1aa0efd02130a13de081621b77390975deb718b45f065338150f171183b02d4b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe
Size

192KB
MD5

be7c39e62ca805fb3d4bf234ed27d7d0
SHA1

b011617155bd838fb4075a2ebd4c1214c2d18782
SHA256

1aa0efd02130a13de081621b77390975deb718b45f065338150f171183b02d4b
SHA512

82e9c02365c54e3b667f85e98d727f37493b2c33f9679d2b1891468f9d3138275dedd390e1aa171d083bf7e2c33db4c2248ae94f03460b74373131e9afbd6ce3
SSDEEP

3072:F7WbiXT4f/nTTTQ9dSjj6+JB8M6m9jqLsFmsdYXmLlcJVIZen+Vcv2JBwwRBkBnf:FTD4HnTTTQ9dSjj6MB8MhjwszeXmr8SO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidofh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijqmhnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkomneim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aknifq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocacl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hghoeqmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmdfgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Achegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mebcop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnoiqdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hocqam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmofagfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jocefm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjblje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqojclne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkmmaeap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iciaqc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiildio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oidofh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahchda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eagaoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmeakf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neccpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiihahme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cidjbmcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekkkoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knbbep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgaijaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mecjif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bblnindg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hidgai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlnipg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghppm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfqkddfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbbch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piijno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gipdap32.exe

Executes dropped EXE 64 IoCs

pid	Process
3304	Lphoelqn.exe
904	Mipcob32.exe
1668	Mgddhf32.exe
2716	Mlampmdo.exe
2812	Mpoefk32.exe
892	Melnob32.exe
3104	Menjdbgj.exe
3472	Mlhbal32.exe
3888	Ncbknfed.exe
2520	Nngokoej.exe
3364	Nphhmj32.exe
212	Ndfqbhia.exe
4992	Nlaegk32.exe
4292	Nnqbanmo.exe
1528	Ocnjidkf.exe
1800	Oncofm32.exe
5056	Ogkcpbam.exe
2748	Opdghh32.exe
4236	Ognpebpj.exe
948	Odapnf32.exe
2324	Olmeci32.exe
368	Ofeilobp.exe
3960	Pcijeb32.exe
4416	Pggbkagp.exe
1596	Pqpgdfnp.exe
3948	Pmfhig32.exe
1532	Pjjhbl32.exe
3848	Pdpmpdbd.exe
4220	Qmkadgpo.exe
1672	Qfcfml32.exe
1844	Qcgffqei.exe
3688	Adgbpc32.exe
2596	Agglboim.exe
924	Aeklkchg.exe
4900	Amgapeea.exe
3976	Afoeiklb.exe
3652	Aadifclh.exe
2112	Bjmnoi32.exe
1484	Bagflcje.exe
4516	Bnkgeg32.exe
2072	Baicac32.exe
4412	Bjagjhnc.exe
4584	Beglgani.exe
3628	Cdabcm32.exe
2600	Cnffqf32.exe
3788	Caebma32.exe
1936	Cfbkeh32.exe
2896	Cmlcbbcj.exe
1276	Cdfkolkf.exe
1228	Cjpckf32.exe
4892	Ceehho32.exe
5080	Cnnlaehj.exe
532	Dfiafg32.exe
388	Danecp32.exe
1688	Dhhnpjmh.exe
4452	Dobfld32.exe
4976	Ddonekbl.exe
4912	Dkifae32.exe
1076	Dfpgffpm.exe
396	Dmjocp32.exe
5132	Dhocqigp.exe
5176	Doilmc32.exe
5220	Dahhio32.exe
5264	Egdqae32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eolhbc32.exe	Egdqae32.exe
File created	C:\Windows\SysWOW64\Dannij32.exe	Dfhjkabi.exe
File created	C:\Windows\SysWOW64\Jjopcb32.exe	Jhndljll.exe
File created	C:\Windows\SysWOW64\Iciaqc32.exe	Iloidijb.exe
File created	C:\Windows\SysWOW64\Mjmoag32.exe	Mccfdmmo.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nlmdbh32.exe
File created	C:\Windows\SysWOW64\Ohmhmh32.exe	Oacoqnci.exe
File created	C:\Windows\SysWOW64\Lippqp32.dll	Ffceip32.exe
File created	C:\Windows\SysWOW64\Egbcih32.dll	Hlglidlo.exe
File opened for modification	C:\Windows\SysWOW64\Qqhcpo32.exe	Qlmgopjq.exe
File created	C:\Windows\SysWOW64\Mlklkgei.exe	Leadnm32.exe
File opened for modification	C:\Windows\SysWOW64\Fjjnifbl.exe	Fpbmfn32.exe
File created	C:\Windows\SysWOW64\Moipoh32.exe	Mogcihaj.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Amlogfel.exe	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Hiagomkq.dll	Ghklce32.exe
File opened for modification	C:\Windows\SysWOW64\Hhihdcbp.exe	Hnddgjbj.exe
File created	C:\Windows\SysWOW64\Nemcjk32.exe	Mbognp32.exe
File opened for modification	C:\Windows\SysWOW64\Nlihle32.exe	Nhnlkfpp.exe
File created	C:\Windows\SysWOW64\Ehcfaboo.exe	Eplnpeol.exe
File opened for modification	C:\Windows\SysWOW64\Kdbjhbbd.exe	Knhakh32.exe
File created	C:\Windows\SysWOW64\Nenbjo32.exe	Nmgjia32.exe
File created	C:\Windows\SysWOW64\Ndnljbeg.dll	Lcimdh32.exe
File opened for modification	C:\Windows\SysWOW64\Mjaabq32.exe	Mcgiefen.exe
File created	C:\Windows\SysWOW64\Nadleilm.exe	Nnfpinmi.exe
File opened for modification	C:\Windows\SysWOW64\Lbqklb32.exe	Llgcph32.exe
File created	C:\Windows\SysWOW64\Gdapai32.dll	Gmeakf32.exe
File created	C:\Windows\SysWOW64\Kqphfe32.exe	Kjepjkhf.exe
File created	C:\Windows\SysWOW64\Ahiiai32.dll	Lknojl32.exe
File created	C:\Windows\SysWOW64\Idefqiag.dll	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Dipidh32.dll	Gdncmghi.exe
File created	C:\Windows\SysWOW64\Miiflecc.dll	Jilnqqbj.exe
File created	C:\Windows\SysWOW64\Oblmdhdo.exe	Oehlkc32.exe
File opened for modification	C:\Windows\SysWOW64\Fdepgkgj.exe	Flngfn32.exe
File created	C:\Windows\SysWOW64\Fefedmil.exe	Ffceip32.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Jghabl32.exe	Jnpmjf32.exe
File created	C:\Windows\SysWOW64\Cffpglpg.dll	Lnpofnhk.exe
File created	C:\Windows\SysWOW64\Fhjnfdhk.dll	Hedafk32.exe
File created	C:\Windows\SysWOW64\Ipjijkpg.dll	Dkndie32.exe
File created	C:\Windows\SysWOW64\Kmmmic32.dll	Olgemcli.exe
File opened for modification	C:\Windows\SysWOW64\Aimkjp32.exe	Acpbbi32.exe
File created	C:\Windows\SysWOW64\Fmpbnihe.dll	Akffafgg.exe
File created	C:\Windows\SysWOW64\Chfhllkp.dll	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Kolfbd32.dll	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Hkhdqoac.exe	Hhihdcbp.exe
File created	C:\Windows\SysWOW64\Gpaqbbld.exe	Gmcdffmq.exe
File created	C:\Windows\SysWOW64\Icahfh32.dll	Kqpoakco.exe
File opened for modification	C:\Windows\SysWOW64\Adkgje32.exe	Aamknj32.exe
File created	C:\Windows\SysWOW64\Nglhld32.exe	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Hegaehem.dll	Bhbcfbjk.exe
File created	C:\Windows\SysWOW64\Knqepc32.exe	Keimof32.exe
File created	C:\Windows\SysWOW64\Hmimkinm.dll	Oidofh32.exe
File created	C:\Windows\SysWOW64\Nagbfo32.dll	Oofaiokl.exe
File opened for modification	C:\Windows\SysWOW64\Qepkbpak.exe	Piijno32.exe
File created	C:\Windows\SysWOW64\Illddp32.dll	Lggldm32.exe
File created	C:\Windows\SysWOW64\Kodoah32.dll	Nlhkgi32.exe
File opened for modification	C:\Windows\SysWOW64\Iipfmggc.exe	Igajal32.exe
File created	C:\Windows\SysWOW64\Kfnkkb32.exe	Kijjbofj.exe
File opened for modification	C:\Windows\SysWOW64\Pjehmfch.exe	Pckppl32.exe
File created	C:\Windows\SysWOW64\Ncndec32.dll	Plbmokop.exe
File created	C:\Windows\SysWOW64\Fnipgg32.dll	Mebcop32.exe
File opened for modification	C:\Windows\SysWOW64\Felbnn32.exe	Ebnfbcbc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8008	7472	WerFault.exe	863

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkincfn.dll"	Nemcjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmlilh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajohjon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cponen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoclopne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghpcp32.dll"	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llbidimc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngaionfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ookjdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladfllde.dll"	Hloqml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmokdgeg.dll"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aijjhbli.dll"	Chfegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkmkkjko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahpmjejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpod32.dll"	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Migmpjdh.dll"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Felbnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okogahgo.dll"	Acgolj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afelhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkeldnpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdmkhgho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Domdjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmmmfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljobpiql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnnkgo32.dll"	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foalam32.dll"	Llbidimc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhijijbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edhjghdk.dll"	Chglab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjamhbn.dll"	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kolfbd32.dll"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgolif32.dll"	Ajhniccb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pijmiq32.dll"	Kodnmkap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknbglob.dll"	Eachem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqcdkk32.dll"	Kfnkkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqmeal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmikeaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlcjhkdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iciaqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lggldm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbbmmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlnipg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlihle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkmioc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oppceehj.dll"	Nglhld32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3304	4260	NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe	88
PID 4260 wrote to memory of 3304	4260	NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe	88
PID 4260 wrote to memory of 3304	4260	NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe	88
PID 3304 wrote to memory of 904	3304	Lphoelqn.exe	89
PID 3304 wrote to memory of 904	3304	Lphoelqn.exe	89
PID 3304 wrote to memory of 904	3304	Lphoelqn.exe	89
PID 904 wrote to memory of 1668	904	Mipcob32.exe	90
PID 904 wrote to memory of 1668	904	Mipcob32.exe	90
PID 904 wrote to memory of 1668	904	Mipcob32.exe	90
PID 1668 wrote to memory of 2716	1668	Mgddhf32.exe	91
PID 1668 wrote to memory of 2716	1668	Mgddhf32.exe	91
PID 1668 wrote to memory of 2716	1668	Mgddhf32.exe	91
PID 2716 wrote to memory of 2812	2716	Mlampmdo.exe	92
PID 2716 wrote to memory of 2812	2716	Mlampmdo.exe	92
PID 2716 wrote to memory of 2812	2716	Mlampmdo.exe	92
PID 2812 wrote to memory of 892	2812	Mpoefk32.exe	93
PID 2812 wrote to memory of 892	2812	Mpoefk32.exe	93
PID 2812 wrote to memory of 892	2812	Mpoefk32.exe	93
PID 892 wrote to memory of 3104	892	Melnob32.exe	94
PID 892 wrote to memory of 3104	892	Melnob32.exe	94
PID 892 wrote to memory of 3104	892	Melnob32.exe	94
PID 3104 wrote to memory of 3472	3104	Menjdbgj.exe	95
PID 3104 wrote to memory of 3472	3104	Menjdbgj.exe	95
PID 3104 wrote to memory of 3472	3104	Menjdbgj.exe	95
PID 3472 wrote to memory of 3888	3472	Mlhbal32.exe	96
PID 3472 wrote to memory of 3888	3472	Mlhbal32.exe	96
PID 3472 wrote to memory of 3888	3472	Mlhbal32.exe	96
PID 3888 wrote to memory of 2520	3888	Ncbknfed.exe	97
PID 3888 wrote to memory of 2520	3888	Ncbknfed.exe	97
PID 3888 wrote to memory of 2520	3888	Ncbknfed.exe	97
PID 2520 wrote to memory of 3364	2520	Nngokoej.exe	98
PID 2520 wrote to memory of 3364	2520	Nngokoej.exe	98
PID 2520 wrote to memory of 3364	2520	Nngokoej.exe	98
PID 3364 wrote to memory of 212	3364	Nphhmj32.exe	99
PID 3364 wrote to memory of 212	3364	Nphhmj32.exe	99
PID 3364 wrote to memory of 212	3364	Nphhmj32.exe	99
PID 212 wrote to memory of 4992	212	Ndfqbhia.exe	100
PID 212 wrote to memory of 4992	212	Ndfqbhia.exe	100
PID 212 wrote to memory of 4992	212	Ndfqbhia.exe	100
PID 4992 wrote to memory of 4292	4992	Nlaegk32.exe	101
PID 4992 wrote to memory of 4292	4992	Nlaegk32.exe	101
PID 4992 wrote to memory of 4292	4992	Nlaegk32.exe	101
PID 4292 wrote to memory of 1528	4292	Nnqbanmo.exe	102
PID 4292 wrote to memory of 1528	4292	Nnqbanmo.exe	102
PID 4292 wrote to memory of 1528	4292	Nnqbanmo.exe	102
PID 1528 wrote to memory of 1800	1528	Ocnjidkf.exe	103
PID 1528 wrote to memory of 1800	1528	Ocnjidkf.exe	103
PID 1528 wrote to memory of 1800	1528	Ocnjidkf.exe	103
PID 1800 wrote to memory of 5056	1800	Oncofm32.exe	104
PID 1800 wrote to memory of 5056	1800	Oncofm32.exe	104
PID 1800 wrote to memory of 5056	1800	Oncofm32.exe	104
PID 5056 wrote to memory of 2748	5056	Ogkcpbam.exe	105
PID 5056 wrote to memory of 2748	5056	Ogkcpbam.exe	105
PID 5056 wrote to memory of 2748	5056	Ogkcpbam.exe	105
PID 2748 wrote to memory of 4236	2748	Opdghh32.exe	106
PID 2748 wrote to memory of 4236	2748	Opdghh32.exe	106
PID 2748 wrote to memory of 4236	2748	Opdghh32.exe	106
PID 4236 wrote to memory of 948	4236	Ognpebpj.exe	107
PID 4236 wrote to memory of 948	4236	Ognpebpj.exe	107
PID 4236 wrote to memory of 948	4236	Ognpebpj.exe	107
PID 948 wrote to memory of 2324	948	Odapnf32.exe	108
PID 948 wrote to memory of 2324	948	Odapnf32.exe	108
PID 948 wrote to memory of 2324	948	Odapnf32.exe	108
PID 2324 wrote to memory of 368	2324	Olmeci32.exe	109

C:\Users\Admin\AppData\Local\Temp\NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be7c39e62ca805fb3d4bf234ed27d7d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\Lphoelqn.exe
  C:\Windows\system32\Lphoelqn.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\Mipcob32.exe
    C:\Windows\system32\Mipcob32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\SysWOW64\Mgddhf32.exe
      C:\Windows\system32\Mgddhf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        23⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        24⤵
        Executes dropped EXE
        
        PID:3960
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        25⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        26⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        27⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        28⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        29⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        30⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        31⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        32⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        33⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        34⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        35⤵
        Executes dropped EXE
        
        PID:924
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        36⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        37⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        38⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        39⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        40⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        41⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        42⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        43⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        46⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        47⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        48⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        49⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        50⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        51⤵
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        52⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        53⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        54⤵
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        55⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        57⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        58⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        59⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        60⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        61⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        62⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        63⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        65⤵
        Executes dropped EXE
        
        PID:5220
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        67⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        68⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        69⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        70⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        71⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        72⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        73⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        74⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        75⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        76⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        77⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        78⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        79⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        80⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        81⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        82⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        83⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        84⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        85⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        86⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        87⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        88⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        89⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        90⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        92⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        93⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        94⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        95⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        96⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        97⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        98⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        100⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        101⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        102⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        103⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        105⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        107⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        108⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        109⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        110⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        111⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        112⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        113⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        114⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        115⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        116⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        117⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        118⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        119⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        120⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        121⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        122⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        123⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        124⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        125⤵
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        126⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        127⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        128⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        129⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        130⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        131⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        132⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        133⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        134⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        135⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        136⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        137⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        139⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        140⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        141⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        143⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        144⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        146⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        147⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        148⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        149⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        150⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        151⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        152⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        153⤵
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        154⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        155⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        156⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        157⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        158⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        159⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        160⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        161⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        162⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        163⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        165⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        167⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        168⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1776
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        170⤵
        Drops file in System32 directory
        
        PID:2436
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        171⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        172⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        173⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        174⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        175⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        176⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        177⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        178⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        179⤵
        Drops file in System32 directory
        
        PID:3636
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        180⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        181⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        182⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        183⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        184⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        185⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        186⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        187⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        188⤵
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        189⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        191⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        192⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        193⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        194⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        195⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        196⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        198⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        199⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        201⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        202⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        203⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        204⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        205⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        206⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        207⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        208⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        211⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        212⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        213⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        214⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        215⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        216⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        217⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        218⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        219⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        220⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        221⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        223⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        224⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        225⤵
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        226⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        227⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        228⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        229⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        230⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        231⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        232⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        233⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        234⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        235⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        237⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        238⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        239⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        240⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        241⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        242⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        243⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        244⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        245⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        246⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        247⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        248⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        249⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1104
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        251⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        252⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        253⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        254⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        255⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        256⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        257⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        258⤵
        Drops file in System32 directory
        
        PID:7408
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        259⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        260⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        261⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        263⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        264⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        265⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        266⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8424
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        268⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        269⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        270⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        271⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        272⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        273⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        274⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        275⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        276⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        277⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        278⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        279⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8980
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        281⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        282⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        283⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        284⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        285⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        286⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        287⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        288⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        289⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        291⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        293⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        295⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        296⤵
        Modifies registry class
        
        PID:8864
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        297⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        298⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        299⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        300⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        301⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        302⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        303⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        304⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        305⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        306⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        307⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        308⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        309⤵
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        310⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        311⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        312⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        314⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8920
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        316⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        317⤵
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        318⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        319⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        320⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8612
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        322⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        323⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        325⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        327⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        328⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        329⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        330⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        331⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        332⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        333⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9624
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        335⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        336⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        337⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        338⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        339⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        340⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        341⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        342⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        343⤵
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        344⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        345⤵
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        346⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        347⤵
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        348⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        349⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        350⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        351⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        352⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        353⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        354⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        355⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9720
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        357⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9852
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        359⤵
        Modifies registry class
        
        PID:9936
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        360⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        361⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        362⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        363⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        364⤵
        Modifies registry class
        
        PID:9236
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        365⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        366⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        367⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        368⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        369⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        370⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        371⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        372⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        373⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        375⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        377⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        378⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        379⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        380⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        381⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        382⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        383⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        384⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        385⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        386⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        387⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        388⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        389⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        390⤵
        Modifies registry class
        
        PID:10312
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        391⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        392⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        393⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10508
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        395⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        396⤵
        Modifies registry class
        
        PID:10592
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        397⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        398⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10728
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        400⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        401⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10864
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        403⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        404⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        405⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        406⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        407⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        408⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        409⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        410⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        411⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        412⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        413⤵
        Drops file in System32 directory
        
        PID:10328
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        414⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10500
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        416⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        417⤵
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        418⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        419⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        420⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        421⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        422⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        423⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        424⤵
        Drops file in System32 directory
        
        PID:11176
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        425⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        426⤵
        Drops file in System32 directory
        
        PID:10300
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        427⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        428⤵
        Modifies registry class
        
        PID:10488

C:\Windows\SysWOW64\Nlkgmh32.exe
C:\Windows\system32\Nlkgmh32.exe
1⤵
PID:4368
- C:\Windows\SysWOW64\Nnicid32.exe
  C:\Windows\system32\Nnicid32.exe
  2⤵
  PID:10724
- - C:\Windows\SysWOW64\Neclenfo.exe
    C:\Windows\system32\Neclenfo.exe
    3⤵
    PID:10836
  - - C:\Windows\SysWOW64\Nhahaiec.exe
      C:\Windows\system32\Nhahaiec.exe
      4⤵
      PID:10936
    - - C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        5⤵
        Drops file in System32 directory
        
        PID:1100
      - C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        6⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        7⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        8⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        9⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        10⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        11⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        12⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        13⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        14⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        15⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        16⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        17⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        18⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        19⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        20⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        21⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        22⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        23⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        24⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        25⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        26⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        27⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        28⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        29⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        30⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        31⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        32⤵
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        33⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        34⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        35⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        36⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        37⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        38⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        39⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        40⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        41⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        42⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        43⤵
        Modifies registry class
        
        PID:11112
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:992
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        45⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3948
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        47⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        48⤵
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        49⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        50⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        51⤵
        Drops file in System32 directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        52⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        53⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        54⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        55⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        56⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        57⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        58⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        59⤵
        Modifies registry class
        
        PID:11392
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        60⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        61⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        62⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        63⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11604
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        65⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        66⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        67⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        68⤵
        Drops file in System32 directory
        
        PID:11764
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        69⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        70⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        71⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        72⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        74⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        75⤵
        Modifies registry class
        
        PID:12056
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        76⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        77⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        78⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12244
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        80⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        81⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        82⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        83⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        84⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        85⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        86⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        87⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        88⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        89⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        90⤵
        Modifies registry class
        
        PID:11784
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3416
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        92⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        93⤵
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        94⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        95⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        96⤵
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        97⤵
        
        PID:12124

C:\Windows\SysWOW64\Dngjff32.exe
C:\Windows\system32\Dngjff32.exe
1⤵
PID:2816
- C:\Windows\SysWOW64\Dfnbgc32.exe
  C:\Windows\system32\Dfnbgc32.exe
  2⤵
  PID:4460
- - C:\Windows\SysWOW64\Eiloco32.exe
    C:\Windows\system32\Eiloco32.exe
    3⤵
    PID:2772
  - - C:\Windows\SysWOW64\Ekkkoj32.exe
      C:\Windows\system32\Ekkkoj32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:11296
    - - C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        5⤵
        
        PID:1140
      - C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        6⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        7⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        8⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        9⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        10⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        11⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        12⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        13⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        14⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        15⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        16⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        17⤵
        Modifies registry class
        
        PID:12088
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        18⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        19⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        20⤵
        Drops file in System32 directory
        
        PID:12284
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        21⤵
        Modifies registry class
        
        PID:11336
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        22⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        23⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        24⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        25⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        26⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        27⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        28⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        29⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        30⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        31⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        32⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        33⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        34⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        35⤵
        Drops file in System32 directory
        
        PID:11276
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        36⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        37⤵
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        38⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        39⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        40⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        41⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        42⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        43⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        44⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        45⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2176
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        47⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        49⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        50⤵
        
        PID:3492

C:\Windows\SysWOW64\Geaepk32.exe
C:\Windows\system32\Geaepk32.exe
1⤵
PID:3668
- C:\Windows\SysWOW64\Gmimai32.exe
  C:\Windows\system32\Gmimai32.exe
  2⤵
  PID:11656
- - C:\Windows\SysWOW64\Gojiiafp.exe
    C:\Windows\system32\Gojiiafp.exe
    3⤵
    PID:5820
  - - C:\Windows\SysWOW64\Hfaajnfb.exe
      C:\Windows\system32\Hfaajnfb.exe
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        5⤵
        Drops file in System32 directory
        
        PID:5608
      - C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        6⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        7⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        8⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        9⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        10⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        11⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        13⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        14⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        15⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        16⤵
        Modifies registry class
        
        PID:11816
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        17⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12156
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        19⤵
        Drops file in System32 directory
        
        PID:11332
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        20⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        21⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        22⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        23⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        25⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        26⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        27⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        28⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        29⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        30⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        31⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        32⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        33⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        34⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        35⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        36⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        37⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        38⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        39⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        40⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12016
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        42⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        43⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        44⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        45⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        46⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        47⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        48⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        49⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        50⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        51⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        52⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        54⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        55⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        56⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        57⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        58⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        59⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        60⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        61⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        63⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        64⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        65⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        66⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        67⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        68⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        69⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        70⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12324
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        72⤵
        Drops file in System32 directory
        
        PID:12368
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        73⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        74⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        75⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        76⤵
        Drops file in System32 directory
        
        PID:12532
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        77⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        78⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        79⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12692
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        81⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        82⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        83⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        84⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        85⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        86⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        87⤵
        Drops file in System32 directory
        
        PID:12992
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        88⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        89⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        90⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        91⤵
        Drops file in System32 directory
        
        PID:13148
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        92⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        93⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        94⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        95⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        96⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        97⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        98⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        99⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12512
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        101⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        102⤵
        Drops file in System32 directory
        
        PID:12644
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        103⤵
        Modifies registry class
        
        PID:12680
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        104⤵
        Drops file in System32 directory
        
        PID:12720
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        105⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        106⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12868
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        108⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        109⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        110⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        111⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        113⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        114⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        115⤵
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        116⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        117⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        118⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        119⤵
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        120⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        122⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        123⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        124⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        125⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        126⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        127⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        128⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        129⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13112
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        131⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        132⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        133⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        134⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        135⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        136⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        137⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        138⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        139⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        140⤵
        Drops file in System32 directory
        
        PID:12748
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        141⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        143⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        144⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        145⤵
        Drops file in System32 directory
        
        PID:2436
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        146⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        147⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        148⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        149⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        150⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        151⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        152⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        153⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        154⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        155⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12760
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        157⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        158⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        159⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13072
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        161⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        162⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        163⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        165⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        166⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        167⤵
        
        PID:6632

C:\Windows\SysWOW64\Bgelgi32.exe
C:\Windows\system32\Bgelgi32.exe
1⤵
PID:6848
- C:\Windows\SysWOW64\Bnoddcef.exe
  C:\Windows\system32\Bnoddcef.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  - Modifies registry class
  PID:7048
- - C:\Windows\SysWOW64\Cdimqm32.exe
    C:\Windows\system32\Cdimqm32.exe
    3⤵
    PID:7624
  - - C:\Windows\SysWOW64\Cggimh32.exe
      C:\Windows\system32\Cggimh32.exe
      4⤵
      PID:7668
    - - C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        5⤵
        
        PID:6204
      - C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        6⤵
        Modifies registry class
        
        PID:13036
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        7⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        8⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        9⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        10⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        11⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        13⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        14⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        15⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        16⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        17⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        18⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        19⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        20⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        21⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        22⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        23⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        24⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 404
        25⤵
        Program crash
        
        PID:8008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7472 -ip 7472
1⤵
PID:7568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
192KB

MD5
88e89ccdc803b6b5e52cd68b13da7c1b

SHA1
00cc9d980fec3c152eba015d1311ea3f8f8e0c56

SHA256
9e94c7e7d158ea48ad5ae48729a3e8f783496cf360556f7d7fc8b3a3478fc67b

SHA512
ee90023519b7053f28c2b2490db2ff52634922d4ca316ba284ea273ceae0e00f482bb07ea4e344c96284b431cb559cee51869c1f0aaa93de4232d2fb0bb8370f

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
192KB

MD5
709d31b5ece4b8490590530b37c614a2

SHA1
15cad7fa03e00451662ae47e75c480c21d6a3dcf

SHA256
b168faf104bffaebf03dd286b3d011ebe495aec23241e980f87b4028139c2c74

SHA512
cf4223e44638c1a176cfa5ec54fe081e75cef555a3d431da83e770f3ccd3268c5f8d4cd979d1dc0c2a6a5f79aad5303d81e41744f0578eca2661f01708b0275e

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
192KB

MD5
709d31b5ece4b8490590530b37c614a2

SHA1
15cad7fa03e00451662ae47e75c480c21d6a3dcf

SHA256
b168faf104bffaebf03dd286b3d011ebe495aec23241e980f87b4028139c2c74

SHA512
cf4223e44638c1a176cfa5ec54fe081e75cef555a3d431da83e770f3ccd3268c5f8d4cd979d1dc0c2a6a5f79aad5303d81e41744f0578eca2661f01708b0275e

Download Submit
C:\Windows\SysWOW64\Ahchda32.exe

Filesize
192KB

MD5
a79f3e7cde17d6650c87721e9214209b

SHA1
337655c149b91f15308d324c976357d2a15821a2

SHA256
cdb9e4c1b2ae6dfba3c67b3ba7c71871e1097ab896d87f849bc2eb32ff5f3ed6

SHA512
b95b0a7418393cf4071851b28bbaba717e592583e82c8d02bc8780cb7c30f38ae4cb6143a202f282c84a5c2e3068b425312f29a873b87a1e86f1ebd8ddfac2e6

Download Submit
C:\Windows\SysWOW64\Bqmeal32.exe

Filesize
192KB

MD5
f6fbf38a6b657de2817eaf36bd2da813

SHA1
fbf9ddd848cda52b608aec8048543be9d1ddd72b

SHA256
81e44513fb9ccde3750758239129ba239fe0c08fcd04eb683e677ebe0d5e5d98

SHA512
35e4e544f25deeb9bc6b45e0f83f2ff29828fbb034ff11900e36d65d173f44b75b134cf89ed975a7ac706214c0e1dcf00b18b246bf3014116db82dad47d1d550

Download Submit
C:\Windows\SysWOW64\Cocacl32.exe

Filesize
192KB

MD5
c77ac7fd9cdfcd2dd5e413b277c37d40

SHA1
9941c9709d3ef82ee8f4bbb39267e982b98f331b

SHA256
621449f9e22626a29c6dc701b70798b547744b915c0ac9856b24f562cab61517

SHA512
d25906f129f450b0ec3da9e1acfd60d06c58896dbfd28adfc05f01ce5dbbde7a140e6b6bf9e2dfd12d0b01870ac3efc5ed38f06b630ac93fda728514345a717b

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
192KB

MD5
73b75c1b1c9154964b231fad84f77277

SHA1
152c07840bc5f3108181f80bf045835324e2799f

SHA256
46e0138915eff5baed3a649234185406176028f07811e5df1ae74d34ea707b59

SHA512
0ae6d5fb7f21bee069f88bee04126aa18b6007b25872eaeb7867400e47f778500f6401be24cd6f258dbfe808444c8810814ac76f9c7062b95f134b8ee4c61265

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
192KB

MD5
ea012f4d7c62d8232b90dd019e715f8a

SHA1
39ef566f0203cd76e0c09dd713ffd2b91dda1ee4

SHA256
d3b1fd26de377b8183cbc6601625652e8b862d558ec77e6ed28c44fe9301bc0d

SHA512
ce2c9875ca2476d34ad300abe8364e038335fac116f196b4c1a8f55adc7f543b0729641f8d0672afc84de3d4e78e7975cb7c8d9d085230ee8b9dbf116dff128f

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
192KB

MD5
51345ad33ea60c1f8603a0085d1c694d

SHA1
9fb61ed97b3809eac7cec9a1faa11a89dbd6f635

SHA256
d7973216ff781cf6e59dcb016a057bad7b5a649504cc36c7f33fcb0bc324eb4c

SHA512
42634df5af5060e2cf86d16e3fc5c14fd1ae9fefbea5b7977b0b64d33449e8a3dc8cd7691186bd19fa6a80f1ee9e935c02a996efd8a8f63ba03b821cdcf55bcd

Download Submit
C:\Windows\SysWOW64\Fipbdikp.exe

Filesize
192KB

MD5
c30a68910da6919c729f614a1e5a445e

SHA1
66e45b9f2b9fa70dfc30e8196ad7c3fae7208d21

SHA256
5d0041ea5977b8411e0938f687199b29d3d13b0a007249810902fcdc96917882

SHA512
1d058b82593d1d329fb04cfb1f601a43f51369a87fa68da0fc900f520c8e6711492eec8900db5e9f403bfa67f8562eb1dabb5d0fe5315eb32a4d5515b91c20fa

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
192KB

MD5
6be505afbc116bbe164ffbea37344470

SHA1
4d84d96fe69181aa4fbd30ce17bcda9e9ddb526a

SHA256
2dd4bc95a20d01aae54165b92cdf5e77e60296f54a4b278537ed2cb80a8d1191

SHA512
32520be608bd1374fc384969401dcf5c7882c08f7587773fe90065d5ac88e43a23e6326019c16c96387e3226ec8718a437b3438f9ff8144cefc86b50ed1f383d

Download Submit
C:\Windows\SysWOW64\Gkkgpc32.exe

Filesize
192KB

MD5
a9f92243da213878bc2ba39673d2d707

SHA1
739c0b6e38086cfb775156697d4931be283b121e

SHA256
6fa3bde745f0dd61ce9611483687e0a496d5c38dc06c86ca46e80f7e305fa123

SHA512
59a95d194f131aacaf9ffc317532615acd8c5a0fb82f894850ac983da294d0e05d0fa03337a2d68424e90af44fba8e04af83f86b557350fa42755431e2dd1f92

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
192KB

MD5
fef5fea99452e1163a9997f697bf591c

SHA1
8146bb94724453fa835bef789504aa82ebb5ba2f

SHA256
403032e75df246efefede995758f9fc73467384295de52651eb4c8cee6c3d355

SHA512
3f25e34f29cea90cb6a3f32016d9d47c26567ad27729be0740b5d6be26bbc7f205005a101b3be08ab0b6a89d578f90feaf8d343b09db5952014b65b7bba1dffe

Download Submit
C:\Windows\SysWOW64\Hdkidohn.exe

Filesize
192KB

MD5
a2a1308038e6e0d5ce87a2194c20e2d3

SHA1
d0d0ad355e2ace5a4774f9c7811a83bec5d803bf

SHA256
e311d948425d8ac574130cd791c1587bc9b4f5bcefaf158273d611ad180525db

SHA512
9c279d12fa1499514f598125f270870fd1b055c3a7a1a7765299e723966c06729cd773457342a03c8a48fac901b1bbe834d6e95cbd6b6022772fb20ba0f3520a

Download Submit
C:\Windows\SysWOW64\Hfpecg32.exe

Filesize
192KB

MD5
7cc339bb2709f3cad676c89e17b15863

SHA1
4e58af8785fae2f4eaaa29998a29811a25ff028c

SHA256
06b5ca8b3b22583248b778ed5b15ab2f830670cf3b0643bfe5b935e9f36a4c33

SHA512
05c9f4c2bb0840b5f489dd5889f36b3982dd0b9b6afd3f63b751c871324501a8b5240aff75bf5b1deb98679da77045f81192dfcea3dcac8ee4a71fb8cdaf632b

Download Submit
C:\Windows\SysWOW64\Higjaoci.exe

Filesize
192KB

MD5
d27e5e0bca74b68555fb4d547f317089

SHA1
918f7ff184d6e3deba4bb3ce686b8f78ad8da4f8

SHA256
c0a79cdb315ec26958dbc9015493480175b945b5b3b8252c6edef5f38cd981ad

SHA512
64aa0f69044f70cf297fea2e76e1b018d565eb7d1e312e98ef5bda8222002f3f1672d3a27070e8cb8584326341ba8e612b1e6d0b0522925046c2252335bca781

Download Submit
C:\Windows\SysWOW64\Hlambk32.exe

Filesize
192KB

MD5
f6d77389cebfdf5636a91de105a4500c

SHA1
bcb4f21bd9467d5d818ad670f418b32eff590b0f

SHA256
cbb30b7cb1428f621944097ff4a1fcc7c5520bdca38c4436b22608eb0b1575bb

SHA512
cbaef910e797442f23d3e0dff1e538e9b9a439706ae3edbf91f8c44d74fe7456b23af26a3d5e983d63f21a94e45dc271bc9011f51f08814be049ff9af70a5ef2

Download Submit
C:\Windows\SysWOW64\Hoogfnnb.exe

Filesize
192KB

MD5
e550940987f5e78e2d5c93adb5d15de0

SHA1
09f9e0f1abf7fbd0e088f5cf957646a2eb70741c

SHA256
eca138526702e4dc0499d1faaeb5ff671b92004a64e79ca4a0e02929950a6948

SHA512
6abfc48c44e064d94ca373d974f329a39164ea8cc15dd50d81d70281e5eceefda006d51b9688afa2ca802883eb8f276afeb389d74f0592b06c7ad4716cfda9f2

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
192KB

MD5
02fe1d1eef68d5ec882fd91ee757518e

SHA1
a836bf2811e99825ef0c4c40b27d48eb93577d2e

SHA256
484759b2381b497d7db9ab91dff4f65a3aa386d9c6f20cedb2c142464f9ab0cd

SHA512
1d5bd040823c7847020708f7aa2defce84b552065f34a9d48db992a67a658adeaf673e9db4c513a4a643b74a9d902cdccb8ee7c34a668bc899855acc4691f89d

Download Submit
C:\Windows\SysWOW64\Jfbkpd32.exe

Filesize
192KB

MD5
126f75ca707c14bcd57c2ad16d4d5861

SHA1
beda725cdbcd76270e49020d08fc1e81d8fe4b81

SHA256
c6eab7330cbbb1f410348ebddac4da8a46f45e7d1a66442f4716aa50a8c893aa

SHA512
9e6571520fabfd22a0d666ba68841593112921b441ee992010552dd5850c923c711bc344d84a5a942ec3933351d9950833dd8f6d25afea1167fba548557ece6b

Download Submit
C:\Windows\SysWOW64\Jjafok32.exe

Filesize
192KB

MD5
b946658662cd37244c32850dc4039e2e

SHA1
282e04f760467b740d7ae7b9900b56a786f20337

SHA256
09c3348008eb29c7243989cb31911822e1da203944e9f2f2d2e13c5d21dabf84

SHA512
01c2c6a40e8150d836ccd763c8248099ea9f49ae03f755cb4f4b2c7d5bb34f06a6117f9fd932ca2146481979827c3ece565725c80843568b215d54353bedbbca

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
192KB

MD5
b13a6b29dc3c4cc536610bc8275794c4

SHA1
1a5305d53d94737a472ce1ea1988e1c3d9bcd4bf

SHA256
f28cc6561e8a6f214c4c35931fba53cde807ef4d385edb8b3cfa57e9a7c6f8a1

SHA512
6dfce15e0db85b0e88b5bcec5b14f232ff350e239b8279f74c5019a818e47d4c6360dda9b6b72ca304ece4920f3d8edd151bacf175155df88cf97b03a7f772a1

Download Submit
C:\Windows\SysWOW64\Kqbkfkal.exe

Filesize
192KB

MD5
e4e2882b55b9c6ad06cc95069d7a07a5

SHA1
d612ffb4fc645a78fb115ecaa1168d148e68613e

SHA256
3e1ad2fea3636133be42ea3f7d46f17edea74895b212eb447dad6cf8653627d4

SHA512
da2a2aa0871d70828d23ef23273850feffb814da7c9f0109c1bda13f0d9bdbe354bf2c4cd022106c58929e0b38cd621a27131f07804b32a0398e881e307df6c3

Download Submit
C:\Windows\SysWOW64\Ljceqb32.exe

Filesize
192KB

MD5
384f51ce4187986d4ec2be979e31e9d4

SHA1
d65a8d5b4277bfc33f165e5db6348589a0fa8ee5

SHA256
6c53fc93070c398c87aba2d35a2956959f2f1f3c05fe611f682d2cde1fa25959

SHA512
7c63827b76b3e435c2b184b236315f26c2aac1c72b3ed7f101152ceafc79fedbe37d8b23621bedbe532aad56025b5ca5e7eaa13d2fe6dede09c86e2b496b517d

Download Submit
C:\Windows\SysWOW64\Llflea32.exe

Filesize
64KB

MD5
fad1f14db80224830bbd8596c169f2c9

SHA1
9354114e254fbbe1107efa3231ad055b3f77308f

SHA256
1ae42f3e689ca148f2e521bca43bee092d365a86ec91f26ef611306fa27ddf0b

SHA512
bbc3ab0c2b0f1460367fcffaf53fd63450eac1dc27e6d0c34166f1a6daaddacbdd2575ef2ee9bcde4ad33de47e814f6e22c9ef8c98ad3ea9594932db5d13d7de

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
192KB

MD5
c1063442aeb697f2b80e383fd9b11da4

SHA1
efc0112f0797d6161ce91393cc5314075a61933e

SHA256
e1f649c5926a676c5328e904a58a80d87c2309f071d6b4f0bf7ea30f1fc9cefd

SHA512
66f698dbc810f4cd622143e207f773c95ed7a60856b4467c3f3ca0c6679093a78bd115f8b72e787fe3a635d00ce967d1e0f6af9338713252f7e77cda82240476

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
192KB

MD5
c1063442aeb697f2b80e383fd9b11da4

SHA1
efc0112f0797d6161ce91393cc5314075a61933e

SHA256
e1f649c5926a676c5328e904a58a80d87c2309f071d6b4f0bf7ea30f1fc9cefd

SHA512
66f698dbc810f4cd622143e207f773c95ed7a60856b4467c3f3ca0c6679093a78bd115f8b72e787fe3a635d00ce967d1e0f6af9338713252f7e77cda82240476

Download Submit
C:\Windows\SysWOW64\Mbighjdd.exe

Filesize
192KB

MD5
edda867a85fac0e1cb7be6d12dc6dca8

SHA1
92ff2d438db64c5e237c195a0898c46925194477

SHA256
a4fdac4220cfae71ba694e102fa51aeb55af4715a4c07b54e408c27b3bb4fd80

SHA512
e2e9836edf1a31c6534259a181d5ca86d4ab31bcf30fb97f46f7b1c13b0b6ec45bc1f060f27637785e35f0f79fd2c9dcdb3bedb1eabf89f0133b6cd789b90b17

Download Submit
C:\Windows\SysWOW64\Mecjif32.exe

Filesize
192KB

MD5
9b817fd1046f108f00074d966f03e204

SHA1
b9a22faca336c91e7998d53a118a5d5c029d0f58

SHA256
f3e76d32263fee54433789ea6d642cde5cb6bcbdbb413851e0a77e8ec9437156

SHA512
226e64467a8e905b3974e56cc73649858552cd96f901221709cde61f1c879100cadc5248824aa9bea201167a87464efcbb4a9863de6faad19b3a98b93054c8ac

Download Submit
C:\Windows\SysWOW64\Megljppl.exe

Filesize
192KB

MD5
dc5057d14939193f7df2b6a6a0fa7dc0

SHA1
efcdeafe8ca86fe783ffade0d9764da7ae9a015a

SHA256
281a5711a488039eef797c97910be09c85ddc6edeae9133734b7010b30623227

SHA512
6a91a362770861789c736cb5d27c1407850f03cbed74641c53def19179610690a62d48a3f6940906326fd722a1abc06f96e8e2b426025db5ca34077e451dc651

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
192KB

MD5
18a4733d9f1f60a1618d33ada03bdbac

SHA1
f4d759536c354a475e805042f3125b84c2ebff60

SHA256
e1b02d569170d2a0ee552f6fb8518593048f5d11f00c5e0f69067516ec402ef2

SHA512
cab8e3387bb746f41169b8994527e0f0cb6857b1f7e3e6fc8b120ddfd1642ff8ff9f9dd8f2dc3c01c7f47130c3fd5deb3ee1601db6951127984e8ae83683d5df

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
192KB

MD5
18a4733d9f1f60a1618d33ada03bdbac

SHA1
f4d759536c354a475e805042f3125b84c2ebff60

SHA256
e1b02d569170d2a0ee552f6fb8518593048f5d11f00c5e0f69067516ec402ef2

SHA512
cab8e3387bb746f41169b8994527e0f0cb6857b1f7e3e6fc8b120ddfd1642ff8ff9f9dd8f2dc3c01c7f47130c3fd5deb3ee1601db6951127984e8ae83683d5df

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
192KB

MD5
81022bdb5d1c3c833595dafdf4f09c1f

SHA1
c3c51da917f4be29e3a8af63fdd31d896ee79485

SHA256
8b4c247f4263341b864b5ab011e8e9cb22c6a313119f851d1b5ddc03b1a7b868

SHA512
f610f59967dda1422fa6ad34bbdbb36871aa6987821a5784a7f018b22f33e17dd3d9d394df3c4950ac6d98efa15557c1b9ecef741c24182c5a43d91eeb0cea11

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
192KB

MD5
81022bdb5d1c3c833595dafdf4f09c1f

SHA1
c3c51da917f4be29e3a8af63fdd31d896ee79485

SHA256
8b4c247f4263341b864b5ab011e8e9cb22c6a313119f851d1b5ddc03b1a7b868

SHA512
f610f59967dda1422fa6ad34bbdbb36871aa6987821a5784a7f018b22f33e17dd3d9d394df3c4950ac6d98efa15557c1b9ecef741c24182c5a43d91eeb0cea11

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
192KB

MD5
04abdc27d09fb486360b44f206da547c

SHA1
1c0c986578fab495a35aa614280a90d95b68aaae

SHA256
c946a4eba5ad5c8b30bac43a4e30c1ab22c4c3ac8194c55fd940fc11c72906fc

SHA512
ad86659c13f8919e9b68117c6dfc06430b10c5c1d70626efe928d9167c41695868bb14501a2579c9238320d650b4afb90918502e7a6a3b611f34c90046f3798b

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
192KB

MD5
04abdc27d09fb486360b44f206da547c

SHA1
1c0c986578fab495a35aa614280a90d95b68aaae

SHA256
c946a4eba5ad5c8b30bac43a4e30c1ab22c4c3ac8194c55fd940fc11c72906fc

SHA512
ad86659c13f8919e9b68117c6dfc06430b10c5c1d70626efe928d9167c41695868bb14501a2579c9238320d650b4afb90918502e7a6a3b611f34c90046f3798b

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
192KB

MD5
4bc0f15a9cc2de1f7a06cd69e8554e99

SHA1
4d808fc516b3e4a67d3004c46511c6e6b2c3e1f9

SHA256
8826240873a3b7eb4028a198a386b5fc2357a9f4ab5997df2b963d0b6b730342

SHA512
b43b396b48315812cb6f1aee0d6bedc7d3728d52e5948582d0f89a93930a1670ad9cc8fe39e4655fe0f4f2fa64abb4dffa0d19290750e26157b4c5984bae092c

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
192KB

MD5
4bc0f15a9cc2de1f7a06cd69e8554e99

SHA1
4d808fc516b3e4a67d3004c46511c6e6b2c3e1f9

SHA256
8826240873a3b7eb4028a198a386b5fc2357a9f4ab5997df2b963d0b6b730342

SHA512
b43b396b48315812cb6f1aee0d6bedc7d3728d52e5948582d0f89a93930a1670ad9cc8fe39e4655fe0f4f2fa64abb4dffa0d19290750e26157b4c5984bae092c

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
192KB

MD5
4ed690bd304c52bc8eca96a601887f77

SHA1
9de3a4cecda324f6cc0383e8da07be701d31cf02

SHA256
162e4de6c7d98fa7b9ee19c9766939fc6b58247690e44ac6780047f908b8a3cf

SHA512
5ca5fbf01ffcae0af51c7354fde71779cf8d74d57d39e9978fb6858d3e2f4ed0a57baec9b75ea4d0d750ba0ed03fb4c992ccf124061ba32ff24bd00d735b5ba1

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
192KB

MD5
4ed690bd304c52bc8eca96a601887f77

SHA1
9de3a4cecda324f6cc0383e8da07be701d31cf02

SHA256
162e4de6c7d98fa7b9ee19c9766939fc6b58247690e44ac6780047f908b8a3cf

SHA512
5ca5fbf01ffcae0af51c7354fde71779cf8d74d57d39e9978fb6858d3e2f4ed0a57baec9b75ea4d0d750ba0ed03fb4c992ccf124061ba32ff24bd00d735b5ba1

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
192KB

MD5
cee80d85d2e929171f2b013746898738

SHA1
e2eef34219dbc06bb1e094f3872ad85dc71ffaf0

SHA256
f617952b70a0f4b02ec8875ceb4fdf9a9e1cdfa9b04df66a5c298b7316a69e27

SHA512
d18f52efffd840a2f1b4a8a42a9d10f99d5a3ef00c0e7241c8ff4da8a0285f581bccd5a57847d43c15d505fff5555d7114159bbd89b7a91973e6a7153eb4111a

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
192KB

MD5
cee80d85d2e929171f2b013746898738

SHA1
e2eef34219dbc06bb1e094f3872ad85dc71ffaf0

SHA256
f617952b70a0f4b02ec8875ceb4fdf9a9e1cdfa9b04df66a5c298b7316a69e27

SHA512
d18f52efffd840a2f1b4a8a42a9d10f99d5a3ef00c0e7241c8ff4da8a0285f581bccd5a57847d43c15d505fff5555d7114159bbd89b7a91973e6a7153eb4111a

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
192KB

MD5
cc8f143c150a0beaa21777216eec5f84

SHA1
fe3f0efda9bc8ad556b4592c1b5ff7df6ecefebc

SHA256
1300c54b5490be1c36e0cbb04caa997bb931c0d8c28d248d01a9bcd755eff090

SHA512
182027febb4e961e4f62b18baf2426900a3c1cb77e03581b90b7a1bfec1b24ce3fe32e7588848fa037066e6b68c44f8ef7c52ff0da3ca5868b7e9ffea586838c

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
192KB

MD5
cc8f143c150a0beaa21777216eec5f84

SHA1
fe3f0efda9bc8ad556b4592c1b5ff7df6ecefebc

SHA256
1300c54b5490be1c36e0cbb04caa997bb931c0d8c28d248d01a9bcd755eff090

SHA512
182027febb4e961e4f62b18baf2426900a3c1cb77e03581b90b7a1bfec1b24ce3fe32e7588848fa037066e6b68c44f8ef7c52ff0da3ca5868b7e9ffea586838c

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
192KB

MD5
7e6f715f1c03b323a7475a719523a973

SHA1
9fa9d7df1314196224babe1f26a5786461b45e0e

SHA256
6d31c3e91c6317a4a5188c82c3329f03c9036690a928561db84b0ec7cfdc07f8

SHA512
b75208476ed09489568a715e09013ecf863c566795b52e8ad88e21d175962859bcfd34871a29eaf18ef8931171b04ac5ce4c7e1b09d4f1a478d3e3c86cb42fef

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
192KB

MD5
7e6f715f1c03b323a7475a719523a973

SHA1
9fa9d7df1314196224babe1f26a5786461b45e0e

SHA256
6d31c3e91c6317a4a5188c82c3329f03c9036690a928561db84b0ec7cfdc07f8

SHA512
b75208476ed09489568a715e09013ecf863c566795b52e8ad88e21d175962859bcfd34871a29eaf18ef8931171b04ac5ce4c7e1b09d4f1a478d3e3c86cb42fef

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
192KB

MD5
ac6f7ab5367a96237e8fb3c598c72702

SHA1
fc8a8a327cf068d54dd3cc1a92a296e8983c1eb6

SHA256
c0cae0cec6ecd8fe16d8fead41f5f9b1cea496365b13aab2b28d858bbf94d50a

SHA512
37ea83f489533f0e227651046c0956e4be941c83f3c9ae8548acee6b7b40cd735230093fe537f007020dcb71ef20f33c168f17ef97ea7a59529d7c2fc1811934

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
192KB

MD5
ac6f7ab5367a96237e8fb3c598c72702

SHA1
fc8a8a327cf068d54dd3cc1a92a296e8983c1eb6

SHA256
c0cae0cec6ecd8fe16d8fead41f5f9b1cea496365b13aab2b28d858bbf94d50a

SHA512
37ea83f489533f0e227651046c0956e4be941c83f3c9ae8548acee6b7b40cd735230093fe537f007020dcb71ef20f33c168f17ef97ea7a59529d7c2fc1811934

Download Submit
C:\Windows\SysWOW64\Nhmeapmd.exe

Filesize
192KB

MD5
38c261c8a3b4e2b8289cfd732f2d318b

SHA1
075756a0ff2302de0d3c9c7f527e8ddb0a262853

SHA256
672826358066fa90cf33ab337d00ed7b13353860e555bed4c45c68a49aea9fd0

SHA512
881860870ff5955e259e26f354f23000e8ef8c08849e65141715379e8de1d04858df0a92eda4ecb3bea8875b1d4d99431a61a5f81a48a0fb2a9099d5098df6c3

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
192KB

MD5
d4ef00bddaaf3f9d7fc496b83669fcd8

SHA1
e04504a17fb93b387927026940188ffaedc44a44

SHA256
f14f9c5c6f6fa39850a09ba1a5f270a451fa9c5d494e8623d46d2558f5a388df

SHA512
c9317716d1aa2025d0f7ce5b6f0523e1d9d4120d1878286740cd13ac8c47330f288af39dbfe818ddd20ebdb750b13ce119fd993b1720e48ed2423d0822428fac

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
192KB

MD5
d4ef00bddaaf3f9d7fc496b83669fcd8

SHA1
e04504a17fb93b387927026940188ffaedc44a44

SHA256
f14f9c5c6f6fa39850a09ba1a5f270a451fa9c5d494e8623d46d2558f5a388df

SHA512
c9317716d1aa2025d0f7ce5b6f0523e1d9d4120d1878286740cd13ac8c47330f288af39dbfe818ddd20ebdb750b13ce119fd993b1720e48ed2423d0822428fac

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
192KB

MD5
929bf749f57455055e4a63d1886e2b25

SHA1
bb81f4add00cfd337d9ff69375e2e0a3eb61d1f2

SHA256
922b96e2dda6b13b370e56b50c53eb1fc12184e6cdfed92897d23d83bd196c25

SHA512
897c32cee774e151d17ca6c36646b88f69cf58b1fdbb01cfb91f7740874c014567dd8b9c4e5ad39c2efebc2a66c504315c304e869563889f4514fc2ffcf63e2f

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
192KB

MD5
929bf749f57455055e4a63d1886e2b25

SHA1
bb81f4add00cfd337d9ff69375e2e0a3eb61d1f2

SHA256
922b96e2dda6b13b370e56b50c53eb1fc12184e6cdfed92897d23d83bd196c25

SHA512
897c32cee774e151d17ca6c36646b88f69cf58b1fdbb01cfb91f7740874c014567dd8b9c4e5ad39c2efebc2a66c504315c304e869563889f4514fc2ffcf63e2f

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
192KB

MD5
36c81a1fc9661eb6d96818d8b42b5253

SHA1
230d0715b0343f18f06685f8e792590e669ff110

SHA256
f60a45e463bcecd47642b016ebc245339fce637ed01828b99baabff75d7114e8

SHA512
df815136b8c67fc04f3de09074082bc175c930856d2546a0938899901a3783e2fc66bde53ff851bb530fb287fac41bb0f281d546dd134c9c229dde50f03e2f1b

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
192KB

MD5
36c81a1fc9661eb6d96818d8b42b5253

SHA1
230d0715b0343f18f06685f8e792590e669ff110

SHA256
f60a45e463bcecd47642b016ebc245339fce637ed01828b99baabff75d7114e8

SHA512
df815136b8c67fc04f3de09074082bc175c930856d2546a0938899901a3783e2fc66bde53ff851bb530fb287fac41bb0f281d546dd134c9c229dde50f03e2f1b

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
192KB

MD5
d6cf8384b043b856f3c47a2d5a406127

SHA1
af95a4a672f78c98228ae9d59d28136ec62b0300

SHA256
021e65c8488a9f15b8995ba929df5bb0daf1613dcb9017b836913b572a6a906a

SHA512
5adb6c5250aa7e593d6ea759389f94e23dd6a591ed19c51e20cbf23f328bc1bf6069925f619113f5634d04eec479ec60a1991ea59fc97fbad7d75ab9e6a9570a

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
192KB

MD5
d6cf8384b043b856f3c47a2d5a406127

SHA1
af95a4a672f78c98228ae9d59d28136ec62b0300

SHA256
021e65c8488a9f15b8995ba929df5bb0daf1613dcb9017b836913b572a6a906a

SHA512
5adb6c5250aa7e593d6ea759389f94e23dd6a591ed19c51e20cbf23f328bc1bf6069925f619113f5634d04eec479ec60a1991ea59fc97fbad7d75ab9e6a9570a

Download Submit
C:\Windows\SysWOW64\Ocdjpmac.exe

Filesize
192KB

MD5
c852a821112e18c84b705678a912831c

SHA1
10537d4de324f944dfeb8e0698a5a20844e08ac2

SHA256
71f007cccf178c8f87efc3b117b125accdb540333b5bf9327c7e7b72da2549aa

SHA512
22dce0beac6812df11d636d9560495be7a100ce5801cbe85372042b12b7a5b27f1e2fd276000c1ce15715968ab4ceaf33d447ebee9f8f42f238e564017e6d7a0

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
192KB

MD5
2e85ae1aee03a5c12238a5e0736b7776

SHA1
b6389e87b85e31326e0ab4af61c64b22a9b0e7f5

SHA256
879cf897088a195bb5285d2bc5446294206a8413475a1668e85e5724904cdeb4

SHA512
f5512b1156ba47c885dd4b786a3c91393a6a49d6e7c101fbc86052694f517fa9825926c65dab4b75fc6c86e8c9ad94a5a2edf91f7cbb44f7e2155b71a24fa209

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
192KB

MD5
2e85ae1aee03a5c12238a5e0736b7776

SHA1
b6389e87b85e31326e0ab4af61c64b22a9b0e7f5

SHA256
879cf897088a195bb5285d2bc5446294206a8413475a1668e85e5724904cdeb4

SHA512
f5512b1156ba47c885dd4b786a3c91393a6a49d6e7c101fbc86052694f517fa9825926c65dab4b75fc6c86e8c9ad94a5a2edf91f7cbb44f7e2155b71a24fa209

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
192KB

MD5
388340defb107145a8befd8a534a8eb2

SHA1
fa33038b808b8c46c04a3508e17ba9e4a1eb6eac

SHA256
902c48e5e93f5a428f4695bce51496f2a4f2caed1e76f4b67582c156c657214d

SHA512
6c6cc4e885c7d45394cdbd1547cbc4590f6aff218618cb8516848e2516c9fb1b442f3aa83393ec1004b86be0373d9e3ce5e8923bb8576360cdfc52248a655e2a

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
192KB

MD5
388340defb107145a8befd8a534a8eb2

SHA1
fa33038b808b8c46c04a3508e17ba9e4a1eb6eac

SHA256
902c48e5e93f5a428f4695bce51496f2a4f2caed1e76f4b67582c156c657214d

SHA512
6c6cc4e885c7d45394cdbd1547cbc4590f6aff218618cb8516848e2516c9fb1b442f3aa83393ec1004b86be0373d9e3ce5e8923bb8576360cdfc52248a655e2a

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
192KB

MD5
7a5fa2ed1006320d173d9f1c35f3d554

SHA1
856071f5879bfad952ec1c989fcc79e24d5c1289

SHA256
07928cb225d0c9c79a556bb9505740f45bda090c68a60b9c0b2e4c436b88af65

SHA512
b67de4892c47afdd7cfdd808a3366fe6f9c3d0c6b4d91452dc74d0b3b4218d57b45e88fbcfb7b83b6bd32e09a71df5f0bf98ae3001f748b9a94af80c8d0cd105

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
192KB

MD5
7a5fa2ed1006320d173d9f1c35f3d554

SHA1
856071f5879bfad952ec1c989fcc79e24d5c1289

SHA256
07928cb225d0c9c79a556bb9505740f45bda090c68a60b9c0b2e4c436b88af65

SHA512
b67de4892c47afdd7cfdd808a3366fe6f9c3d0c6b4d91452dc74d0b3b4218d57b45e88fbcfb7b83b6bd32e09a71df5f0bf98ae3001f748b9a94af80c8d0cd105

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
192KB

MD5
a1490a90b59d99c5c3cca0777ac46f50

SHA1
ef60e0881f82be87e81ed23a93e553f897ee59a7

SHA256
70bdd4a62b7c902bc16a081f016c60f816f200c7eca54c30bde1c050a6ee9668

SHA512
30f8bee75da2465e4daaad6a4f2ff500ff7c595db5856f868b923bf48559b867efdf4b770fd98e4d3ba816e80b4ed97b02e8ed63626746371ceaad17636c2d46

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
192KB

MD5
a1490a90b59d99c5c3cca0777ac46f50

SHA1
ef60e0881f82be87e81ed23a93e553f897ee59a7

SHA256
70bdd4a62b7c902bc16a081f016c60f816f200c7eca54c30bde1c050a6ee9668

SHA512
30f8bee75da2465e4daaad6a4f2ff500ff7c595db5856f868b923bf48559b867efdf4b770fd98e4d3ba816e80b4ed97b02e8ed63626746371ceaad17636c2d46

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
192KB

MD5
672454287b6951fbf29d98ed0eeeebe2

SHA1
2b1a8366e703ce843d6970dedef0a732d5262385

SHA256
404f0aca4e9127b17f5b73973264ce90bb5b6bfe1350c7355af73ff21534e81f

SHA512
93f73e6374635fe3b27ece3f15cd4e6c42cc5015ccd81575d32d0aa79d3a0a261d10abf6d2468ab6826690890a2eaca3965c6e235f55fd9251c71d06fd04cfb0

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
192KB

MD5
672454287b6951fbf29d98ed0eeeebe2

SHA1
2b1a8366e703ce843d6970dedef0a732d5262385

SHA256
404f0aca4e9127b17f5b73973264ce90bb5b6bfe1350c7355af73ff21534e81f

SHA512
93f73e6374635fe3b27ece3f15cd4e6c42cc5015ccd81575d32d0aa79d3a0a261d10abf6d2468ab6826690890a2eaca3965c6e235f55fd9251c71d06fd04cfb0

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
192KB

MD5
af944ba9c33559f5dae0a20bcd424ea4

SHA1
bacf6857c4277f34fc86c2d1a3a548cf47bb5b58

SHA256
44f5d764fe6b0cddde0996246cde02862877736ad3d78ea86ef56a55a7d99c83

SHA512
53d9e04a338a84404a4d07850b5adc7e60a8a0482c2f5f29290b3705c04c3dad4e201c6b0c1cee1a6fc02d20595d1fcf6ea4ae0da107a66e19f3a3d28f5410c2

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
192KB

MD5
af944ba9c33559f5dae0a20bcd424ea4

SHA1
bacf6857c4277f34fc86c2d1a3a548cf47bb5b58

SHA256
44f5d764fe6b0cddde0996246cde02862877736ad3d78ea86ef56a55a7d99c83

SHA512
53d9e04a338a84404a4d07850b5adc7e60a8a0482c2f5f29290b3705c04c3dad4e201c6b0c1cee1a6fc02d20595d1fcf6ea4ae0da107a66e19f3a3d28f5410c2

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
192KB

MD5
b76bb43bedc8771cb9931811928fb89d

SHA1
d6fe19b208f7912ca55ef07ec7c76e7421f9b185

SHA256
31949e02841086fe610f68120d34794d9a74179b57e8d749ca9f19c9269cca68

SHA512
305406aec59b8473d249f3c2bfff5b0f6b49a519d67b47790da949537db8c38c6f855e3fb7928eedf0b188dd8f1698e3ee059b9e3c2c20aab6e640749dadff02

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
192KB

MD5
b76bb43bedc8771cb9931811928fb89d

SHA1
d6fe19b208f7912ca55ef07ec7c76e7421f9b185

SHA256
31949e02841086fe610f68120d34794d9a74179b57e8d749ca9f19c9269cca68

SHA512
305406aec59b8473d249f3c2bfff5b0f6b49a519d67b47790da949537db8c38c6f855e3fb7928eedf0b188dd8f1698e3ee059b9e3c2c20aab6e640749dadff02

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
192KB

MD5
ac91f18b13cbc0c304d05ebc095d011f

SHA1
c5b57dfb20e82ca183d8ccd451b1db96b86fed48

SHA256
64960428faf410cdc050bdba88644913de803ecb385f5a2a0eb881745f84214d

SHA512
0d8fbfc5368f342538b4710eb86e3f4aead5d66b1ccc7e53df286a251d29288972800d05e3186a379dca55c5613332d1f63b8843ccfceae34f25b73728450abc

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
192KB

MD5
ac91f18b13cbc0c304d05ebc095d011f

SHA1
c5b57dfb20e82ca183d8ccd451b1db96b86fed48

SHA256
64960428faf410cdc050bdba88644913de803ecb385f5a2a0eb881745f84214d

SHA512
0d8fbfc5368f342538b4710eb86e3f4aead5d66b1ccc7e53df286a251d29288972800d05e3186a379dca55c5613332d1f63b8843ccfceae34f25b73728450abc

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
192KB

MD5
43d2c42f5de19d5a1c1f00ac675c6d0b

SHA1
1f48c76bb8afe32cb035d4afc1fd2e953cc64752

SHA256
5c4a960ef9dd04fbd4be835c74b4123d4b2b1dfdd151a31c16c87d51fc0a84f9

SHA512
ef3958950fe19ca5d5e9b9c75a26be08765dfb64f525e976630b30014eb15722c2d7429abbb8dbcbd6d68238af98838411a85ffaf91aa6d1b0b4bf6568353cfd

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
192KB

MD5
43d2c42f5de19d5a1c1f00ac675c6d0b

SHA1
1f48c76bb8afe32cb035d4afc1fd2e953cc64752

SHA256
5c4a960ef9dd04fbd4be835c74b4123d4b2b1dfdd151a31c16c87d51fc0a84f9

SHA512
ef3958950fe19ca5d5e9b9c75a26be08765dfb64f525e976630b30014eb15722c2d7429abbb8dbcbd6d68238af98838411a85ffaf91aa6d1b0b4bf6568353cfd

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
192KB

MD5
a2b0c809546fa751e022ecc5287384a1

SHA1
cce1fd8695e61e5d39664639b4b8199e4ddbff61

SHA256
9a2c6802afd629ab5f35997414262191ee3e406828ab67f7f0623dcb7e9d1190

SHA512
aa396ee6438ee24c3cce9f2965d43f34917b6671a6543e681759485aeba464db7b932e25c172371d19150dbdf797711f7d7e1a4b106cdce1931b3485dc006db4

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
192KB

MD5
a2b0c809546fa751e022ecc5287384a1

SHA1
cce1fd8695e61e5d39664639b4b8199e4ddbff61

SHA256
9a2c6802afd629ab5f35997414262191ee3e406828ab67f7f0623dcb7e9d1190

SHA512
aa396ee6438ee24c3cce9f2965d43f34917b6671a6543e681759485aeba464db7b932e25c172371d19150dbdf797711f7d7e1a4b106cdce1931b3485dc006db4

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
192KB

MD5
1f27d0f3c0849044113ed42b3add6562

SHA1
0fdd72acc603fe3587bd48ea96c53cd8765401c4

SHA256
db5117531ae01bea8e3d82bf26a74aeab284c180d6be051dce98c51e2ceb8155

SHA512
bf3134355afc0d3477280d5c110913e4db9d8912a667f29c7375251cad91b87c17277127a99716d7fca18d312752891f5c8c9d7db4a1ab99007d658ddccbf317

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
192KB

MD5
1f27d0f3c0849044113ed42b3add6562

SHA1
0fdd72acc603fe3587bd48ea96c53cd8765401c4

SHA256
db5117531ae01bea8e3d82bf26a74aeab284c180d6be051dce98c51e2ceb8155

SHA512
bf3134355afc0d3477280d5c110913e4db9d8912a667f29c7375251cad91b87c17277127a99716d7fca18d312752891f5c8c9d7db4a1ab99007d658ddccbf317

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
192KB

MD5
65f9bbd734b61081bc5872e76416fa67

SHA1
5b9c68234bc30e562d3fec3899ce23aa5d2fa48e

SHA256
14be40d74af37345994ec4cef74e88ca5df0c7c1110746a909bc8ecabc407ff9

SHA512
fa23453a4b47846f3976d7e161471da85a4770c9ec8c0f3cb86cb1a23035eed3946d4fa84052a5113754c08f28d19aba3f4b0f6b90c9008dedc4f4967ecd10e5

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
192KB

MD5
65f9bbd734b61081bc5872e76416fa67

SHA1
5b9c68234bc30e562d3fec3899ce23aa5d2fa48e

SHA256
14be40d74af37345994ec4cef74e88ca5df0c7c1110746a909bc8ecabc407ff9

SHA512
fa23453a4b47846f3976d7e161471da85a4770c9ec8c0f3cb86cb1a23035eed3946d4fa84052a5113754c08f28d19aba3f4b0f6b90c9008dedc4f4967ecd10e5

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
192KB

MD5
d79501ebe2a3a8f19381520d0349aa7b

SHA1
aa4a014065183a8552b7c138750b43ff8b1751c6

SHA256
6589bc4b69deebee07df72bc065b0dc8850e9c963b29a380ed2778cba9a53cda

SHA512
145c1a617f8f4943fc21f4212406ec144ecf140ca170958adbf20f6d2d5f6a1708cbb9031e659fb9a16237a6b5eaca521a39014b8895a298c5cf36f57bbc467d

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
192KB

MD5
d79501ebe2a3a8f19381520d0349aa7b

SHA1
aa4a014065183a8552b7c138750b43ff8b1751c6

SHA256
6589bc4b69deebee07df72bc065b0dc8850e9c963b29a380ed2778cba9a53cda

SHA512
145c1a617f8f4943fc21f4212406ec144ecf140ca170958adbf20f6d2d5f6a1708cbb9031e659fb9a16237a6b5eaca521a39014b8895a298c5cf36f57bbc467d

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
192KB

MD5
df2db8b3d4b4394e52a355be18b9bb66

SHA1
e2a91627ce59cc09fb965f267347bde9287297c4

SHA256
e8830a00855aec1c562f52e714a741e2c8dea6756a686badb9f7024fd630bbc3

SHA512
65c9b762a5b05b3e33dca0293fbc6fbc1e302dad35dbd64a4ee10c8fcbaeb49cd5c35dc1c3f7acb38f840c7c7255ad3b446a62ada8339a37ccebe2b1669d0206

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
192KB

MD5
df2db8b3d4b4394e52a355be18b9bb66

SHA1
e2a91627ce59cc09fb965f267347bde9287297c4

SHA256
e8830a00855aec1c562f52e714a741e2c8dea6756a686badb9f7024fd630bbc3

SHA512
65c9b762a5b05b3e33dca0293fbc6fbc1e302dad35dbd64a4ee10c8fcbaeb49cd5c35dc1c3f7acb38f840c7c7255ad3b446a62ada8339a37ccebe2b1669d0206

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
192KB

MD5
539d029d93d45bb416f6b4083ebcd298

SHA1
ac0cbb2a1832147d63cc611aca5e5e737366d306

SHA256
67b97fec493158916f3bbdf0d7f26225fd20d82bb923132d113372858a7879ad

SHA512
16c968500081d27b5abc458ac6403e5438778ed8e1da34fa0f50e73026d1a268a55be5ef4a4165e44729f20399df003c8589c65891c7c8a3e82408971e0c73fb

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
192KB

MD5
539d029d93d45bb416f6b4083ebcd298

SHA1
ac0cbb2a1832147d63cc611aca5e5e737366d306

SHA256
67b97fec493158916f3bbdf0d7f26225fd20d82bb923132d113372858a7879ad

SHA512
16c968500081d27b5abc458ac6403e5438778ed8e1da34fa0f50e73026d1a268a55be5ef4a4165e44729f20399df003c8589c65891c7c8a3e82408971e0c73fb

Download Submit
C:\Windows\SysWOW64\Qepkbpak.exe

Filesize
192KB

MD5
5733a9be0fb33d64ed008bfc1637ac64

SHA1
eae67d239c04ef4159c9eca0cfe2418ffda02f76

SHA256
b662f2e40d8ae98f06e54a2f73fc05446b203ac4e151e0404c1e07fad372a539

SHA512
5c450e1d0775deb3808699d6a89bfb845a024d04d471f2fa59f8cb94706746826914dfeea9aecd84da5915564f804357202b0d194558cd6898a3887c3a2950f1

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
192KB

MD5
40778817f7c22b6749eca91aeb40560c

SHA1
5d213da985aad720e10298e76b513492accf3664

SHA256
477ea2af278829409bb72b2c03b68f33a3b3747ad4125c829180985c958d40e6

SHA512
c518d9fc0db693119a7fed7a5216f76e5aa1e3b919d0ccc3530399b93fe63b536d5021c8b74d2251b34f0c49e1e906ec1ab501e343955d10ec3ed9f7076d1d95

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
192KB

MD5
40778817f7c22b6749eca91aeb40560c

SHA1
5d213da985aad720e10298e76b513492accf3664

SHA256
477ea2af278829409bb72b2c03b68f33a3b3747ad4125c829180985c958d40e6

SHA512
c518d9fc0db693119a7fed7a5216f76e5aa1e3b919d0ccc3530399b93fe63b536d5021c8b74d2251b34f0c49e1e906ec1ab501e343955d10ec3ed9f7076d1d95

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
192KB

MD5
a08bbb105b65c6f2a843f9e752027b26

SHA1
d4bd5521c6954a54f76bf6e142e7da5978a32153

SHA256
d0a8f505e618a1c4d3fa91ce74101b69301cc922d02662e12e9cf22b2bd52ad7

SHA512
33d0158ea9852cc08ed2301b4fcea2fe4446577d08f36a0d6cce4534f0210f98a1ea0142d63f665cbdb9f8f8c89cc1e05a82de1cb6cbf0d36fc2e0827fe0e6c3

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
192KB

MD5
a08bbb105b65c6f2a843f9e752027b26

SHA1
d4bd5521c6954a54f76bf6e142e7da5978a32153

SHA256
d0a8f505e618a1c4d3fa91ce74101b69301cc922d02662e12e9cf22b2bd52ad7

SHA512
33d0158ea9852cc08ed2301b4fcea2fe4446577d08f36a0d6cce4534f0210f98a1ea0142d63f665cbdb9f8f8c89cc1e05a82de1cb6cbf0d36fc2e0827fe0e6c3

Download Submit
memory/212-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/368-177-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/388-391-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/396-427-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/532-385-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/892-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/904-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/924-270-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/948-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1076-421-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1228-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1276-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1484-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1528-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-217-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1536-379-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1596-201-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1668-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1672-242-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1688-397-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1800-130-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1844-249-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1936-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2072-312-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2112-294-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2324-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2520-82-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2596-264-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2600-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2716-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2748-150-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2812-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2896-354-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3104-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3304-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3364-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3472-65-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3628-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3652-288-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3688-258-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3788-342-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3848-225-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3888-73-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3948-209-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3960-185-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3976-282-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4220-234-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4236-158-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4260-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4260-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4260-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4292-113-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4412-318-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4416-193-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4452-403-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4516-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4584-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4892-372-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4900-276-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4912-415-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4976-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4992-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5056-138-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5080-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads