798c7f9a

Download Submit
C:\Windows\SysWOW64\Edfdej32.exe

Filesize
110KB

MD5
62fcf095688d54bf1253a3bd3c2f3218

SHA1
365932631605b4a3e5adaa311158dcc707169bfe

SHA256
3fa4a5577289e73da330dce52514edf588685260903e0633689a63936e8097b8

SHA512
42b490c18aef16be154576a1966a2dbe306a9abbd194d85c965c78caca5717d2e470a0bad425d80cc403ea6cdce0ae99fc6b80de4dc8c781f5e11ae94b3135d5

Download Submit
C:\Windows\SysWOW64\Edfdej32.exe

Filesize
110KB

MD5
62fcf095688d54bf1253a3bd3c2f3218

SHA1
365932631605b4a3e5adaa311158dcc707169bfe

SHA256
3fa4a5577289e73da330dce52514edf588685260903e0633689a63936e8097b8

SHA512
42b490c18aef16be154576a1966a2dbe306a9abbd194d85c965c78caca5717d2e470a0bad425d80cc403ea6cdce0ae99fc6b80de4dc8c781f5e11ae94b3135d5

Download Submit
C:\Windows\SysWOW64\Edmjfifl.exe

Filesize
110KB

MD5
ea8518ef0182bb8e1d3b7a937508270d

SHA1
344a47c99a1d34439d09830467c8dd9e86f78549

SHA256
3bc4c8ca6b01a3194d7f49a8ce315b9a4f23c0c118f0a3b956e7e478e2b1b7a6

SHA512
f7e47795cac98c43f79724349d5f5ac898bc02be0910c6695e499d0f190bac3d41fcd3c0ddff6a8726f2ea8d3d18da6c34cfeafd0b73430b2da5f32a7fc4474f

Download Submit
C:\Windows\SysWOW64\Edmjfifl.exe

Filesize
110KB

MD5
ea8518ef0182bb8e1d3b7a937508270d

SHA1
344a47c99a1d34439d09830467c8dd9e86f78549

SHA256
3bc4c8ca6b01a3194d7f49a8ce315b9a4f23c0c118f0a3b956e7e478e2b1b7a6

SHA512
f7e47795cac98c43f79724349d5f5ac898bc02be0910c6695e499d0f190bac3d41fcd3c0ddff6a8726f2ea8d3d18da6c34cfeafd0b73430b2da5f32a7fc4474f

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
110KB

MD5
e75b2bb14e6ca16e33599bebe7804cce

SHA1
1927ce36e22c75c86d02e27e002a1aedb7d08b72

SHA256
c866fd39fd7a3ca4ea971da1f092ad49241f5d56e3ab97bd2c50f6dd71659832

SHA512
542c66bb96ec9ad673eacb6e0789a2935f44f7f289ccb53e05e81afa1908d230337465102ebed1650cc70e49e7c780c443a817a59eb33a6ba8783b01a8a51da2

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
110KB

MD5
e75b2bb14e6ca16e33599bebe7804cce

SHA1
1927ce36e22c75c86d02e27e002a1aedb7d08b72

SHA256
c866fd39fd7a3ca4ea971da1f092ad49241f5d56e3ab97bd2c50f6dd71659832

SHA512
542c66bb96ec9ad673eacb6e0789a2935f44f7f289ccb53e05e81afa1908d230337465102ebed1650cc70e49e7c780c443a817a59eb33a6ba8783b01a8a51da2

Download Submit
C:\Windows\SysWOW64\Eggmge32.exe

Filesize
110KB

MD5
425e3a9549fd75f184310059e5c01e62

SHA1
c480748e3d4866b421c36e9d4f02da35879aa889

SHA256
ea1276149bc72d3be0b3b85f75c280cea7acb63f32bfba4d4d975b86f19a70b7

SHA512
753dccf0bcab069be4a49c3747cb0227bde68b8c5578e08ee91efaf62a1603ca78f40dfb55f79e0cf920dd733299913a933712fd08f71a83b2d43ca802205f11

Download Submit
C:\Windows\SysWOW64\Eggmge32.exe

Filesize
110KB

MD5
425e3a9549fd75f184310059e5c01e62

SHA1
c480748e3d4866b421c36e9d4f02da35879aa889

SHA256
ea1276149bc72d3be0b3b85f75c280cea7acb63f32bfba4d4d975b86f19a70b7

SHA512
753dccf0bcab069be4a49c3747cb0227bde68b8c5578e08ee91efaf62a1603ca78f40dfb55f79e0cf920dd733299913a933712fd08f71a83b2d43ca802205f11

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
110KB

MD5
801b4f4b2b3d6f5027e5671fa583c9ba

SHA1
2dcb717005c5be3b870f53b8dc235cd424633e33

SHA256
b043e425e26f2f2523b27f617a63ebf926f07637d53a4e97692085af7d52de22

SHA512
a085864602f6ab746687ccd1628f682ae143481ca256be8338e0799c51202fba42caf32973c16432f5d438184fea628da19b7e02ac970ff4944a9f100ec61f87

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
110KB

MD5
801b4f4b2b3d6f5027e5671fa583c9ba

SHA1
2dcb717005c5be3b870f53b8dc235cd424633e33

SHA256
b043e425e26f2f2523b27f617a63ebf926f07637d53a4e97692085af7d52de22

SHA512
a085864602f6ab746687ccd1628f682ae143481ca256be8338e0799c51202fba42caf32973c16432f5d438184fea628da19b7e02ac970ff4944a9f100ec61f87

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
110KB

MD5
c62b2165ee1634022a34cc3bf744df4d

SHA1
100008dcde3944378271894650a741e09ff35762

SHA256
01b20ef98b67c6a26919d98b3f1ee88442d6dc2c2005d6cf470f66ba16011055

SHA512
38e0ee1725b0a237de16240f713cbab5ef100321f119a4965a2ab1928d60c09ddd0d297dcb1947df81ec27d9a178ae62d2385b1749d437f289cef23b85b6ce82

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
110KB

MD5
c62b2165ee1634022a34cc3bf744df4d

SHA1
100008dcde3944378271894650a741e09ff35762

SHA256
01b20ef98b67c6a26919d98b3f1ee88442d6dc2c2005d6cf470f66ba16011055

SHA512
38e0ee1725b0a237de16240f713cbab5ef100321f119a4965a2ab1928d60c09ddd0d297dcb1947df81ec27d9a178ae62d2385b1749d437f289cef23b85b6ce82

Download Submit
C:\Windows\SysWOW64\Ejglcq32.exe

Filesize
110KB

MD5
2f7051c5fffb1c43f97fd847e0820616

SHA1
3aaf98b7994e7a64c14a22875bf857e61ffb89f8

SHA256
9f36e3ec27dd2edb9c10ef157eb38c64285cd49a9b86ac69dea849711c0dd6f8

SHA512
8eb063cfef6ad181f15c0ba7d6bcfedd0dc30d58453c79958744d7fbf6d1a6698ec2b356d68be2de00f505863b2356003ed8135221f7479e2cde18b5afde2a42

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
110KB

MD5
64cd1b2219252892fb3e1f71699928ce

SHA1
998cb906f29528d48b08a082f90f4c8219928524

SHA256
362b5d2bafc9d2bbab7e665c86e572670a85bad367cbd07b264c428f77378e94

SHA512
f30d6115a7e2bfb975f0925093e6c180fd04ac8cadd6546a70276a8c132f85274395dbae41caeedfc369f1f2bc14648dbcb7263e6505e695a620ff0d0ee8fb89

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
110KB

MD5
64cd1b2219252892fb3e1f71699928ce

SHA1
998cb906f29528d48b08a082f90f4c8219928524

SHA256
362b5d2bafc9d2bbab7e665c86e572670a85bad367cbd07b264c428f77378e94

SHA512
f30d6115a7e2bfb975f0925093e6c180fd04ac8cadd6546a70276a8c132f85274395dbae41caeedfc369f1f2bc14648dbcb7263e6505e695a620ff0d0ee8fb89

Download Submit
C:\Windows\SysWOW64\Ekgbccni.exe

Filesize
110KB

MD5
a7e0203b2bf4027a4dfec4ea251fe4ac

SHA1
a05776c69a135c2e8153fc1fd0747d03e2bfd271

SHA256
550361ea33e68f6f8329d66d3522d55cf259b361c3adc6d3376274ff6d5a5d04

SHA512
d6fe3e68c71f03861e3b982e69fe9ab3a259002f8957e124534618778e679db51ae7998e30182c6132b4422a93dff67402a9a55b643df3f6e636f993f8e840f9

Download Submit
C:\Windows\SysWOW64\Ekgbccni.exe

Filesize
110KB

MD5
a7e0203b2bf4027a4dfec4ea251fe4ac

SHA1
a05776c69a135c2e8153fc1fd0747d03e2bfd271

SHA256
550361ea33e68f6f8329d66d3522d55cf259b361c3adc6d3376274ff6d5a5d04

SHA512
d6fe3e68c71f03861e3b982e69fe9ab3a259002f8957e124534618778e679db51ae7998e30182c6132b4422a93dff67402a9a55b643df3f6e636f993f8e840f9

Download Submit
C:\Windows\SysWOW64\Elaobdmm.exe

Filesize
110KB

MD5
76813f6e85da8a697ef74a7615f0033c

SHA1
d6b2ad8a54fd0b10e2eaa1cc1884741d520a76ba

SHA256
fa02963ea7842254d771f93aa853473cc757cb85fa0bbd6607d274b92c3ff9cc

SHA512
2088080a4a72c1de260731f77bd2cc2858df2b06de212a43c8a0d91c11aaea1f476fbb21ffa9e405a16d936017349a89be707accfa9871e8f5db2999439f37ba

Download Submit
C:\Windows\SysWOW64\Emaedo32.exe

Filesize
110KB

MD5
a3d0a6df4a98ccb5540c638e3d13b53d

SHA1
682e755533c491873086a557944e7f5efbc26039

SHA256
231cbbf58fcc3b62707bfa5da7f480e489a2b717854376b33a6b873682b1a5e6

SHA512
500048c9dc2ab18b146daa42b0729e0bf8f161d01a3dc8c2abffa4cfed7e032762182817c77b79962e7b08d7a3144f84a7c21645acab8c9f7cc29444db76408e

Download Submit
C:\Windows\SysWOW64\Emaedo32.exe

Filesize
110KB

MD5
a3d0a6df4a98ccb5540c638e3d13b53d

SHA1
682e755533c491873086a557944e7f5efbc26039

SHA256
231cbbf58fcc3b62707bfa5da7f480e489a2b717854376b33a6b873682b1a5e6

SHA512
500048c9dc2ab18b146daa42b0729e0bf8f161d01a3dc8c2abffa4cfed7e032762182817c77b79962e7b08d7a3144f84a7c21645acab8c9f7cc29444db76408e

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
110KB

MD5
a192ab2a076e4c9f4593d14ea5ee21d2

SHA1
43d57f9f9a532da36c033d7d91b5cc8a9380ddac

SHA256
1c323cd510698f46f50b16c644270d63f3211120d59a2e522b3f0ba07a3c2aa1

SHA512
175f75a1f9c66bf802398e1a00c2c9e870131423c1334e5842793ebda3f1d329a81505cf528049fba2651b201c903e3a6a089147dae8046c056bbbe57fa569a5

Download Submit
C:\Windows\SysWOW64\Falcli32.exe

Filesize
110KB

MD5
b6459dc69ce1eab0a5ac05de15393114

SHA1
e4ddc3e2ce1371bdbdb3cf3e9adea3750aa2162b

SHA256
786b2af6d9b84ea86cc1ae9860a9072961ba236877e486366f94cf06d57502f2

SHA512
43bfe1be8ffb8f930462a9ac8014f6e5759ad70648bfc62d8eb8ba1751895d3d3ef5c25cf700ba6eb02f46d19a1def99e9ae5ec7466fee5a7fcbb0283ad9a60d

Download Submit
C:\Windows\SysWOW64\Fbnmkk32.exe

Filesize
110KB

MD5
69c3cc7065afa6997f258a3d38ef35d6

SHA1
d1f987798c467a867632cbe9e1be3861011bd3ae

SHA256
2dbf911799f9b4aa5889ccc13b491ca9ee41edf9a29460ec4666a6dec1b0d302

SHA512
1ee0c5c0e70f465523782bd47950fb54df5632fb31f7bb06c2d6f9bcac5c7b27d17ba145799999c914efa2b22b5ec675418c93fc1d0320007ad890096ae324e4

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
110KB

MD5
209f5564408f10d2484e7118e5c55c31

SHA1
65dcbd8d2d51fc0c2627142e335ba5142f6fc177

SHA256
84df1e8fa1982a9c51ab80cc737a3d12876dc85582cb79ea7cb7042eb443dcb4

SHA512
7f94bea09328ce98fe0b3a2ed218d3aa388c028dc6d7fc0e00ace00f9e6a141ea7e5914bb3fa79a5317c3d14c81384cbf1f47397226626a56fcebb08f4cc3504

Download Submit
C:\Windows\SysWOW64\Folkjnbc.exe

Filesize
110KB

MD5
720f4d6f760cda6fb81c0e164b43e003

SHA1
55ea9d690c21580010b71805b470a4d9c840447d

SHA256
dd3d5cd844a7a0a92da2936810d9c55c84062cdbc55f5fb39decced80120250e

SHA512
9ae589f373160eb2aedcc5f6f1833052037972d54e737b243753815a4f8f5b29a9854cf0af9d8873b632a65ac4c8a7c3613cc10cf807d2041ea0a76cf34a0647

Download Submit
C:\Windows\SysWOW64\Hjimaole.exe

Filesize
110KB

MD5
9ce1479591dfae51b16b6b757c25c358

SHA1
b170e4608e25cce15d453c3ed45b8c120cb442ee

SHA256
f2c60c9156773eac96eede095447f6c60168947dce23b17382c552867ecb2377

SHA512
2f582425f4cb934bede0d42c5b3879c10751ec898ba56912806bc5b8e4e40c99395c642440c29de4075a3727e82eace640cb8c171ee16b8ed9ee49be583b25a7

Download Submit
C:\Windows\SysWOW64\Hlhccj32.exe

Filesize
110KB

MD5
4af0badc5bccbb2c3c8c9ed604f6fee7

SHA1
13d1e3822575ca839b40c67af18388985e4903d0

SHA256
fcfe2f034131090c28ddcb88c4fcb97a314d6a27721f5b026d90b87734384555

SHA512
b5c33cf25b7fc4c9cde7fce95f08307b15f77a98572cd278da8e4a09b8f3144d2765242e46ada94e44963df156a92658571007c34d47aa5ffb4a4c66e8690db9

Download Submit
C:\Windows\SysWOW64\Inkjhi32.exe

Filesize
110KB

MD5
a1f09f768bb58b6fb5debe4537faa825

SHA1
a5ff892c9a903769884a0e4f95fd8ee8a25583a6

SHA256
3f54bcec4580bdbc53701cbd7080a72f961071714028690b13c3b8f3334f98a1

SHA512
7d490f4ce2d311c5308d8af91af090b756000e36232eb81944f661320082a6ae2454aa315a3d596eb27f8ae4f6a62d66ebd7b5dec5592953709c437dfed6ab68

Download Submit
C:\Windows\SysWOW64\Jalakeme.exe

Filesize
110KB

MD5
e4c393f747243a04c097e2831cdd19cc

SHA1
0c2a940a822ca473de19f4d5fda8f23c1d4a36e7

SHA256
1c42c545c47d88cd3c2a9e6e5642f3fe158b888934fe61881e7432c47caa09c7

SHA512
8cf379bb9df5b05bc9c5f079183927347f2cede462bf71513dffdd0e0fd7ab76602b4a27b22854bd9bfb3579e0fc99e00a65082f98bfdf0935272fa71563fb93

Download Submit
C:\Windows\SysWOW64\Jhapmphg.exe

Filesize
110KB

MD5
6bcc5e2a200f360e9e2bb17f53e98fc4

SHA1
b0689879db8d92dde0def9ef479c9bc6cbc04e20

SHA256
e7f7ddd0a084f88982b83a6e9e6bfe2721d6ecce92da067a4191eced9466fb4c

SHA512
601c742f14977d95ac58ab7c029f405be629d1dfc9b380bff1ee050b6718c40f07db771fba64ab95b5e2acfc7bd8ce70f5666e8706feea999e7fe6dbd38d46c7

Download Submit
C:\Windows\SysWOW64\Jkkbnl32.exe

Filesize
110KB

MD5
6d3199d0dfa61cda048cb3534a7cc307

SHA1
bf96580a54f044ed38f39d927b63583733e46e35

SHA256
b6f9b99da48f7e5a9c817a97893d9b727306423e4aae2d95ba10e79169929e5c

SHA512
50b4af332adc4ef6eb52e07e7359963896a1f069851e001bc5e6fb1d5dccbf489dbce0f4e30946513cd1461c1afa3c59f3b04baa7abc19c8a01b23231a53e587

Download Submit
C:\Windows\SysWOW64\Kknhjj32.exe

Filesize
110KB

MD5
2b33657c6475bf6c973fe49e2c974a8f

SHA1
d888019fb8ebb20f275e2de0d935b94da2d6f7a7

SHA256
b4899a7bb743f2369198465de34800aa17bf41810d23023d0389ad802d245d9c

SHA512
a735761d36f8c66c23d0b7c150d92af1929bd520e4570b5f15e77c78788ff1060f4b72ad1047368ce75f21116071f1e1afe6ddf5bc4654b1fba14cb87f0bb332

Download Submit
C:\Windows\SysWOW64\Ldkfno32.exe

Filesize
110KB

MD5
1ebe89a577f78c96abed6e0a31e701dd

SHA1
8856d7ca5532b578d503f2be97f2e2f1860f68ce

SHA256
2de414301cbd8823dad2d21913224faa4ac66b3cf61c6f3fde409e5c0a9ea473

SHA512
0f8e04e8d5fef63b79b39baaa2709b53085d3e5c970cd9bd4e231fbc55e1084e83f23af3d6758f8e2f805ae070707e7453bb7335d142b7c6da50f4ad63e4c83c

Download Submit
C:\Windows\SysWOW64\Ljhchc32.exe

Filesize
110KB

MD5
6e69c737a13e599627e6bc1708ed1a2f

SHA1
fdb1e11abe01f5f288e8b27447e3ae714c9742eb

SHA256
1b93a9e8adadb7d65b74e911993dc10d1603d4d6400de344ec6a8a6cb591992c

SHA512
8d8fc814d801be25f156cf4e8687f4cd5560e569d3144e0100bf2db7f40c791be4dc96b74731e7758a4b833a3047cc97a87341e35b5b3e28d21f502faa56a924

Download Submit
C:\Windows\SysWOW64\Lkjhfh32.exe

Filesize
110KB

MD5
4d05acf87ab7740fb91a629fcb95c5cd

SHA1
98740f84ac015055240a522daed90c0ba50e1b34

SHA256
0d0ad1748eb0168227da79f8b44b42c4f6c255881f44ecdd2bed98273f5788a5

SHA512
0ebf5d0d1a51d4752c39fff26e3b72aa975685405565b1af3882db250438b8503709fa7ef9cd5c41f9ba29a3594552f073c1c8cbc656efbf9648214cd04aa1f7

Download Submit
C:\Windows\SysWOW64\Mafofggd.exe

Filesize
110KB

MD5
ca514d3c2e4a0bef03904ae2778357db

SHA1
b6aa15e91542c6244dc327060122da601314ab47

SHA256
ef24c2bbe62e87ab0eb9833eb9b8c45ca0ef613471287b644f09e00742203af5

SHA512
a6e2d1d5ad853e298d425f5ac2a5d7f8b4d329a728083e6c93a11e87f1327f562c89d505d32670c69da7905628d189c0090c6623e45116575298a92fcc6c6328

Download Submit
C:\Windows\SysWOW64\Mgkjch32.exe

Filesize
110KB

MD5
68a35f4e7fdb6a5fb40858bea2330a62

SHA1
ceb631e974251a70cd8a517019bb9bc23a0fed70

SHA256
255b213642f0f78987730f4c1baee985df547dead27ce2579b374dbcb79b15bb

SHA512
ccf808ae04819ae28669066b1471a58097da07bac90962c0048e32e864bc397eabf05d817c5c3c6586aaba64ce70951e1190b3ae22b431510415657835aad3bf

Download Submit
C:\Windows\SysWOW64\Mnaghb32.exe

Filesize
110KB

MD5
9ad2ba05630de161daa979d6b0da532a

SHA1
43550501347f118502098bfa8bf4188826337e25

SHA256
a013e39faef16cd6130c2cff5ae3a824408a55ad7758987da0a084b2ea1d9ee3

SHA512
9f8bcfd337c0888abade457bb06bb8e5340b4651f06d35f85335222bd4a83437e952f2afbd665d899056e9a4c3c228574fce4b1e659c66f89f7fb3083de2406d

Download Submit
C:\Windows\SysWOW64\Nooikj32.exe

Filesize
110KB

MD5
cb7b859cf68a6238919928280a2f9dde

SHA1
e03171540ddd9ab2af43d3a651fc192db934b522

SHA256
9a834d2eb3df23ee5f76148ce36a5aa42884108f3ce646500cdc18c83ce4d7d2

SHA512
109ecb1c41f3b7cc88483d7b0bb0a8266756484f1a9ce1e5baf85d6b4853289353aa208e066047c475ef696583ddb788f95392662e314f7e0967339d1a2cc224

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
110KB

MD5
ee2d0ebb6e395c2bc7af6a95efe1c4f6

SHA1
76127a6104410a31b36c5ad91c69143a6badeb2b

SHA256
07ca3679910f8a60bebd998300f748b2389b84fa776f809b586bc30229699ae3

SHA512
79201fde8e489055d5341f2f7540bf55d917b8cfea1237c1b4f5da23930d83ccc5f50a2a127098d16f7912cc3c3744a27e63abc69d1df41365827edaed158d88

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
110KB

MD5
ee2d0ebb6e395c2bc7af6a95efe1c4f6

SHA1
76127a6104410a31b36c5ad91c69143a6badeb2b

SHA256
07ca3679910f8a60bebd998300f748b2389b84fa776f809b586bc30229699ae3

SHA512
79201fde8e489055d5341f2f7540bf55d917b8cfea1237c1b4f5da23930d83ccc5f50a2a127098d16f7912cc3c3744a27e63abc69d1df41365827edaed158d88

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
110KB

MD5
2294faa05e4c1fa93814196448aea6e0

SHA1
57d5a216748388fce06a2e2c09608e2a3748ae6e

SHA256
00b90b9d5c8dcf09044a0dd7ee06d4be432c30f28c6debf4178fa67f187ef086

SHA512
cab781995c97e6026d2fc11b2d2ecd25653119f66161c3ae2b63bae6b20761e27762098a47f83cec03ae54afc268a2f4dafd21add6b7fdeba5a5fd3acadb5711

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
110KB

MD5
2294faa05e4c1fa93814196448aea6e0

SHA1
57d5a216748388fce06a2e2c09608e2a3748ae6e

SHA256
00b90b9d5c8dcf09044a0dd7ee06d4be432c30f28c6debf4178fa67f187ef086

SHA512
cab781995c97e6026d2fc11b2d2ecd25653119f66161c3ae2b63bae6b20761e27762098a47f83cec03ae54afc268a2f4dafd21add6b7fdeba5a5fd3acadb5711

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
110KB

MD5
fd7d1c4d921ad0441fe6caaa9247e29e

SHA1
d458b814d6e8e619753a942003339bd80315187c

SHA256
6e39d040b28a1fd3d62989b1b81c5f10541608a1a641eb6a8449b0a80bc9b197

SHA512
e5bd88434a1293141c0cc2bd228fcd3500ad1c0c6c5ff6ecb39fa6170675a54548840659101119941d527765c71ceff57e9c3890d9f5f1b5062b028793858928

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
110KB

MD5
fd7d1c4d921ad0441fe6caaa9247e29e

SHA1
d458b814d6e8e619753a942003339bd80315187c

SHA256
6e39d040b28a1fd3d62989b1b81c5f10541608a1a641eb6a8449b0a80bc9b197

SHA512
e5bd88434a1293141c0cc2bd228fcd3500ad1c0c6c5ff6ecb39fa6170675a54548840659101119941d527765c71ceff57e9c3890d9f5f1b5062b028793858928

Download Submit
C:\Windows\SysWOW64\Oflkqc32.exe

Filesize
110KB

MD5
5b61f1c29a204271387c55250f0e7854

SHA1
74c6e4ad81dd799649d7fe89678abc3bfbe596dd

SHA256
dfeace946fe04cfd05f0f2ff518b439b5787bc8f0fdacf99b2746f08fc088cad

SHA512
a34e75b3ae7e3360624d030e5ed02b97b68b3f454ca6083b67ea4a74b6c2003a9d2cb67e73cbbdf2c3ab643e7d58d1c2926201668b0fab301c12543453bdb07c

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
110KB

MD5
031d1159e798097592e9fd86efcd1c9e

SHA1
f7668f71496cee82df00d537fa609dfa07198ac6

SHA256
14a7fe480d833c6e3a023133fb64038ca6c3b78613237726d90ec4d724e0644c

SHA512
415d22ed15b518e33142f9dc15e7c8afcd53f671359123af3245c6a4241d3ab2a0d8cee2d0258efbd25944b38136dc1f311ce5ccc61af05f7abc06d8db4fd95b

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
110KB

MD5
031d1159e798097592e9fd86efcd1c9e

SHA1
f7668f71496cee82df00d537fa609dfa07198ac6

SHA256
14a7fe480d833c6e3a023133fb64038ca6c3b78613237726d90ec4d724e0644c

SHA512
415d22ed15b518e33142f9dc15e7c8afcd53f671359123af3245c6a4241d3ab2a0d8cee2d0258efbd25944b38136dc1f311ce5ccc61af05f7abc06d8db4fd95b

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
110KB

MD5
3e23c67d2545916bfeec89e472a6d183

SHA1
febb944fff5a5fe4119b5039eac6812ff8f18596

SHA256
d25c7bc101ae3cd27049ef7004eab38caea1d3f362a33d0c0b8b6b7b93996c7e

SHA512
483c6e74021944728155c155e0e03ce6f33ac483270d7cacffdffc2dc6b977b497903935e70f5e21f457f62a72c387d5d94cea5d7b6cebf4a4bc14cb827f6a3b

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
110KB

MD5
3e23c67d2545916bfeec89e472a6d183

SHA1
febb944fff5a5fe4119b5039eac6812ff8f18596

SHA256
d25c7bc101ae3cd27049ef7004eab38caea1d3f362a33d0c0b8b6b7b93996c7e

SHA512
483c6e74021944728155c155e0e03ce6f33ac483270d7cacffdffc2dc6b977b497903935e70f5e21f457f62a72c387d5d94cea5d7b6cebf4a4bc14cb827f6a3b

Download Submit
C:\Windows\SysWOW64\Omhpcm32.exe

Filesize
110KB

MD5
e963125871eaf41d1967709561fef24b

SHA1
c7d31b98a70c3a8ceb9a2969f75db06a179258c1

SHA256
b79c12e3448053be87f47ac75daab78c782a339c5ace01b6aee5b3762c99f50a

SHA512
944cb8b7a86ce8411bb6deb338030535e3c4cd32ea3a2013243d292e2e7e5b792d0fefc94b3031e2157a3c9be76d92511781af47127144709c197b367cea9598

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
110KB

MD5
66714728e3ca398526690ea8ad54bb4d

SHA1
cdf392fb7a62c2720aab6b0f0fd08ea4ac7dc738

SHA256
4c763b816f0a828c3acf34170b088d8d9a7737976500df781e6a9c055d5eb7ef

SHA512
68a12991415ca796407cbcbe5f1f1cc0ae856721fc890b551a19b4bcdafa221a6ad305a0a37991124235f6527478111076706e9acdf16529276af2d8593c5f73

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
110KB

MD5
66714728e3ca398526690ea8ad54bb4d

SHA1
cdf392fb7a62c2720aab6b0f0fd08ea4ac7dc738

SHA256
4c763b816f0a828c3acf34170b088d8d9a7737976500df781e6a9c055d5eb7ef

SHA512
68a12991415ca796407cbcbe5f1f1cc0ae856721fc890b551a19b4bcdafa221a6ad305a0a37991124235f6527478111076706e9acdf16529276af2d8593c5f73

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
110KB

MD5
75b01fdd31fb434a0389445241c4bea6

SHA1
9b014f366f6c2a2c0024be7e76eb03f3104dda2a

SHA256
b8590a96784726d79c63d769228f123340d46f2ab7e8dff89f14e91f9184beaa

SHA512
9fbf31eacfafba12da9433bf283af8b46c675aa6f576413314acd651daa20387c6831d117a959acb19133efd75abd6d4b69772abfdb6f1720e92b7ee1c2efb0c

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
110KB

MD5
75b01fdd31fb434a0389445241c4bea6

SHA1
9b014f366f6c2a2c0024be7e76eb03f3104dda2a

SHA256
b8590a96784726d79c63d769228f123340d46f2ab7e8dff89f14e91f9184beaa

SHA512
9fbf31eacfafba12da9433bf283af8b46c675aa6f576413314acd651daa20387c6831d117a959acb19133efd75abd6d4b69772abfdb6f1720e92b7ee1c2efb0c

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
110KB

MD5
2aaf6304f0f492fbcad9085fcf040214

SHA1
d2adea6b7df118d4932d8bd69dce84532bd1427f

SHA256
524543433f1f7d6ef91169f8934ab317c15ce32e73c40d496fbb6c6d20098f13

SHA512
c5bb7fb722861f61fe6bf73304ac77eda2b312f8fd6b6e595d752ac5079c5908a5eb779f7863200ca6b86a301be2116bf44552f641cf777a9d7fffb685de5152

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
110KB

MD5
2aaf6304f0f492fbcad9085fcf040214

SHA1
d2adea6b7df118d4932d8bd69dce84532bd1427f

SHA256
524543433f1f7d6ef91169f8934ab317c15ce32e73c40d496fbb6c6d20098f13

SHA512
c5bb7fb722861f61fe6bf73304ac77eda2b312f8fd6b6e595d752ac5079c5908a5eb779f7863200ca6b86a301be2116bf44552f641cf777a9d7fffb685de5152

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
110KB

MD5
21e8af757f3dc317053547be697ce723

SHA1
0f913b56553deb49d397b65846e53c3844727073

SHA256
da77e726c32f49c3a0a58903e055231539c776b0ba525f78ef516a868c52ea4c

SHA512
19c43d673117bf23779095a553d6d9eb597acc65f1ca95760cd4352014c1d41c623b120c3addbe936a330d219999d4eb1eb5ee62c972acd8646cfac82c4c3a01

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
110KB

MD5
21e8af757f3dc317053547be697ce723

SHA1
0f913b56553deb49d397b65846e53c3844727073

SHA256
da77e726c32f49c3a0a58903e055231539c776b0ba525f78ef516a868c52ea4c

SHA512
19c43d673117bf23779095a553d6d9eb597acc65f1ca95760cd4352014c1d41c623b120c3addbe936a330d219999d4eb1eb5ee62c972acd8646cfac82c4c3a01

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
110KB

MD5
b0dd3b5b0a0e4df8e4b8c8acb62029fa

SHA1
591b6f26b4cf5cf88f3781e224c2dd15158ed1b1

SHA256
a1b7a666d3d19b251dc575a14314d2a998aa408345c14ca518cbcab02d94e3b0

SHA512
fdbce70b698bdb2d2beae666bdcaba3676be4bde21a206729d9d4fb27e4765047ed7e5d03b35385c109a41d719ca866691d00f11c801a0376e2324a1e48d03dc

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
110KB

MD5
b0dd3b5b0a0e4df8e4b8c8acb62029fa

SHA1
591b6f26b4cf5cf88f3781e224c2dd15158ed1b1

SHA256
a1b7a666d3d19b251dc575a14314d2a998aa408345c14ca518cbcab02d94e3b0

SHA512
fdbce70b698bdb2d2beae666bdcaba3676be4bde21a206729d9d4fb27e4765047ed7e5d03b35385c109a41d719ca866691d00f11c801a0376e2324a1e48d03dc

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
110KB

MD5
ad2a94abd61a1b239067b29f6847a166

SHA1
0de901381177de7704ec616a9fb9bd2dae92300b

SHA256
aac4bb9f520546bc161fbc1de662d8b54a46d59197fa99a6273f26cd325433cb

SHA512
23c7b40be419ca4b721129f73d41b33b19b5c5ee9923f4ace0180569eb37f9f34763f0702aaca45ed28755f69681f7be157fb1e24642fbd429441e03d0765a71

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
110KB

MD5
ad2a94abd61a1b239067b29f6847a166

SHA1
0de901381177de7704ec616a9fb9bd2dae92300b

SHA256
aac4bb9f520546bc161fbc1de662d8b54a46d59197fa99a6273f26cd325433cb

SHA512
23c7b40be419ca4b721129f73d41b33b19b5c5ee9923f4ace0180569eb37f9f34763f0702aaca45ed28755f69681f7be157fb1e24642fbd429441e03d0765a71

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
110KB

MD5
7b639ab078a24e2071357f94fb16e3f5

SHA1
2583357cced553bc0d8e57f586bc04e4d3e72494

SHA256
c522b65b30aed6b4ac03b439c2ba02ca1ec060fdec146b0720695ed5504d9fe5

SHA512
ea389be34ec785a6bcbb66d2e8aa40ff1ea5bc6bab6f9298efd95a251b51169d40aa958734947cd20acc41c1c1110c25b1c5402de32afec207ecb62a45a6dfe0

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
110KB

MD5
7b639ab078a24e2071357f94fb16e3f5

SHA1
2583357cced553bc0d8e57f586bc04e4d3e72494

SHA256
c522b65b30aed6b4ac03b439c2ba02ca1ec060fdec146b0720695ed5504d9fe5

SHA512
ea389be34ec785a6bcbb66d2e8aa40ff1ea5bc6bab6f9298efd95a251b51169d40aa958734947cd20acc41c1c1110c25b1c5402de32afec207ecb62a45a6dfe0

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
110KB

MD5
6f50cad4144de51a84fda31e2c869fda

SHA1
2af53cb6cea860b597b775b9099c46feb64483de

SHA256
45f45ffae3acf35dc2b7690a9f381aa5f0bb6d61ba4c63ca8b13bbf7541c797c

SHA512
2b98bb5b4f4263613325815c5602c0a763d47cfe0b4ee932e7ef2b74a2a525e2aebd7c72d6292c97e922943ab3e35d4ea067b5fc01633f08d1e3cf40e56a12ad

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
110KB

MD5
6f50cad4144de51a84fda31e2c869fda

SHA1
2af53cb6cea860b597b775b9099c46feb64483de

SHA256
45f45ffae3acf35dc2b7690a9f381aa5f0bb6d61ba4c63ca8b13bbf7541c797c

SHA512
2b98bb5b4f4263613325815c5602c0a763d47cfe0b4ee932e7ef2b74a2a525e2aebd7c72d6292c97e922943ab3e35d4ea067b5fc01633f08d1e3cf40e56a12ad

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
110KB

MD5
1c9a6451b197ce7a70a0aad916684c48

SHA1
7c354aebf60bd93dec8790f038c6595459830bd7

SHA256
8b58c6d0cc2bc862a36a0709b498d8e15d96ab018ba2ed8ef40476a5f10c4e12

SHA512
7bff95675627e55a45f0403aa6f0950f5e9e81ef2e953f59b810b715b69288f7d08362d193443091b025ec0e4f4e432b6ee403b805795b721150656d3aec8a00

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
110KB

MD5
1c9a6451b197ce7a70a0aad916684c48

SHA1
7c354aebf60bd93dec8790f038c6595459830bd7

SHA256
8b58c6d0cc2bc862a36a0709b498d8e15d96ab018ba2ed8ef40476a5f10c4e12

SHA512
7bff95675627e55a45f0403aa6f0950f5e9e81ef2e953f59b810b715b69288f7d08362d193443091b025ec0e4f4e432b6ee403b805795b721150656d3aec8a00

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
110KB

MD5
dc38c590891f66bb194de56f0785658f

SHA1
46463223be9695da6a69e4565a086d3cd16eef9c

SHA256
891c5e652a8e6137d5f5e626dad9864aef0bc55fe0105c1c795b0758a9bf73a3

SHA512
fba549107e888f576fe9ca464617347acc353b104ca19ef50ea2503dc82e1232d3427520a0694eb4199d57f1642453983d2f46f80cad8a50bcb39847a01fe183

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
110KB

MD5
dc38c590891f66bb194de56f0785658f

SHA1
46463223be9695da6a69e4565a086d3cd16eef9c

SHA256
891c5e652a8e6137d5f5e626dad9864aef0bc55fe0105c1c795b0758a9bf73a3

SHA512
fba549107e888f576fe9ca464617347acc353b104ca19ef50ea2503dc82e1232d3427520a0694eb4199d57f1642453983d2f46f80cad8a50bcb39847a01fe183

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
110KB

MD5
e623bd7a9a6de1a870d74b43691e087c

SHA1
c7d3383e68e4233474420a1e5ed3be83833d32f9

SHA256
639ed4bf1168256223a1788d83ac6eedac69c95bed65ed605d40c107ac710db3

SHA512
8e123454ea67f01e13c62879fe11975ddbffc7f75f15060b8bb2e58323a061ed5ecf2559d6a836b35ca38f9dc6a8fafe870b17573e61c18f9e417234f7946678

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
110KB

MD5
e623bd7a9a6de1a870d74b43691e087c

SHA1
c7d3383e68e4233474420a1e5ed3be83833d32f9

SHA256
639ed4bf1168256223a1788d83ac6eedac69c95bed65ed605d40c107ac710db3

SHA512
8e123454ea67f01e13c62879fe11975ddbffc7f75f15060b8bb2e58323a061ed5ecf2559d6a836b35ca38f9dc6a8fafe870b17573e61c18f9e417234f7946678

Download Submit
memory/544-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/648-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1116-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1436-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1512-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1528-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1528-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1580-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1588-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1748-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2256-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2256-508-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3280-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-556-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4072-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-505-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4220-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4468-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4608-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4712-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4712-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4728-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads