91a6c510db0e99ce12c28e85573001684ec23c62aea18166b27ad56d075ac5c8

Analysis

max time kernel
167s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.3648de129b3b5bf389ca3bd333655110.exe
Size

109KB
MD5

3648de129b3b5bf389ca3bd333655110
SHA1

bc04de4f1d582ef8c69ac38f2cc7f19c8632cdf4
SHA256

91a6c510db0e99ce12c28e85573001684ec23c62aea18166b27ad56d075ac5c8
SHA512

52b0ecfc1bbd7074a52d8445f20cca470bd76b3e1593682b46a9bc6f8920b25d92ed9d3014019b1d64f68e2ba8255bbcdba2c283665aeae9aab94cd43387feac
SSDEEP

3072:axJQ7TWO+29ZskoJ9HLCqwzBu1DjHLMVDqqkSpR:VTWrCuJ97wtu1DjrFqhz

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpcnig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eggmqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkejalge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlbkjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okedmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmfkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqkkdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emhmkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdkbdllj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahjoljqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgjekc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nppkkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eenfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcmfgimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndkjbq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fongpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kidbnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mohingqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcfmgkgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnockqlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jianpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggicmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnockqlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejgdim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ginenk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amaqde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojbid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clihcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liecmlno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alkdbllo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfjlecdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hklglk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kggjghkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbhdafdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lifjgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjbbbga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggjjfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kaflio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inmplh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqpccp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Offnae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hqfqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdifcoea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adllplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kaemgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klibdcjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkhnab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agpoqoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mplfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlnbhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efolidno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eoilfidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knbiil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khiopp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apimhjbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bicogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blnoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caeiam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moglkikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbibpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Affoopqd.exe

Malware Backdoor - Berbew 64 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/memory/4860-0-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022cd6-8.dat	family_berbew
behavioral2/memory/3976-7-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022cd6-6.dat	family_berbew
behavioral2/files/0x0007000000022cd8-16.dat	family_berbew
behavioral2/memory/5056-15-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022cd8-14.dat	family_berbew
behavioral2/files/0x0007000000022cda-24.dat	family_berbew
behavioral2/memory/3604-23-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022cda-22.dat	family_berbew
behavioral2/files/0x0006000000022cde-26.dat	family_berbew
behavioral2/memory/412-32-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ce0-38.dat	family_berbew
behavioral2/files/0x0006000000022ce0-40.dat	family_berbew
behavioral2/memory/1748-39-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cde-31.dat	family_berbew
behavioral2/files/0x0006000000022cde-30.dat	family_berbew
behavioral2/files/0x0006000000022ce2-46.dat	family_berbew
behavioral2/files/0x0006000000022ce2-48.dat	family_berbew
behavioral2/memory/1996-47-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/2928-56-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ce4-55.dat	family_berbew
behavioral2/files/0x0006000000022ce4-54.dat	family_berbew
behavioral2/files/0x0006000000022ce6-62.dat	family_berbew
behavioral2/files/0x0006000000022ce6-63.dat	family_berbew
behavioral2/memory/4804-64-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ce7-70.dat	family_berbew
behavioral2/memory/3560-72-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ce7-71.dat	family_berbew
behavioral2/files/0x0006000000022ce9-73.dat	family_berbew
behavioral2/files/0x0006000000022ce9-80.dat	family_berbew
behavioral2/memory/1128-79-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ce9-78.dat	family_berbew
behavioral2/files/0x0006000000022ceb-88.dat	family_berbew
behavioral2/memory/4656-87-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ceb-86.dat	family_berbew
behavioral2/memory/4852-95-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022ced-96.dat	family_berbew
behavioral2/files/0x0006000000022ced-94.dat	family_berbew
behavioral2/files/0x0006000000022cef-98.dat	family_berbew
behavioral2/files/0x0006000000022cef-104.dat	family_berbew
behavioral2/memory/1848-103-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cef-102.dat	family_berbew
behavioral2/files/0x0006000000022cf1-111.dat	family_berbew
behavioral2/memory/4056-112-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cf1-110.dat	family_berbew
behavioral2/files/0x0006000000022cf4-118.dat	family_berbew
behavioral2/memory/3140-120-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cf4-119.dat	family_berbew
behavioral2/files/0x0006000000022cf6-128.dat	family_berbew
behavioral2/memory/792-127-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cf6-126.dat	family_berbew
behavioral2/files/0x0006000000022cf8-135.dat	family_berbew
behavioral2/memory/992-136-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cf8-134.dat	family_berbew
behavioral2/files/0x0006000000022cfa-143.dat	family_berbew
behavioral2/memory/416-144-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022cfa-142.dat	family_berbew
behavioral2/files/0x0006000000022cfc-152.dat	family_berbew
behavioral2/files/0x0006000000022cfe-158.dat	family_berbew
behavioral2/files/0x0006000000022cfe-160.dat	family_berbew
behavioral2/memory/316-159-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/4724-167-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022d00-168.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
3976	Dbckcf32.exe
5056	Gohapb32.exe
3604	Ginenk32.exe
412	Hcaibo32.exe
1748	Ijlkfg32.exe
1996	Igpkok32.exe
2928	Jflnafno.exe
4804	Kaflio32.exe
3560	Kggjghkd.exe
1128	Ldgnbg32.exe
4656	Mdlgmgdh.exe
4852	Maeaajpl.exe
1848	Nmbhgjoi.exe
4056	Omlkmign.exe
3140	Pdmikb32.exe
792	Adpogp32.exe
992	Ajaqjfbp.exe
416	Bgjjoi32.exe
4348	Cnmebblf.exe
316	Dabhomea.exe
4724	Djklgb32.exe
4412	Dgomaf32.exe
4668	Dhcfleff.exe
2064	Flmonbbp.exe
1832	Fongpm32.exe
732	Fhflhcfa.exe
3580	Gklnem32.exe
2488	Ghbkdald.exe
4652	Hcabhido.exe
2496	Hklglk32.exe
5104	Hebkid32.exe
2708	Hcflch32.exe
2176	Ioafchai.exe
1064	Ihndgmdd.exe
5088	Jbkbkbfo.exe
2016	Joobdfei.exe
3856	Kcbded32.exe
1292	Kmjinjnj.exe
5032	Kbgafqla.exe
3512	Kfejmobh.exe
456	Lkiiee32.exe
5040	Limioiia.exe
1716	Lfcfnm32.exe
3476	Mpkkgbmi.exe
1620	Ncbfcp32.exe
4700	Npldnp32.exe
5064	Qgdabflp.exe
4888	Fmejlcoj.exe
2676	Glkdejcd.exe
1872	Ghadjkhh.exe
1804	Gdkbdllj.exe
4784	Heohinog.exe
1628	Hlmiagbo.exe
4164	Iehkpmgl.exe
1944	Iaokdn32.exe
1132	Idpdfija.exe
4948	Ieoapl32.exe
4812	Jknfnbmi.exe
2580	Jlnbhe32.exe
2904	Jakkplbc.exe
2244	Jhdcmf32.exe
4836	Jamhflqq.exe
1444	Klibdcjo.exe
3388	Khbpndnp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aqhcid32.exe	Ajnkmjqj.exe
File created	C:\Windows\SysWOW64\Jkhnab32.exe	Jfkehk32.exe
File opened for modification	C:\Windows\SysWOW64\Mnjqfeld.exe	Mcdlil32.exe
File created	C:\Windows\SysWOW64\Nakhkl32.exe	Nedgfk32.exe
File opened for modification	C:\Windows\SysWOW64\Cpnpjgpn.exe	Cidgnm32.exe
File created	C:\Windows\SysWOW64\Qjfmda32.exe	Qpahghbg.exe
File opened for modification	C:\Windows\SysWOW64\Ahdpdd32.exe	Amnlfk32.exe
File created	C:\Windows\SysWOW64\Kobkle32.dll	Ggjjfq32.exe
File created	C:\Windows\SysWOW64\Fbgnbigb.dll	Maohdj32.exe
File opened for modification	C:\Windows\SysWOW64\Oahnbc32.exe	Oojaeh32.exe
File created	C:\Windows\SysWOW64\Nppkkj32.exe	Nbljaf32.exe
File created	C:\Windows\SysWOW64\Laiiie32.exe	Lllaqn32.exe
File created	C:\Windows\SysWOW64\Igpkok32.exe	Ijlkfg32.exe
File created	C:\Windows\SysWOW64\Bgemlo32.dll	Eqpfknbj.exe
File opened for modification	C:\Windows\SysWOW64\Mdanjaqf.exe	Lgmnqmam.exe
File created	C:\Windows\SysWOW64\Lpkiim32.exe	Lfcdph32.exe
File opened for modification	C:\Windows\SysWOW64\Qleahgff.exe	Pgihppgo.exe
File opened for modification	C:\Windows\SysWOW64\Cbbnim32.exe	Cleeafbi.exe
File created	C:\Windows\SysWOW64\Kpfpci32.dll	Pjaciafc.exe
File created	C:\Windows\SysWOW64\Epqegd32.exe	Eekail32.exe
File opened for modification	C:\Windows\SysWOW64\Nonajj32.exe	Ndhnma32.exe
File created	C:\Windows\SysWOW64\Nqklfe32.exe	Ncgkma32.exe
File opened for modification	C:\Windows\SysWOW64\Okloomoj.exe	Oqgkadod.exe
File created	C:\Windows\SysWOW64\Kiejfo32.exe	Kbkaiddd.exe
File created	C:\Windows\SysWOW64\Okgofl32.dll	Aadgadai.exe
File created	C:\Windows\SysWOW64\Ccopfi32.exe	Cgioah32.exe
File opened for modification	C:\Windows\SysWOW64\Blnoad32.exe	Pllieg32.exe
File created	C:\Windows\SysWOW64\Mknjopdf.dll	Knbiil32.exe
File created	C:\Windows\SysWOW64\Kimnnbaj.dll	Ogqaqigd.exe
File created	C:\Windows\SysWOW64\Dhphfppl.exe	Ckgnbl32.exe
File opened for modification	C:\Windows\SysWOW64\Ejegdngb.exe	Dphipidf.exe
File created	C:\Windows\SysWOW64\Eiclml32.dll	Dhhnipbe.exe
File opened for modification	C:\Windows\SysWOW64\Nhhlog32.exe	Nlbkjf32.exe
File opened for modification	C:\Windows\SysWOW64\Bhkmoifp.exe	Bochfc32.exe
File created	C:\Windows\SysWOW64\Idcpofaf.dll	Akkfop32.exe
File opened for modification	C:\Windows\SysWOW64\Akmbepke.exe	Aphngglp.exe
File created	C:\Windows\SysWOW64\Gnoanl32.dll	Idpdfija.exe
File opened for modification	C:\Windows\SysWOW64\Mmiccf32.exe	Mdanjaqf.exe
File created	C:\Windows\SysWOW64\Olphlcdb.exe	Obgccn32.exe
File opened for modification	C:\Windows\SysWOW64\Jlnbhe32.exe	Jknfnbmi.exe
File opened for modification	C:\Windows\SysWOW64\Jkhnab32.exe	Jfkehk32.exe
File created	C:\Windows\SysWOW64\Bicogo32.exe	Apimhjbe.exe
File opened for modification	C:\Windows\SysWOW64\Qgdabflp.exe	Npldnp32.exe
File opened for modification	C:\Windows\SysWOW64\Fbcfan32.exe	Flinddpj.exe
File created	C:\Windows\SysWOW64\Ejdhokji.dll	Idceim32.exe
File created	C:\Windows\SysWOW64\Qaoofaoi.exe	Phaabm32.exe
File created	C:\Windows\SysWOW64\Jfpmglkb.dll	Jndenjmo.exe
File opened for modification	C:\Windows\SysWOW64\Gdkbdllj.exe	Ghadjkhh.exe
File opened for modification	C:\Windows\SysWOW64\Mljmblae.exe	Mcaiif32.exe
File created	C:\Windows\SysWOW64\Nbpafkdf.exe	Nlbindfo.exe
File created	C:\Windows\SysWOW64\Bgjiokeo.dll	Flmonbbp.exe
File opened for modification	C:\Windows\SysWOW64\Ojjoedfn.exe	Ndagao32.exe
File created	C:\Windows\SysWOW64\Opnbjk32.exe	Offnae32.exe
File opened for modification	C:\Windows\SysWOW64\Noqnpi32.exe	Ndkjbq32.exe
File created	C:\Windows\SysWOW64\Cacdlf32.dll	Iaokdn32.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkhb32.exe	Caebfg32.exe
File created	C:\Windows\SysWOW64\Pifodifq.dll	Jqpfccgo.exe
File opened for modification	C:\Windows\SysWOW64\Kibmqond.exe	Knmicfnn.exe
File created	C:\Windows\SysWOW64\Giplpe32.dll	Dbckcf32.exe
File created	C:\Windows\SysWOW64\Efocbmni.dll	Lpkiim32.exe
File opened for modification	C:\Windows\SysWOW64\Ihnkobpl.exe	Fhablf32.exe
File created	C:\Windows\SysWOW64\Mcnmccfa.exe	Lklbnb32.exe
File created	C:\Windows\SysWOW64\Oqkkdh32.exe	Ookokeqd.exe
File created	C:\Windows\SysWOW64\Fkbpjbil.exe	Fqmlmiif.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkbgeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfcmge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpenoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhklccbj.dll"	Meljkeed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnnkaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igkbkg32.dll"	Bhkmoifp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edklljnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plakkepg.dll"	Egknco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ghadjkhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhlamhkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feoacblj.dll"	Pcmjaloi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khbpndnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekejap32.dll"	Nlbkjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bphpqpah.dll"	Afapjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oolnkhgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpeohnhn.dll"	Bajjeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ilpaei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgkfhngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjaciafc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afnljenh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qhlamhkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmkiqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckgnbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcabkgce.dll"	Ckbnlfeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjoadbbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aemead32.dll"	Mnjqfeld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njhglelp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Limioiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgnekcei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pookqgeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iocliecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jialbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggjjfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Egknco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmofkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbaabk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpbmpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gjnlag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldgnbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Encgdbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfcompnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amjjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnicgle.dll"	Ginenk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldgnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aofjhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqimje32.dll"	Lemjlcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjhlipla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdbndjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mplfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panemeei.dll"	Blpemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcgbmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljagfapn.dll"	Khoeok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqfedn32.dll"	Ddqbkebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibpjfkd.dll"	Keekci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aohfnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lifjgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oopnio32.dll"	Mhncnodp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oifekg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bochfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Inkjao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbpljo32.dll"	Naejcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Keekci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kaflio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmbhgjoi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3976	4860	NEAS.3648de129b3b5bf389ca3bd333655110.exe	94
PID 4860 wrote to memory of 3976	4860	NEAS.3648de129b3b5bf389ca3bd333655110.exe	94
PID 4860 wrote to memory of 3976	4860	NEAS.3648de129b3b5bf389ca3bd333655110.exe	94
PID 3976 wrote to memory of 5056	3976	Dbckcf32.exe	95
PID 3976 wrote to memory of 5056	3976	Dbckcf32.exe	95
PID 3976 wrote to memory of 5056	3976	Dbckcf32.exe	95
PID 5056 wrote to memory of 3604	5056	Gohapb32.exe	96
PID 5056 wrote to memory of 3604	5056	Gohapb32.exe	96
PID 5056 wrote to memory of 3604	5056	Gohapb32.exe	96
PID 3604 wrote to memory of 412	3604	Ginenk32.exe	98
PID 3604 wrote to memory of 412	3604	Ginenk32.exe	98
PID 3604 wrote to memory of 412	3604	Ginenk32.exe	98
PID 412 wrote to memory of 1748	412	Hcaibo32.exe	97
PID 412 wrote to memory of 1748	412	Hcaibo32.exe	97
PID 412 wrote to memory of 1748	412	Hcaibo32.exe	97
PID 1748 wrote to memory of 1996	1748	Ijlkfg32.exe	99
PID 1748 wrote to memory of 1996	1748	Ijlkfg32.exe	99
PID 1748 wrote to memory of 1996	1748	Ijlkfg32.exe	99
PID 1996 wrote to memory of 2928	1996	Igpkok32.exe	100
PID 1996 wrote to memory of 2928	1996	Igpkok32.exe	100
PID 1996 wrote to memory of 2928	1996	Igpkok32.exe	100
PID 2928 wrote to memory of 4804	2928	Jflnafno.exe	101
PID 2928 wrote to memory of 4804	2928	Jflnafno.exe	101
PID 2928 wrote to memory of 4804	2928	Jflnafno.exe	101
PID 4804 wrote to memory of 3560	4804	Kaflio32.exe	102
PID 4804 wrote to memory of 3560	4804	Kaflio32.exe	102
PID 4804 wrote to memory of 3560	4804	Kaflio32.exe	102
PID 3560 wrote to memory of 1128	3560	Kggjghkd.exe	103
PID 3560 wrote to memory of 1128	3560	Kggjghkd.exe	103
PID 3560 wrote to memory of 1128	3560	Kggjghkd.exe	103
PID 1128 wrote to memory of 4656	1128	Ldgnbg32.exe	104
PID 1128 wrote to memory of 4656	1128	Ldgnbg32.exe	104
PID 1128 wrote to memory of 4656	1128	Ldgnbg32.exe	104
PID 4656 wrote to memory of 4852	4656	Mdlgmgdh.exe	105
PID 4656 wrote to memory of 4852	4656	Mdlgmgdh.exe	105
PID 4656 wrote to memory of 4852	4656	Mdlgmgdh.exe	105
PID 4852 wrote to memory of 1848	4852	Maeaajpl.exe	106
PID 4852 wrote to memory of 1848	4852	Maeaajpl.exe	106
PID 4852 wrote to memory of 1848	4852	Maeaajpl.exe	106
PID 1848 wrote to memory of 4056	1848	Nmbhgjoi.exe	107
PID 1848 wrote to memory of 4056	1848	Nmbhgjoi.exe	107
PID 1848 wrote to memory of 4056	1848	Nmbhgjoi.exe	107
PID 4056 wrote to memory of 3140	4056	Omlkmign.exe	108
PID 4056 wrote to memory of 3140	4056	Omlkmign.exe	108
PID 4056 wrote to memory of 3140	4056	Omlkmign.exe	108
PID 3140 wrote to memory of 792	3140	Pdmikb32.exe	109
PID 3140 wrote to memory of 792	3140	Pdmikb32.exe	109
PID 3140 wrote to memory of 792	3140	Pdmikb32.exe	109
PID 792 wrote to memory of 992	792	Adpogp32.exe	110
PID 792 wrote to memory of 992	792	Adpogp32.exe	110
PID 792 wrote to memory of 992	792	Adpogp32.exe	110
PID 992 wrote to memory of 416	992	Ajaqjfbp.exe	111
PID 992 wrote to memory of 416	992	Ajaqjfbp.exe	111
PID 992 wrote to memory of 416	992	Ajaqjfbp.exe	111
PID 416 wrote to memory of 4348	416	Bgjjoi32.exe	115
PID 416 wrote to memory of 4348	416	Bgjjoi32.exe	115
PID 416 wrote to memory of 4348	416	Bgjjoi32.exe	115
PID 4348 wrote to memory of 316	4348	Cnmebblf.exe	113
PID 4348 wrote to memory of 316	4348	Cnmebblf.exe	113
PID 4348 wrote to memory of 316	4348	Cnmebblf.exe	113
PID 316 wrote to memory of 4724	316	Dabhomea.exe	112
PID 316 wrote to memory of 4724	316	Dabhomea.exe	112
PID 316 wrote to memory of 4724	316	Dabhomea.exe	112
PID 4724 wrote to memory of 4412	4724	Djklgb32.exe	114

C:\Users\Admin\AppData\Local\Temp\NEAS.3648de129b3b5bf389ca3bd333655110.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3648de129b3b5bf389ca3bd333655110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\Dbckcf32.exe
  C:\Windows\system32\Dbckcf32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\Gohapb32.exe
    C:\Windows\system32\Gohapb32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\SysWOW64\Ginenk32.exe
      C:\Windows\system32\Ginenk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\Windows\SysWOW64\Hcaibo32.exe
        
        C:\Windows\system32\Hcaibo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412

C:\Windows\SysWOW64\Ijlkfg32.exe
C:\Windows\system32\Ijlkfg32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\Igpkok32.exe
  C:\Windows\system32\Igpkok32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\Jflnafno.exe
    C:\Windows\system32\Jflnafno.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\Kaflio32.exe
      C:\Windows\system32\Kaflio32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
      - C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Maeaajpl.exe
        
        C:\Windows\system32\Maeaajpl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Bgjjoi32.exe
        
        C:\Windows\system32\Bgjjoi32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348

C:\Windows\SysWOW64\Djklgb32.exe
C:\Windows\system32\Djklgb32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\Dgomaf32.exe
  C:\Windows\system32\Dgomaf32.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- - C:\Windows\SysWOW64\Dhcfleff.exe
    C:\Windows\system32\Dhcfleff.exe
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Windows\SysWOW64\Flmonbbp.exe
      C:\Windows\system32\Flmonbbp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2064

C:\Windows\SysWOW64\Dabhomea.exe
C:\Windows\system32\Dabhomea.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\Fongpm32.exe
C:\Windows\system32\Fongpm32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1832
- C:\Windows\SysWOW64\Fhflhcfa.exe
  C:\Windows\system32\Fhflhcfa.exe
  2⤵
  - Executes dropped EXE
  PID:732
- - C:\Windows\SysWOW64\Gklnem32.exe
    C:\Windows\system32\Gklnem32.exe
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Windows\SysWOW64\Ghbkdald.exe
      C:\Windows\system32\Ghbkdald.exe
      4⤵
      Executes dropped EXE
      PID:2488
    - - C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        5⤵
        Executes dropped EXE
        
        PID:4652
      - C:\Windows\SysWOW64\Hklglk32.exe
        
        C:\Windows\system32\Hklglk32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2496

C:\Windows\SysWOW64\Hebkid32.exe
C:\Windows\system32\Hebkid32.exe
1⤵
- Executes dropped EXE
PID:5104
- C:\Windows\SysWOW64\Hcflch32.exe
  C:\Windows\system32\Hcflch32.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- - C:\Windows\SysWOW64\Ioafchai.exe
    C:\Windows\system32\Ioafchai.exe
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Windows\SysWOW64\Ihndgmdd.exe
      C:\Windows\system32\Ihndgmdd.exe
      4⤵
      Executes dropped EXE
      PID:1064
    - - C:\Windows\SysWOW64\Jbkbkbfo.exe
        
        C:\Windows\system32\Jbkbkbfo.exe
        5⤵
        Executes dropped EXE
        
        PID:5088
      - C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        6⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        7⤵
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        8⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        9⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        10⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        11⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        13⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        14⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Windows\SysWOW64\Ncbfcp32.exe
        
        C:\Windows\system32\Ncbfcp32.exe
        15⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Npldnp32.exe
        
        C:\Windows\system32\Npldnp32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4700
        
        C:\Windows\SysWOW64\Qgdabflp.exe
        
        C:\Windows\system32\Qgdabflp.exe
        17⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Fmejlcoj.exe
        
        C:\Windows\system32\Fmejlcoj.exe
        18⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Glkdejcd.exe
        
        C:\Windows\system32\Glkdejcd.exe
        19⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\Ghadjkhh.exe
        
        C:\Windows\system32\Ghadjkhh.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Gdkbdllj.exe
        
        C:\Windows\system32\Gdkbdllj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Heohinog.exe
        
        C:\Windows\system32\Heohinog.exe
        22⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Hlmiagbo.exe
        
        C:\Windows\system32\Hlmiagbo.exe
        23⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Iehkpmgl.exe
        
        C:\Windows\system32\Iehkpmgl.exe
        24⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Iaokdn32.exe
        
        C:\Windows\system32\Iaokdn32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Idpdfija.exe
        
        C:\Windows\system32\Idpdfija.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Ieoapl32.exe
        
        C:\Windows\system32\Ieoapl32.exe
        27⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Jknfnbmi.exe
        
        C:\Windows\system32\Jknfnbmi.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Jlnbhe32.exe
        
        C:\Windows\system32\Jlnbhe32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        30⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Jhdcmf32.exe
        
        C:\Windows\system32\Jhdcmf32.exe
        31⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Jamhflqq.exe
        
        C:\Windows\system32\Jamhflqq.exe
        32⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Klibdcjo.exe
        
        C:\Windows\system32\Klibdcjo.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Khbpndnp.exe
        
        C:\Windows\system32\Khbpndnp.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Lnkgbibj.exe
        
        C:\Windows\system32\Lnkgbibj.exe
        35⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Niohap32.exe
        
        C:\Windows\system32\Niohap32.exe
        36⤵
        
        PID:680
        
        C:\Windows\SysWOW64\Pekkhn32.exe
        
        C:\Windows\system32\Pekkhn32.exe
        37⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Pllieg32.exe
        
        C:\Windows\system32\Pllieg32.exe
        38⤵
        Drops file in System32 directory
        
        PID:880
        
        C:\Windows\SysWOW64\Blnoad32.exe
        
        C:\Windows\system32\Blnoad32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5000
        
        C:\Windows\SysWOW64\Eqpfknbj.exe
        
        C:\Windows\system32\Eqpfknbj.exe
        40⤵
        Drops file in System32 directory
        
        PID:3080
        
        C:\Windows\SysWOW64\Encgdbqd.exe
        
        C:\Windows\system32\Encgdbqd.exe
        41⤵
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Efolidno.exe
        
        C:\Windows\system32\Efolidno.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1720
        
        C:\Windows\SysWOW64\Fjoadbbc.exe
        
        C:\Windows\system32\Fjoadbbc.exe
        43⤵
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Oilmhhfd.exe
        
        C:\Windows\system32\Oilmhhfd.exe
        44⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Ppphkq32.exe
        
        C:\Windows\system32\Ppphkq32.exe
        45⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        46⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        47⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Blpemn32.exe
        
        C:\Windows\system32\Blpemn32.exe
        48⤵
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        49⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Ceppfbef.exe
        
        C:\Windows\system32\Ceppfbef.exe
        50⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Clihcm32.exe
        
        C:\Windows\system32\Clihcm32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3064
        
        C:\Windows\SysWOW64\Dhgoimlo.exe
        
        C:\Windows\system32\Dhgoimlo.exe
        52⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Doageg32.exe
        
        C:\Windows\system32\Doageg32.exe
        53⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Dhjknljl.exe
        
        C:\Windows\system32\Dhjknljl.exe
        54⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Dphipidf.exe
        
        C:\Windows\system32\Dphipidf.exe
        55⤵
        Drops file in System32 directory
        
        PID:3844
        
        C:\Windows\SysWOW64\Ejegdngb.exe
        
        C:\Windows\system32\Ejegdngb.exe
        56⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Ejgdim32.exe
        
        C:\Windows\system32\Ejgdim32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5084
        
        C:\Windows\SysWOW64\Emhmkh32.exe
        
        C:\Windows\system32\Emhmkh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:984
        
        C:\Windows\SysWOW64\Gfqjkljn.exe
        
        C:\Windows\system32\Gfqjkljn.exe
        59⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Ipckqnja.exe
        
        C:\Windows\system32\Ipckqnja.exe
        60⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        61⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Kaemgn32.exe
        
        C:\Windows\system32\Kaemgn32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4724
        
        C:\Windows\SysWOW64\Kgbepdpf.exe
        
        C:\Windows\system32\Kgbepdpf.exe
        63⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        64⤵
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Mdaedgdb.exe
        
        C:\Windows\system32\Mdaedgdb.exe
        65⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Mpkbohhd.exe
        
        C:\Windows\system32\Mpkbohhd.exe
        66⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Maohdj32.exe
        
        C:\Windows\system32\Maohdj32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Nqdeefpi.exe
        
        C:\Windows\system32\Nqdeefpi.exe
        68⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Nkijbooo.exe
        
        C:\Windows\system32\Nkijbooo.exe
        69⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ndbnkefp.exe
        
        C:\Windows\system32\Ndbnkefp.exe
        70⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4176
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2016
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        74⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Ojfmdk32.exe
        
        C:\Windows\system32\Ojfmdk32.exe
        75⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        76⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        77⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        78⤵
        Drops file in System32 directory
        
        PID:3620
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        79⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Pqihgcma.exe
        
        C:\Windows\system32\Pqihgcma.exe
        80⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Pgcpdn32.exe
        
        C:\Windows\system32\Pgcpdn32.exe
        81⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Pbhdafdd.exe
        
        C:\Windows\system32\Pbhdafdd.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3932
        
        C:\Windows\SysWOW64\Pgjfdm32.exe
        
        C:\Windows\system32\Pgjfdm32.exe
        83⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Ahjoljqc.exe
        
        C:\Windows\system32\Ahjoljqc.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:732
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        85⤵
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Bonjnc32.exe
        
        C:\Windows\system32\Bonjnc32.exe
        86⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Bdkbgj32.exe
        
        C:\Windows\system32\Bdkbgj32.exe
        87⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        88⤵
        
        PID:792
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        89⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Cbnpja32.exe
        
        C:\Windows\system32\Cbnpja32.exe
        90⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Caeiam32.exe
        
        C:\Windows\system32\Caeiam32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5136
        
        C:\Windows\SysWOW64\Dkbgeb32.exe
        
        C:\Windows\system32\Dkbgeb32.exe
        92⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        93⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Fhpckb32.exe
        
        C:\Windows\system32\Fhpckb32.exe
        94⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Fbihdhhf.exe
        
        C:\Windows\system32\Fbihdhhf.exe
        95⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Gokdoj32.exe
        
        C:\Windows\system32\Gokdoj32.exe
        96⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ilpaei32.exe
        
        C:\Windows\system32\Ilpaei32.exe
        97⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        98⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Jmknkk32.exe
        
        C:\Windows\system32\Jmknkk32.exe
        99⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jbgfca32.exe
        
        C:\Windows\system32\Jbgfca32.exe
        100⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jianpl32.exe
        
        C:\Windows\system32\Jianpl32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        102⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        103⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        104⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        105⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Kbceoped.exe
        
        C:\Windows\system32\Kbceoped.exe
        106⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kimnlj32.exe
        
        C:\Windows\system32\Kimnlj32.exe
        107⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kdcbic32.exe
        
        C:\Windows\system32\Kdcbic32.exe
        108⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        109⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        110⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        111⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Mmiccf32.exe
        
        C:\Windows\system32\Mmiccf32.exe
        112⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Mdckpqod.exe
        
        C:\Windows\system32\Mdckpqod.exe
        113⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        114⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        115⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Ndagao32.exe
        
        C:\Windows\system32\Ndagao32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        117⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        118⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Pjaefc32.exe
        
        C:\Windows\system32\Pjaefc32.exe
        119⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        120⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Pqbdclak.exe
        
        C:\Windows\system32\Pqbdclak.exe
        121⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Bfcompnj.exe
        
        C:\Windows\system32\Bfcompnj.exe
        122⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Caebfg32.exe
        
        C:\Windows\system32\Caebfg32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Cdfkhb32.exe
        
        C:\Windows\system32\Cdfkhb32.exe
        124⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Dmnpah32.exe
        
        C:\Windows\system32\Dmnpah32.exe
        125⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Dffdjmme.exe
        
        C:\Windows\system32\Dffdjmme.exe
        126⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Dmpmfg32.exe
        
        C:\Windows\system32\Dmpmfg32.exe
        127⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Dkdmpl32.exe
        
        C:\Windows\system32\Dkdmpl32.exe
        128⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Dhhnipbe.exe
        
        C:\Windows\system32\Dhhnipbe.exe
        129⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Eddhipdd.exe
        
        C:\Windows\system32\Eddhipdd.exe
        130⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Eoilfidj.exe
        
        C:\Windows\system32\Eoilfidj.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Egdqkk32.exe
        
        C:\Windows\system32\Egdqkk32.exe
        132⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Eggmqk32.exe
        
        C:\Windows\system32\Eggmqk32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        134⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Fgppgi32.exe
        
        C:\Windows\system32\Fgppgi32.exe
        135⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        136⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Fknimh32.exe
        
        C:\Windows\system32\Fknimh32.exe
        137⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Gkcbhgii.exe
        
        C:\Windows\system32\Gkcbhgii.exe
        138⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ggicmh32.exe
        
        C:\Windows\system32\Ggicmh32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Gdncfl32.exe
        
        C:\Windows\system32\Gdncfl32.exe
        140⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        141⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Hnagkp32.exe
        
        C:\Windows\system32\Hnagkp32.exe
        142⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        143⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        144⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Inkjao32.exe
        
        C:\Windows\system32\Inkjao32.exe
        145⤵
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Idebniil.exe
        
        C:\Windows\system32\Idebniil.exe
        146⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Ikokkc32.exe
        
        C:\Windows\system32\Ikokkc32.exe
        147⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ibicgmhe.exe
        
        C:\Windows\system32\Ibicgmhe.exe
        148⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Jgjekc32.exe
        
        C:\Windows\system32\Jgjekc32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:628
        
        C:\Windows\SysWOW64\Jfkehk32.exe
        
        C:\Windows\system32\Jfkehk32.exe
        150⤵
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3080
        
        C:\Windows\SysWOW64\Jfnbnk32.exe
        
        C:\Windows\system32\Jfnbnk32.exe
        152⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        153⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kejepfgd.exe
        
        C:\Windows\system32\Kejepfgd.exe
        154⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Knbiil32.exe
        
        C:\Windows\system32\Knbiil32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Kihnfdmj.exe
        
        C:\Windows\system32\Kihnfdmj.exe
        156⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Lfcdph32.exe
        
        C:\Windows\system32\Lfcdph32.exe
        157⤵
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Lpkiim32.exe
        
        C:\Windows\system32\Lpkiim32.exe
        158⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Lehaad32.exe
        
        C:\Windows\system32\Lehaad32.exe
        159⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Loqejjad.exe
        
        C:\Windows\system32\Loqejjad.exe
        160⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Lifjgb32.exe
        
        C:\Windows\system32\Lifjgb32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Lemjlcgo.exe
        
        C:\Windows\system32\Lemjlcgo.exe
        162⤵
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Mhncnodp.exe
        
        C:\Windows\system32\Mhncnodp.exe
        163⤵
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Mfoclflo.exe
        
        C:\Windows\system32\Mfoclflo.exe
        165⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        166⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        167⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Mfcmge32.exe
        
        C:\Windows\system32\Mfcmge32.exe
        168⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Mbjnlfnn.exe
        
        C:\Windows\system32\Mbjnlfnn.exe
        169⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Nbljaf32.exe
        
        C:\Windows\system32\Nbljaf32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Nppkkj32.exe
        
        C:\Windows\system32\Nppkkj32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Ngjcgdba.exe
        
        C:\Windows\system32\Ngjcgdba.exe
        172⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nhpijldj.exe
        
        C:\Windows\system32\Nhpijldj.exe
        173⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        174⤵
        Drops file in System32 directory
        
        PID:4284
        
        C:\Windows\SysWOW64\Qleahgff.exe
        
        C:\Windows\system32\Qleahgff.exe
        175⤵
        
        PID:956
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        176⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Qhlamhkj.exe
        
        C:\Windows\system32\Qhlamhkj.exe
        177⤵
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Qcbfjqkp.exe
        
        C:\Windows\system32\Qcbfjqkp.exe
        178⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Amjjcf32.exe
        
        C:\Windows\system32\Amjjcf32.exe
        179⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Agpoqoaf.exe
        
        C:\Windows\system32\Agpoqoaf.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        181⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Aqhcid32.exe
        
        C:\Windows\system32\Aqhcid32.exe
        182⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Afelal32.exe
        
        C:\Windows\system32\Afelal32.exe
        183⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Aqjpod32.exe
        
        C:\Windows\system32\Aqjpod32.exe
        184⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        185⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        187⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Cggnhlml.exe
        
        C:\Windows\system32\Cggnhlml.exe
        188⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Cpbbln32.exe
        
        C:\Windows\system32\Cpbbln32.exe
        189⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Cflkihbd.exe
        
        C:\Windows\system32\Cflkihbd.exe
        190⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Edemdine.exe
        
        C:\Windows\system32\Edemdine.exe
        191⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Emnbmoef.exe
        
        C:\Windows\system32\Emnbmoef.exe
        192⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ffmmgceo.exe
        
        C:\Windows\system32\Ffmmgceo.exe
        193⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Fhablf32.exe
        
        C:\Windows\system32\Fhablf32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Ihnkobpl.exe
        
        C:\Windows\system32\Ihnkobpl.exe
        195⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        196⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Ihpgda32.exe
        
        C:\Windows\system32\Ihpgda32.exe
        197⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Idfhibdn.exe
        
        C:\Windows\system32\Idfhibdn.exe
        199⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        200⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Jjfngi32.exe
        
        C:\Windows\system32\Jjfngi32.exe
        201⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        202⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        204⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Jkggfl32.exe
        
        C:\Windows\system32\Jkggfl32.exe
        205⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Jbaocfmo.exe
        
        C:\Windows\system32\Jbaocfmo.exe
        206⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Jgngkmkf.exe
        
        C:\Windows\system32\Jgngkmkf.exe
        207⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        208⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jdbheajp.exe
        
        C:\Windows\system32\Jdbheajp.exe
        209⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        210⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Knmicfnn.exe
        
        C:\Windows\system32\Knmicfnn.exe
        211⤵
        Drops file in System32 directory
        
        PID:4944
        
        C:\Windows\SysWOW64\Kibmqond.exe
        
        C:\Windows\system32\Kibmqond.exe
        212⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        213⤵
        Drops file in System32 directory
        
        PID:3892
        
        C:\Windows\SysWOW64\Kiejfo32.exe
        
        C:\Windows\system32\Kiejfo32.exe
        214⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        215⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        216⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Llabchoe.exe
        
        C:\Windows\system32\Llabchoe.exe
        217⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Liecmlno.exe
        
        C:\Windows\system32\Liecmlno.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Lbngfbdo.exe
        
        C:\Windows\system32\Lbngfbdo.exe
        219⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Mlflog32.exe
        
        C:\Windows\system32\Mlflog32.exe
        220⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Macdgn32.exe
        
        C:\Windows\system32\Macdgn32.exe
        221⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Maealn32.exe
        
        C:\Windows\system32\Maealn32.exe
        222⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        223⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Mnnkaa32.exe
        
        C:\Windows\system32\Mnnkaa32.exe
        224⤵
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Nlbkjf32.exe
        
        C:\Windows\system32\Nlbkjf32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Nhhlog32.exe
        
        C:\Windows\system32\Nhhlog32.exe
        226⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        227⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Nelmik32.exe
        
        C:\Windows\system32\Nelmik32.exe
        228⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Noeaaqlq.exe
        
        C:\Windows\system32\Noeaaqlq.exe
        229⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Neoink32.exe
        
        C:\Windows\system32\Neoink32.exe
        230⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        231⤵
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        232⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ohboeenl.exe
        
        C:\Windows\system32\Ohboeenl.exe
        233⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        234⤵
        Drops file in System32 directory
        
        PID:6316
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        235⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        236⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Okedmp32.exe
        
        C:\Windows\system32\Okedmp32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2496
        
        C:\Windows\SysWOW64\Oifekg32.exe
        
        C:\Windows\system32\Oifekg32.exe
        238⤵
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Poggnnkk.exe
        
        C:\Windows\system32\Poggnnkk.exe
        239⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        240⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Bmofkm32.exe
        
        C:\Windows\system32\Bmofkm32.exe
        241⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Diccal32.exe
        
        C:\Windows\system32\Diccal32.exe
        242⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        243⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        244⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        245⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Fmbdnhme.exe
        
        C:\Windows\system32\Fmbdnhme.exe
        246⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        247⤵
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Ffmelmbc.exe
        
        C:\Windows\system32\Ffmelmbc.exe
        248⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Flinddpj.exe
        
        C:\Windows\system32\Flinddpj.exe
        249⤵
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\Fbcfan32.exe
        
        C:\Windows\system32\Fbcfan32.exe
        250⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Gplpfb32.exe
        
        C:\Windows\system32\Gplpfb32.exe
        251⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Glgjfb32.exe
        
        C:\Windows\system32\Glgjfb32.exe
        252⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Gkhkdjli.exe
        
        C:\Windows\system32\Gkhkdjli.exe
        253⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Hipdjfoo.exe
        
        C:\Windows\system32\Hipdjfoo.exe
        254⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Hmnmqdee.exe
        
        C:\Windows\system32\Hmnmqdee.exe
        255⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        256⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Ipflcnln.exe
        
        C:\Windows\system32\Ipflcnln.exe
        257⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        258⤵
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\Ijqmacpl.exe
        
        C:\Windows\system32\Ijqmacpl.exe
        259⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        260⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Kjafha32.exe
        
        C:\Windows\system32\Kjafha32.exe
        261⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        262⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Lklbnb32.exe
        
        C:\Windows\system32\Lklbnb32.exe
        263⤵
        Drops file in System32 directory
        
        PID:2224
        
        C:\Windows\SysWOW64\Mcnmccfa.exe
        
        C:\Windows\system32\Mcnmccfa.exe
        264⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Menimfnd.exe
        
        C:\Windows\system32\Menimfnd.exe
        265⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Napjnfik.exe
        
        C:\Windows\system32\Napjnfik.exe
        266⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Nndjgjhe.exe
        
        C:\Windows\system32\Nndjgjhe.exe
        267⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Ompmie32.exe
        
        C:\Windows\system32\Ompmie32.exe
        268⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Phaabm32.exe
        
        C:\Windows\system32\Phaabm32.exe
        269⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Qaoofaoi.exe
        
        C:\Windows\system32\Qaoofaoi.exe
        270⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        271⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        272⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Adbdml32.exe
        
        C:\Windows\system32\Adbdml32.exe
        273⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Bochfc32.exe
        
        C:\Windows\system32\Bochfc32.exe
        274⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        275⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        276⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Bdbndjld.exe
        
        C:\Windows\system32\Bdbndjld.exe
        277⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        278⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Cleeafbi.exe
        
        C:\Windows\system32\Cleeafbi.exe
        279⤵
        Drops file in System32 directory
        
        PID:3148
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        280⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4324
        
        C:\Windows\SysWOW64\Dfbcek32.exe
        
        C:\Windows\system32\Dfbcek32.exe
        282⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        283⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Eenfff32.exe
        
        C:\Windows\system32\Eenfff32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Eofgioah.exe
        
        C:\Windows\system32\Eofgioah.exe
        285⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Eiahhdee.exe
        
        C:\Windows\system32\Eiahhdee.exe
        286⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Efeiahdo.exe
        
        C:\Windows\system32\Efeiahdo.exe
        287⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Epmmjnkp.exe
        
        C:\Windows\system32\Epmmjnkp.exe
        288⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Ffgegh32.exe
        
        C:\Windows\system32\Ffgegh32.exe
        289⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        290⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Hbchnfei.exe
        
        C:\Windows\system32\Hbchnfei.exe
        291⤵
        
        PID:984
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        292⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Hmkiqn32.exe
        
        C:\Windows\system32\Hmkiqn32.exe
        293⤵
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Hfcnicjl.exe
        
        C:\Windows\system32\Hfcnicjl.exe
        294⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        295⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Hpnohinj.exe
        
        C:\Windows\system32\Hpnohinj.exe
        296⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Hekgppma.exe
        
        C:\Windows\system32\Hekgppma.exe
        297⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        298⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Iojbid32.exe
        
        C:\Windows\system32\Iojbid32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3768
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        300⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        301⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Jcoapami.exe
        
        C:\Windows\system32\Jcoapami.exe
        302⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        303⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        304⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        305⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Jpenoe32.exe
        
        C:\Windows\system32\Jpenoe32.exe
        306⤵
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        307⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Kfgpblda.exe
        
        C:\Windows\system32\Kfgpblda.exe
        308⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        309⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Kjeiij32.exe
        
        C:\Windows\system32\Kjeiij32.exe
        310⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Koaaaaip.exe
        
        C:\Windows\system32\Koaaaaip.exe
        311⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Kgkfhngo.exe
        
        C:\Windows\system32\Kgkfhngo.exe
        312⤵
        Modifies registry class
        
        PID:3728
        
        C:\Windows\SysWOW64\Mmfkac32.exe
        
        C:\Windows\system32\Mmfkac32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Mfnojh32.exe
        
        C:\Windows\system32\Mfnojh32.exe
        314⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        315⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mnhdae32.exe
        
        C:\Windows\system32\Mnhdae32.exe
        316⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Mcdlil32.exe
        
        C:\Windows\system32\Mcdlil32.exe
        317⤵
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\Mnjqfeld.exe
        
        C:\Windows\system32\Mnjqfeld.exe
        318⤵
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        319⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4044
        
        C:\Windows\SysWOW64\Njhglelp.exe
        
        C:\Windows\system32\Njhglelp.exe
        321⤵
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        322⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        323⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        324⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Offnae32.exe
        
        C:\Windows\system32\Offnae32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Opnbjk32.exe
        
        C:\Windows\system32\Opnbjk32.exe
        326⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ofjgmdgg.exe
        
        C:\Windows\system32\Ofjgmdgg.exe
        327⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pjaciafc.exe
        
        C:\Windows\system32\Pjaciafc.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        329⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Qjdpoacp.exe
        
        C:\Windows\system32\Qjdpoacp.exe
        330⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        331⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Qjfmda32.exe
        
        C:\Windows\system32\Qjfmda32.exe
        332⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        333⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Akiijq32.exe
        
        C:\Windows\system32\Akiijq32.exe
        334⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        335⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        336⤵
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        337⤵
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        338⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Apjkmgjm.exe
        
        C:\Windows\system32\Apjkmgjm.exe
        339⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Amnlfk32.exe
        
        C:\Windows\system32\Amnlfk32.exe
        340⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Ahdpdd32.exe
        
        C:\Windows\system32\Ahdpdd32.exe
        341⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Bonhqnpi.exe
        
        C:\Windows\system32\Bonhqnpi.exe
        342⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Bpodhf32.exe
        
        C:\Windows\system32\Bpodhf32.exe
        343⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Cdmfebnk.exe
        
        C:\Windows\system32\Cdmfebnk.exe
        344⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ckgnbl32.exe
        
        C:\Windows\system32\Ckgnbl32.exe
        345⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Dhphfppl.exe
        
        C:\Windows\system32\Dhphfppl.exe
        346⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        347⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Dkqahk32.exe
        
        C:\Windows\system32\Dkqahk32.exe
        348⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Dqmjqb32.exe
        
        C:\Windows\system32\Dqmjqb32.exe
        349⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Dggbmlba.exe
        
        C:\Windows\system32\Dggbmlba.exe
        350⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Dnajjfjo.exe
        
        C:\Windows\system32\Dnajjfjo.exe
        351⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Eddemo32.exe
        
        C:\Windows\system32\Eddemo32.exe
        352⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Felkmnci.exe
        
        C:\Windows\system32\Felkmnci.exe
        353⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Hlblmd32.exe
        
        C:\Windows\system32\Hlblmd32.exe
        354⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ioebdomd.exe
        
        C:\Windows\system32\Ioebdomd.exe
        355⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Jialbf32.exe
        
        C:\Windows\system32\Jialbf32.exe
        356⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Khbioa32.exe
        
        C:\Windows\system32\Khbioa32.exe
        357⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kakmhg32.exe
        
        C:\Windows\system32\Kakmhg32.exe
        358⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Kplmenpl.exe
        
        C:\Windows\system32\Kplmenpl.exe
        359⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Kidbnd32.exe
        
        C:\Windows\system32\Kidbnd32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4232
        
        C:\Windows\SysWOW64\Kcmfgimm.exe
        
        C:\Windows\system32\Kcmfgimm.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Khiopp32.exe
        
        C:\Windows\system32\Khiopp32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Lcocmi32.exe
        
        C:\Windows\system32\Lcocmi32.exe
        363⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Lhlkep32.exe
        
        C:\Windows\system32\Lhlkep32.exe
        364⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Lcapbi32.exe
        
        C:\Windows\system32\Lcapbi32.exe
        365⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Likhoc32.exe
        
        C:\Windows\system32\Likhoc32.exe
        366⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Lcclhhge.exe
        
        C:\Windows\system32\Lcclhhge.exe
        367⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Lllaqn32.exe
        
        C:\Windows\system32\Lllaqn32.exe
        368⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Laiiie32.exe
        
        C:\Windows\system32\Laiiie32.exe
        369⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Lpjjgl32.exe
        
        C:\Windows\system32\Lpjjgl32.exe
        370⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ljbnpbkl.exe
        
        C:\Windows\system32\Ljbnpbkl.exe
        371⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Mplfll32.exe
        
        C:\Windows\system32\Mplfll32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Mfiodc32.exe
        
        C:\Windows\system32\Mfiodc32.exe
        373⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mpocblpf.exe
        
        C:\Windows\system32\Mpocblpf.exe
        374⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Mjggka32.exe
        
        C:\Windows\system32\Mjggka32.exe
        375⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Mfnhpblk.exe
        
        C:\Windows\system32\Mfnhpblk.exe
        376⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Mcaiif32.exe
        
        C:\Windows\system32\Mcaiif32.exe
        377⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Mljmblae.exe
        
        C:\Windows\system32\Mljmblae.exe
        378⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Mohingqi.exe
        
        C:\Windows\system32\Mohingqi.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Mjnnkpqo.exe
        
        C:\Windows\system32\Mjnnkpqo.exe
        380⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Nbibpb32.exe
        
        C:\Windows\system32\Nbibpb32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4372
        
        C:\Windows\SysWOW64\Nomcig32.exe
        
        C:\Windows\system32\Nomcig32.exe
        382⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Nhegblcd.exe
        
        C:\Windows\system32\Nhegblcd.exe
        383⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Njedlojg.exe
        
        C:\Windows\system32\Njedlojg.exe
        384⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Ocdnedkp.exe
        
        C:\Windows\system32\Ocdnedkp.exe
        385⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Oiagnk32.exe
        
        C:\Windows\system32\Oiagnk32.exe
        386⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Ookokeqd.exe
        
        C:\Windows\system32\Ookokeqd.exe
        387⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Oqkkdh32.exe
        
        C:\Windows\system32\Oqkkdh32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Ofgdmo32.exe
        
        C:\Windows\system32\Ofgdmo32.exe
        389⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Qmphkg32.exe
        
        C:\Windows\system32\Qmphkg32.exe
        390⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Amfokf32.exe
        
        C:\Windows\system32\Amfokf32.exe
        391⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Aadgadai.exe
        
        C:\Windows\system32\Aadgadai.exe
        392⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Afapjk32.exe
        
        C:\Windows\system32\Afapjk32.exe
        393⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Apjdbqfa.exe
        
        C:\Windows\system32\Apjdbqfa.exe
        394⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Bpedoold.exe
        
        C:\Windows\system32\Bpedoold.exe
        395⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Cmlamb32.exe
        
        C:\Windows\system32\Cmlamb32.exe
        396⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ckpagg32.exe
        
        C:\Windows\system32\Ckpagg32.exe
        397⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Cpljonfl.exe
        
        C:\Windows\system32\Cpljonfl.exe
        398⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ckbnlfeb.exe
        
        C:\Windows\system32\Ckbnlfeb.exe
        399⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Calfiq32.exe
        
        C:\Windows\system32\Calfiq32.exe
        400⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Cgioah32.exe
        
        C:\Windows\system32\Cgioah32.exe
        401⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Ccopfi32.exe
        
        C:\Windows\system32\Ccopfi32.exe
        402⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dphikllo.exe
        
        C:\Windows\system32\Dphikllo.exe
        403⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Dgdnmfai.exe
        
        C:\Windows\system32\Dgdnmfai.exe
        404⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Dnnfjp32.exe
        
        C:\Windows\system32\Dnnfjp32.exe
        405⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ddhofjpb.exe
        
        C:\Windows\system32\Ddhofjpb.exe
        406⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Djegoanj.exe
        
        C:\Windows\system32\Djegoanj.exe
        407⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Edklljnp.exe
        
        C:\Windows\system32\Edklljnp.exe
        408⤵
        Modifies registry class
        
        PID:348
        
        C:\Windows\SysWOW64\Ejgddq32.exe
        
        C:\Windows\system32\Ejgddq32.exe
        409⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Edmhai32.exe
        
        C:\Windows\system32\Edmhai32.exe
        410⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Enemjobn.exe
        
        C:\Windows\system32\Enemjobn.exe
        411⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Ecbecfqe.exe
        
        C:\Windows\system32\Ecbecfqe.exe
        412⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Fqmlmiif.exe
        
        C:\Windows\system32\Fqmlmiif.exe
        413⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Fkbpjbil.exe
        
        C:\Windows\system32\Fkbpjbil.exe
        414⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fglndbmn.exe
        
        C:\Windows\system32\Fglndbmn.exe
        415⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Fbaabk32.exe
        
        C:\Windows\system32\Fbaabk32.exe
        416⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Gggmqa32.exe
        
        C:\Windows\system32\Gggmqa32.exe
        417⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Ggjjfq32.exe
        
        C:\Windows\system32\Ggjjfq32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Khoeok32.exe
        
        C:\Windows\system32\Khoeok32.exe
        419⤵
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Mefkdm32.exe
        
        C:\Windows\system32\Mefkdm32.exe
        420⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Nkocib32.exe
        
        C:\Windows\system32\Nkocib32.exe
        421⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nedgfk32.exe
        
        C:\Windows\system32\Nedgfk32.exe
        422⤵
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Nakhkl32.exe
        
        C:\Windows\system32\Nakhkl32.exe
        423⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Nhephfpi.exe
        
        C:\Windows\system32\Nhephfpi.exe
        424⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Nameql32.exe
        
        C:\Windows\system32\Nameql32.exe
        425⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Nlbindfo.exe
        
        C:\Windows\system32\Nlbindfo.exe
        426⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Nbpafkdf.exe
        
        C:\Windows\system32\Nbpafkdf.exe
        427⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Nlefcddl.exe
        
        C:\Windows\system32\Nlefcddl.exe
        428⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Ofmjlj32.exe
        
        C:\Windows\system32\Ofmjlj32.exe
        429⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Oofoeo32.exe
        
        C:\Windows\system32\Oofoeo32.exe
        430⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Odbgmf32.exe
        
        C:\Windows\system32\Odbgmf32.exe
        431⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Oohkko32.exe
        
        C:\Windows\system32\Oohkko32.exe
        432⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Ofbcgifh.exe
        
        C:\Windows\system32\Ofbcgifh.exe
        433⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Okolppdo.exe
        
        C:\Windows\system32\Okolppdo.exe
        434⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ohcmid32.exe
        
        C:\Windows\system32\Ohcmid32.exe
        435⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Oomeenke.exe
        
        C:\Windows\system32\Oomeenke.exe
        436⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ofgmbh32.exe
        
        C:\Windows\system32\Ofgmbh32.exe
        437⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Omqeobjo.exe
        
        C:\Windows\system32\Omqeobjo.exe
        438⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Pbnngi32.exe
        
        C:\Windows\system32\Pbnngi32.exe
        439⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Pigfdcoc.exe
        
        C:\Windows\system32\Pigfdcoc.exe
        440⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Pcmjaloi.exe
        
        C:\Windows\system32\Pcmjaloi.exe
        441⤵
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Pijcjcmq.exe
        
        C:\Windows\system32\Pijcjcmq.exe
        442⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Podkfm32.exe
        
        C:\Windows\system32\Podkfm32.exe
        443⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pfnccg32.exe
        
        C:\Windows\system32\Pfnccg32.exe
        444⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Peemjcop.exe
        
        C:\Windows\system32\Peemjcop.exe
        445⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Qcfmgkgo.exe
        
        C:\Windows\system32\Qcfmgkgo.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2804
        
        C:\Windows\SysWOW64\Qehjoc32.exe
        
        C:\Windows\system32\Qehjoc32.exe
        447⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Afnljenh.exe
        
        C:\Windows\system32\Afnljenh.exe
        448⤵
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Alkdbllo.exe
        
        C:\Windows\system32\Alkdbllo.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4696
        
        C:\Windows\SysWOW64\Apimhjbe.exe
        
        C:\Windows\system32\Apimhjbe.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Bicogo32.exe
        
        C:\Windows\system32\Bicogo32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Bfjlecdj.exe
        
        C:\Windows\system32\Bfjlecdj.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2708
        
        C:\Windows\SysWOW64\Clpgdijg.exe
        
        C:\Windows\system32\Clpgdijg.exe
        453⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Cbjoac32.exe
        
        C:\Windows\system32\Cbjoac32.exe
        454⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Cidgnm32.exe
        
        C:\Windows\system32\Cidgnm32.exe
        455⤵
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\Cpnpjgpn.exe
        
        C:\Windows\system32\Cpnpjgpn.exe
        456⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Depanm32.exe
        
        C:\Windows\system32\Depanm32.exe
        457⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ddqbkebo.exe
        
        C:\Windows\system32\Ddqbkebo.exe
        458⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Dpgbqfhc.exe
        
        C:\Windows\system32\Dpgbqfhc.exe
        459⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Dedkimfj.exe
        
        C:\Windows\system32\Dedkimfj.exe
        460⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Dlnceg32.exe
        
        C:\Windows\system32\Dlnceg32.exe
        461⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Dgcgbp32.exe
        
        C:\Windows\system32\Dgcgbp32.exe
        462⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Dlqpkf32.exe
        
        C:\Windows\system32\Dlqpkf32.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Dcjhhq32.exe
        
        C:\Windows\system32\Dcjhhq32.exe
        464⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Eidqdkkn.exe
        
        C:\Windows\system32\Eidqdkkn.exe
        465⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Edjeacjd.exe
        
        C:\Windows\system32\Edjeacjd.exe
        466⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Eekail32.exe
        
        C:\Windows\system32\Eekail32.exe
        467⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\Epqegd32.exe
        
        C:\Windows\system32\Epqegd32.exe
        468⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Egknco32.exe
        
        C:\Windows\system32\Egknco32.exe
        469⤵
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Epcbldne.exe
        
        C:\Windows\system32\Epcbldne.exe
        470⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Engbehmo.exe
        
        C:\Windows\system32\Engbehmo.exe
        471⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Eebgjk32.exe
        
        C:\Windows\system32\Eebgjk32.exe
        472⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Edcghbbi.exe
        
        C:\Windows\system32\Edcghbbi.exe
        473⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Feddpj32.exe
        
        C:\Windows\system32\Feddpj32.exe
        474⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Flolldpd.exe
        
        C:\Windows\system32\Flolldpd.exe
        475⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Fjgfahji.exe
        
        C:\Windows\system32\Fjgfahji.exe
        476⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Gpfhianp.exe
        
        C:\Windows\system32\Gpfhianp.exe
        477⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Gjnlag32.exe
        
        C:\Windows\system32\Gjnlag32.exe
        478⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Hjgohf32.exe
        
        C:\Windows\system32\Hjgohf32.exe
        479⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hqfqpo32.exe
        
        C:\Windows\system32\Hqfqpo32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Hgpiligj.exe
        
        C:\Windows\system32\Hgpiligj.exe
        481⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Hmmadpea.exe
        
        C:\Windows\system32\Hmmadpea.exe
        482⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hgbfai32.exe
        
        C:\Windows\system32\Hgbfai32.exe
        483⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hnmnocld.exe
        
        C:\Windows\system32\Hnmnocld.exe
        484⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ijhhocnc.exe
        
        C:\Windows\system32\Ijhhocnc.exe
        485⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Ifoicdcg.exe
        
        C:\Windows\system32\Ifoicdcg.exe
        486⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Imiapo32.exe
        
        C:\Windows\system32\Imiapo32.exe
        487⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Jfcbodpb.exe
        
        C:\Windows\system32\Jfcbodpb.exe
        488⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Jcgbhh32.exe
        
        C:\Windows\system32\Jcgbhh32.exe
        489⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Jnmgea32.exe
        
        C:\Windows\system32\Jnmgea32.exe
        490⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jegobkeo.exe
        
        C:\Windows\system32\Jegobkeo.exe
        491⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Jnockqlo.exe
        
        C:\Windows\system32\Jnockqlo.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Jcllcgjf.exe
        
        C:\Windows\system32\Jcllcgjf.exe
        493⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Knkcfobb.exe
        
        C:\Windows\system32\Knkcfobb.exe
        494⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Keekci32.exe
        
        C:\Windows\system32\Keekci32.exe
        495⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Kffhkaom.exe
        
        C:\Windows\system32\Kffhkaom.exe
        496⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Kmpphk32.exe
        
        C:\Windows\system32\Kmpphk32.exe
        497⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Kdjhde32.exe
        
        C:\Windows\system32\Kdjhde32.exe
        498⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kjdqapec.exe
        
        C:\Windows\system32\Kjdqapec.exe
        499⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ldanedho.exe
        
        C:\Windows\system32\Ldanedho.exe
        500⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Moklnm32.exe
        
        C:\Windows\system32\Moklnm32.exe
        501⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Mhdqfbjp.exe
        
        C:\Windows\system32\Mhdqfbjp.exe
        502⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Mmqioi32.exe
        
        C:\Windows\system32\Mmqioi32.exe
        503⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Mopeilpj.exe
        
        C:\Windows\system32\Mopeilpj.exe
        504⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Mejnef32.exe
        
        C:\Windows\system32\Mejnef32.exe
        505⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Mobbnl32.exe
        
        C:\Windows\system32\Mobbnl32.exe
        506⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Meljkeed.exe
        
        C:\Windows\system32\Meljkeed.exe
        507⤵
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Moeock32.exe
        
        C:\Windows\system32\Moeock32.exe
        508⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Mdaglb32.exe
        
        C:\Windows\system32\Mdaglb32.exe
        509⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Noglik32.exe
        
        C:\Windows\system32\Noglik32.exe
        510⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Neadfe32.exe
        
        C:\Windows\system32\Neadfe32.exe
        511⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Ngbpnmgm.exe
        
        C:\Windows\system32\Ngbpnmgm.exe
        512⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Nahdkffc.exe
        
        C:\Windows\system32\Nahdkffc.exe
        513⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ndhnma32.exe
        
        C:\Windows\system32\Ndhnma32.exe
        514⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Nonajj32.exe
        
        C:\Windows\system32\Nonajj32.exe
        515⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Ndkjbq32.exe
        
        C:\Windows\system32\Ndkjbq32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\Noqnpi32.exe
        
        C:\Windows\system32\Noqnpi32.exe
        517⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Oglcdlob.exe
        
        C:\Windows\system32\Oglcdlob.exe
        518⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ohpiinbp.exe
        
        C:\Windows\system32\Ohpiinbp.exe
        519⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Oojaeh32.exe
        
        C:\Windows\system32\Oojaeh32.exe
        520⤵
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Oahnbc32.exe
        
        C:\Windows\system32\Oahnbc32.exe
        521⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Oolnkhgj.exe
        
        C:\Windows\system32\Oolnkhgj.exe
        522⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Pdifcoea.exe
        
        C:\Windows\system32\Pdifcoea.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3932
        
        C:\Windows\SysWOW64\Pookqgeg.exe
        
        C:\Windows\system32\Pookqgeg.exe
        524⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Pgjoejbb.exe
        
        C:\Windows\system32\Pgjoejbb.exe
        525⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Qbifia32.exe
        
        C:\Windows\system32\Qbifia32.exe
        526⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Qgeoah32.exe
        
        C:\Windows\system32\Qgeoah32.exe
        527⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Affoopqd.exe
        
        C:\Windows\system32\Affoopqd.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1200
        
        C:\Windows\SysWOW64\Aooche32.exe
        
        C:\Windows\system32\Aooche32.exe
        529⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Adllplel.exe
        
        C:\Windows\system32\Adllplel.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Aoapmeeb.exe
        
        C:\Windows\system32\Aoapmeeb.exe
        531⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Aofjhd32.exe
        
        C:\Windows\system32\Aofjhd32.exe
        532⤵
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Aohfnd32.exe
        
        C:\Windows\system32\Aohfnd32.exe
        533⤵
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Biqkgi32.exe
        
        C:\Windows\system32\Biqkgi32.exe
        534⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Bokcccmg.exe
        
        C:\Windows\system32\Bokcccmg.exe
        535⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Bichli32.exe
        
        C:\Windows\system32\Bichli32.exe
        536⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bpmpickd.exe
        
        C:\Windows\system32\Bpmpickd.exe
        537⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Bihaghob.exe
        
        C:\Windows\system32\Bihaghob.exe
        538⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Bpdfjbel.exe
        
        C:\Windows\system32\Bpdfjbel.exe
        539⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Cfnnfl32.exe
        
        C:\Windows\system32\Cfnnfl32.exe
        540⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Cpfcobbj.exe
        
        C:\Windows\system32\Cpfcobbj.exe
        541⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Cfpkll32.exe
        
        C:\Windows\system32\Cfpkll32.exe
        542⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Clmcdc32.exe
        
        C:\Windows\system32\Clmcdc32.exe
        543⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Cbglam32.exe
        
        C:\Windows\system32\Cbglam32.exe
        544⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Chddid32.exe
        
        C:\Windows\system32\Chddid32.exe
        545⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Cnnlfneo.exe
        
        C:\Windows\system32\Cnnlfneo.exe
        546⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Cicqcgee.exe
        
        C:\Windows\system32\Cicqcgee.exe
        547⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Cfgamk32.exe
        
        C:\Windows\system32\Cfgamk32.exe
        548⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Chhndcjm.exe
        
        C:\Windows\system32\Chhndcjm.exe
        549⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Dijgdfom.exe
        
        C:\Windows\system32\Dijgdfom.exe
        550⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Dhdmpapp.exe
        
        C:\Windows\system32\Dhdmpapp.exe
        551⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Efemni32.exe
        
        C:\Windows\system32\Efemni32.exe
        552⤵
        
        PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaldngqg.exe

Filesize
64KB

MD5
dea23a33a777ac30ec6045b2863a9c2a

SHA1
6f9b6dc0be1e321a3b6d9e61ff638723b18b2fee

SHA256
667c4458d87bba4878c6186010bf1d353c1b9f1787d7dab49e954ea4c7118f0b

SHA512
6656449ab4bb3a2f630cfd44c94140fe890ef8e6abbdfe18bbbde8605b0809efd98f32c3815270befcff4e3b3398dc98ef4cb7852dbcb9db9f0a4272490758cb

Download Submit
C:\Windows\SysWOW64\Adpogp32.exe

Filesize
109KB

MD5
9ecf74ccceb15cd8c907d405383de1cc

SHA1
639369730394b30458b49132c9f65e15250aa0c9

SHA256
d147c8fd1e024ac7d519145d9e55867f9f368b508614acf60d1e797eae6b81a9

SHA512
9acdc48772f25dc8e9135d85d65afc21a654ad719a36b2c94045ac462ae01e15b886bbf747e7edc4994b4e3a976a5ef92ac62959faae875cb4ae2d6c6cd6e0fb

Download Submit
C:\Windows\SysWOW64\Adpogp32.exe

Filesize
109KB

MD5
9ecf74ccceb15cd8c907d405383de1cc

SHA1
639369730394b30458b49132c9f65e15250aa0c9

SHA256
d147c8fd1e024ac7d519145d9e55867f9f368b508614acf60d1e797eae6b81a9

SHA512
9acdc48772f25dc8e9135d85d65afc21a654ad719a36b2c94045ac462ae01e15b886bbf747e7edc4994b4e3a976a5ef92ac62959faae875cb4ae2d6c6cd6e0fb

Download Submit
C:\Windows\SysWOW64\Afapjk32.exe

Filesize
109KB

MD5
9a882c6d8134a1d3c79a5aa9e7601502

SHA1
f4a909377783ee23a84748df3037e3a41521b7bb

SHA256
e854abf2b230c0d56e5d657e198032a6d652549497bbac0931157dc36bd69587

SHA512
09a57de8cd40bde7f6f01468879ee2764e98f2ba3ccc7e4b5582885d8b4db2bc0140dc41c4fb278ab376d521305d886aa98374c995cd8fdf1788ed17226ec246

Download Submit
C:\Windows\SysWOW64\Ajaqjfbp.exe

Filesize
109KB

MD5
4052d09f6007789e01608c181174888a

SHA1
ec6bd39c0bb4674a172e00084b7dab2a3fe83d80

SHA256
06e2a2c137c100b10f8a4bb5e9b09b6f997049e2fba33b3a805f6cd7b0dd9017

SHA512
040d89146e69745247afdf47afd68a797063626463c7d039cb05aa6093b1cf5482560a75dfb375363c3df2f040d95a251c843ce0ebb44f38fdc5f425af49d2c8

Download Submit
C:\Windows\SysWOW64\Ajaqjfbp.exe

Filesize
109KB

MD5
4052d09f6007789e01608c181174888a

SHA1
ec6bd39c0bb4674a172e00084b7dab2a3fe83d80

SHA256
06e2a2c137c100b10f8a4bb5e9b09b6f997049e2fba33b3a805f6cd7b0dd9017

SHA512
040d89146e69745247afdf47afd68a797063626463c7d039cb05aa6093b1cf5482560a75dfb375363c3df2f040d95a251c843ce0ebb44f38fdc5f425af49d2c8

Download Submit
C:\Windows\SysWOW64\Bgjjoi32.exe

Filesize
109KB

MD5
e6dc6ec72419bef1fb4669f913b656bc

SHA1
7bd9113bee4c7dd31c9d32815ce96464009981cf

SHA256
f2312979f26b37f043055d96b67cfccbdc51c3c905a2e2152fc1019956d2b34f

SHA512
ffd5c02ab5ecd2ff5b5a10a7c0ae8470674f4a12a225b0b17039f599b27e358525e7b68fe9d7f9401904d278e5f4f1c52bb17b8779e273d2ca57ebfe8f62505f

Download Submit
C:\Windows\SysWOW64\Bgjjoi32.exe

Filesize
109KB

MD5
e6dc6ec72419bef1fb4669f913b656bc

SHA1
7bd9113bee4c7dd31c9d32815ce96464009981cf

SHA256
f2312979f26b37f043055d96b67cfccbdc51c3c905a2e2152fc1019956d2b34f

SHA512
ffd5c02ab5ecd2ff5b5a10a7c0ae8470674f4a12a225b0b17039f599b27e358525e7b68fe9d7f9401904d278e5f4f1c52bb17b8779e273d2ca57ebfe8f62505f

Download Submit
C:\Windows\SysWOW64\Cfgamk32.exe

Filesize
109KB

MD5
ffe96409eab8a7751c24ad3b6abc89d0

SHA1
81a4dd95b61513f135fd40051b9782f1d9472a39

SHA256
f269729da30eb95e7c3eebf030333f28240cee50697f1a65ce2981236b40a97e

SHA512
38ad57550dc16fc12539f4e150f12f7e0da51c9121336a4f413e8f29a336237b87f8256d9ce9ef2edc8de3dd2db21661b0c0d15b65f1a17eebb58290c8431b2f

Download Submit
C:\Windows\SysWOW64\Cnmebblf.exe

Filesize
109KB

MD5
ff5363e7ddc354fca1aa6bd70347ab79

SHA1
886fdb72a68a14633f37aefb02260fd8ceb1168b

SHA256
cb1b33472a95accd217afc43313851651eacb3f56e9a111385b7c9b4350571aa

SHA512
ba3826f62a6a9fe155084f451254587ad7b140841b8c1d32b3d579ec4656083d628d377765c1c041f7f3f7d6c863f63704972b4774d0dc3f450e612193a57cf4

Download Submit
C:\Windows\SysWOW64\Cnmebblf.exe

Filesize
109KB

MD5
ff5363e7ddc354fca1aa6bd70347ab79

SHA1
886fdb72a68a14633f37aefb02260fd8ceb1168b

SHA256
cb1b33472a95accd217afc43313851651eacb3f56e9a111385b7c9b4350571aa

SHA512
ba3826f62a6a9fe155084f451254587ad7b140841b8c1d32b3d579ec4656083d628d377765c1c041f7f3f7d6c863f63704972b4774d0dc3f450e612193a57cf4

Download Submit
C:\Windows\SysWOW64\Dabhomea.exe

Filesize
109KB

MD5
c4f2915b5ea64643087578945e2868d5

SHA1
8b6ff58946573e31e0b33007c719fc52a83f72ac

SHA256
556b9977c4068683468bb47eb6947eedae7f9f9b46f32f3a1b68b0b5706d4d88

SHA512
c5c84df8e8db6f5be7c1b9015c2f50fe81e6ea23cb7c911eb93c668940aee04c63cacb46389150aff48b3ba475629029e18a499ea6ee986a73ade1446d1690ad

Download Submit
C:\Windows\SysWOW64\Dabhomea.exe

Filesize
109KB

MD5
c4f2915b5ea64643087578945e2868d5

SHA1
8b6ff58946573e31e0b33007c719fc52a83f72ac

SHA256
556b9977c4068683468bb47eb6947eedae7f9f9b46f32f3a1b68b0b5706d4d88

SHA512
c5c84df8e8db6f5be7c1b9015c2f50fe81e6ea23cb7c911eb93c668940aee04c63cacb46389150aff48b3ba475629029e18a499ea6ee986a73ade1446d1690ad

Download Submit
C:\Windows\SysWOW64\Dbckcf32.exe

Filesize
109KB

MD5
b831b6c0383e9675bdb5950a391b8ee6

SHA1
bb5438d55e4e8d831d899f8173d9cb4aee75d8be

SHA256
c40cd30bb1ba7db3e1380efbc98acb06eb19c59aeeec47d50da5343af7a14c0d

SHA512
040badb62a04f88e71f233e11a1edb66b0fda88bd34a01455d4437b44931e99a802bfb0d8e5be2af161d23182900bafba498b077e51f18ab3976942a0780d8c5

Download Submit
C:\Windows\SysWOW64\Dbckcf32.exe

Filesize
109KB

MD5
b831b6c0383e9675bdb5950a391b8ee6

SHA1
bb5438d55e4e8d831d899f8173d9cb4aee75d8be

SHA256
c40cd30bb1ba7db3e1380efbc98acb06eb19c59aeeec47d50da5343af7a14c0d

SHA512
040badb62a04f88e71f233e11a1edb66b0fda88bd34a01455d4437b44931e99a802bfb0d8e5be2af161d23182900bafba498b077e51f18ab3976942a0780d8c5

Download Submit
C:\Windows\SysWOW64\Dgomaf32.exe

Filesize
109KB

MD5
94100711f439cb62adbd1c5226423bc4

SHA1
6d7286bea16bd2a774933aeed9b1fa25950a2139

SHA256
deadbcc9dd01cbbfcb8ca1caa498a71de06e768dc3cb28c66771c619183ffaed

SHA512
b75ea88f7501e8069c59399f7554cf4c26721fed6bf0b5765992c84be026e5f4c6748e6cbe3fde01cb9bc0a8845b0728e5cfb32f8615248a22f01494b805ff3d

Download Submit
C:\Windows\SysWOW64\Dgomaf32.exe

Filesize
109KB

MD5
94100711f439cb62adbd1c5226423bc4

SHA1
6d7286bea16bd2a774933aeed9b1fa25950a2139

SHA256
deadbcc9dd01cbbfcb8ca1caa498a71de06e768dc3cb28c66771c619183ffaed

SHA512
b75ea88f7501e8069c59399f7554cf4c26721fed6bf0b5765992c84be026e5f4c6748e6cbe3fde01cb9bc0a8845b0728e5cfb32f8615248a22f01494b805ff3d

Download Submit
C:\Windows\SysWOW64\Dhcfleff.exe

Filesize
109KB

MD5
2a114564c997c9c9428fcfbacd757726

SHA1
d0e6ac193a50583160805073534d5caa70ed4577

SHA256
2d6fbcf4c81e651fa39626fe1cdebfcd0c7acdf35ac6c51ac37545e0791fad20

SHA512
b484be8247fcc783338393cf860cc62c49c4e62e25b378f110833322f5dc400f94ea593ee31a42ffca8666ae0e9f525760b39e935a5d4702687f376dd23eb8ea

Download Submit
C:\Windows\SysWOW64\Dhcfleff.exe

Filesize
109KB

MD5
2a114564c997c9c9428fcfbacd757726

SHA1
d0e6ac193a50583160805073534d5caa70ed4577

SHA256
2d6fbcf4c81e651fa39626fe1cdebfcd0c7acdf35ac6c51ac37545e0791fad20

SHA512
b484be8247fcc783338393cf860cc62c49c4e62e25b378f110833322f5dc400f94ea593ee31a42ffca8666ae0e9f525760b39e935a5d4702687f376dd23eb8ea

Download Submit
C:\Windows\SysWOW64\Djklgb32.exe

Filesize
109KB

MD5
56008e43b7281ef1a5ac165bc519660c

SHA1
010c93de0d752f9230322d060529178a97a8ecbd

SHA256
6af9e40a33c89adcf149d50583d61122d99d8ad30c4c6da15392231a813a97c6

SHA512
cead236029576db63f1a2f7b8a0ae67051c6b673eaf68bc3009b78bfc0b03065f2bdd7403c27403e03ae6ada294306e7fb52a2e4ccfa74910bcf9518a8d53323

Download Submit
C:\Windows\SysWOW64\Djklgb32.exe

Filesize
109KB

MD5
56008e43b7281ef1a5ac165bc519660c

SHA1
010c93de0d752f9230322d060529178a97a8ecbd

SHA256
6af9e40a33c89adcf149d50583d61122d99d8ad30c4c6da15392231a813a97c6

SHA512
cead236029576db63f1a2f7b8a0ae67051c6b673eaf68bc3009b78bfc0b03065f2bdd7403c27403e03ae6ada294306e7fb52a2e4ccfa74910bcf9518a8d53323

Download Submit
C:\Windows\SysWOW64\Emhmkh32.exe

Filesize
109KB

MD5
91de3e12542b809732183fd2f53f994b

SHA1
045606a99f8878526d8d9cdd09606cc5497dcbca

SHA256
53b929764891ea99e8405e6699496168fb0b77efa302e6c5bf232ac9cd2bf815

SHA512
1178ff97fc58286f4f6b028331e0879100b00efcb2b2aa1bd1c518df45cb5031359ae32351d4638f6f08f31aad8969249b50a9d29ee45ba3990bc746f32fe3e3

Download Submit
C:\Windows\SysWOW64\Encgdbqd.exe

Filesize
109KB

MD5
2d5bf84d0258d39e3ab12b87f803ee2a

SHA1
f1443c222fb1a8aee4656fe72fe00c317d32690b

SHA256
52c8f047c83f1264e1c97d90e89326651054d1946c5d4d8276e57d4211276616

SHA512
50209249c669a51b4a9b853e57ac43bd07679e253b201ad2732daf96193aa4e6364f63027030bb4cc6e7c94d7330b786d753975b0cdfc77dae62038f5197c027

Download Submit
C:\Windows\SysWOW64\Eofgioah.exe

Filesize
109KB

MD5
13fb1622673931a057fb7394025a2a64

SHA1
cc8a6ccf6457013c3ff75520e884b827e80a366c

SHA256
b1cfcdd9b6f845da63e3bd4d4821795b99ab2a64a49e50bbbfae3e1ba148d933

SHA512
63c85a2898423b499f6dfa87d0c442cfb662fcf969faae7052ddd2ea0e493fdbf60e864d4158e25e39f755067517168af69e20c6978224229379744fb2992270

Download Submit
C:\Windows\SysWOW64\Felkmnci.exe

Filesize
109KB

MD5
1c2ed525c8a1b13dfb0a19d58548f4fc

SHA1
4e3f93acdaaceb03561494fb6cb9236ef72df2d1

SHA256
e975fbc764732c215fc8b2040ca7c10a3ff569e516f45db3ccd804548d351faf

SHA512
52457b5a5f03ed390268621a3e5ce33af0b22e1be31126ccd8d5309f43465223521d6e4f98354cc1b931ec560220d89a2c40d4309aa6ecbb1a27dc0bb72b7acd

Download Submit
C:\Windows\SysWOW64\Fhablf32.exe

Filesize
109KB

MD5
513f7337182564b0b9dcc6f68d0f15eb

SHA1
9e27f9b5676878eff1f05d0c2dd73f21477f482b

SHA256
6fde5d32d922e306b557445db7cf7adb336ece5e3dc5c4e13e8744d647321846

SHA512
9ee07086ecdfa5e0cdf83ab3a764a6b3b03ddd42a4a42284748910f2341dd9ff77418cb9979102a135163f219aeadd2192d8bc129dde87c372268fb76cce91fc

Download Submit
C:\Windows\SysWOW64\Fhflhcfa.exe

Filesize
109KB

MD5
e47e4e481c0fe9a6b38f5912df2308fa

SHA1
1f13d0b9b32abea5496eccefb70d68f1ac926e08

SHA256
f37f106e18f44b0543ce5f694eca8190703ac414f3f95ae3608249533d2ee957

SHA512
02a689264e659147f258f23abe739b249d7e1b5adefc125d89b2b06209e52dd7b9ec150acfad5dec88e5cf76cb386658c34d5e1569f0bc344e84e264631e9856

Download Submit
C:\Windows\SysWOW64\Fhflhcfa.exe

Filesize
109KB

MD5
e47e4e481c0fe9a6b38f5912df2308fa

SHA1
1f13d0b9b32abea5496eccefb70d68f1ac926e08

SHA256
f37f106e18f44b0543ce5f694eca8190703ac414f3f95ae3608249533d2ee957

SHA512
02a689264e659147f258f23abe739b249d7e1b5adefc125d89b2b06209e52dd7b9ec150acfad5dec88e5cf76cb386658c34d5e1569f0bc344e84e264631e9856

Download Submit
C:\Windows\SysWOW64\Flmonbbp.exe

Filesize
109KB

MD5
d12f1ca5f73d6bc8de4a2be8d6230880

SHA1
97f8546bcf64e6e49b48c36f8e821abe6dfdd23d

SHA256
846ac03383d9df78806b5146dacffc5f098f55a9a6f2d9e473ab7f56e2f0b02d

SHA512
a840e5ed15e7c76bc917bb67526d5f3817d73be3d99ecf0b79dc9f760a8876bd13ffd73cf793f759e00e50ae0fb8de2c7d711907ba32d71986ab3713e84366e8

Download Submit
C:\Windows\SysWOW64\Flmonbbp.exe

Filesize
109KB

MD5
d12f1ca5f73d6bc8de4a2be8d6230880

SHA1
97f8546bcf64e6e49b48c36f8e821abe6dfdd23d

SHA256
846ac03383d9df78806b5146dacffc5f098f55a9a6f2d9e473ab7f56e2f0b02d

SHA512
a840e5ed15e7c76bc917bb67526d5f3817d73be3d99ecf0b79dc9f760a8876bd13ffd73cf793f759e00e50ae0fb8de2c7d711907ba32d71986ab3713e84366e8

Download Submit
C:\Windows\SysWOW64\Fongpm32.exe

Filesize
109KB

MD5
e52bd104fe0ea694832156712ae1bb3a

SHA1
e1e8d6c4d5c657b77841081e51247aa4ad49f19c

SHA256
3341291715f60b89a4b99c67d7b9187763b46b0da1f60009ef589f836566b126

SHA512
51b95a55b12f25d3d560025da03ee99e3f88465df88be968101cb2a5753ccd41fa3d53c27af93adfc193f201f30e53ecfe69ca7b4c35eb556720024c8c763589

Download Submit
C:\Windows\SysWOW64\Fongpm32.exe

Filesize
109KB

MD5
e52bd104fe0ea694832156712ae1bb3a

SHA1
e1e8d6c4d5c657b77841081e51247aa4ad49f19c

SHA256
3341291715f60b89a4b99c67d7b9187763b46b0da1f60009ef589f836566b126

SHA512
51b95a55b12f25d3d560025da03ee99e3f88465df88be968101cb2a5753ccd41fa3d53c27af93adfc193f201f30e53ecfe69ca7b4c35eb556720024c8c763589

Download Submit
C:\Windows\SysWOW64\Ghbkdald.exe

Filesize
109KB

MD5
01525c1f2c4fdb48e907f59daa6ec5e1

SHA1
edd8e329e47176bb20ca073bda301daabfa8c50c

SHA256
066dab91ce962c07e6b629dd6dc184487e40c3d110585c963f02210c674451a9

SHA512
9284ce2feefd47ac35404814a07e301950c277e2049356e346a70a8f12813e14c81ab01d31df41a09cfb5404400d824a621b6f2a628c7e64d1e72dcac88ebfff

Download Submit
C:\Windows\SysWOW64\Ghbkdald.exe

Filesize
109KB

MD5
01525c1f2c4fdb48e907f59daa6ec5e1

SHA1
edd8e329e47176bb20ca073bda301daabfa8c50c

SHA256
066dab91ce962c07e6b629dd6dc184487e40c3d110585c963f02210c674451a9

SHA512
9284ce2feefd47ac35404814a07e301950c277e2049356e346a70a8f12813e14c81ab01d31df41a09cfb5404400d824a621b6f2a628c7e64d1e72dcac88ebfff

Download Submit
C:\Windows\SysWOW64\Ginenk32.exe

Filesize
109KB

MD5
eb2e543c0b12fa444822cdddb7b06c76

SHA1
d62f01c8ff11f8bcf232fe90b2d3e2291ea0cf94

SHA256
270c57eef216c6edb24aac197bdec18f0b7153bec5d8faa07a4118ce0b865a6f

SHA512
318e1c25c9a9d8edaae34a85a9a440aef95eddede9715f2796c99bc2ca44cb5e8ed959addfbda904d6a03d9f3aebbf570efc69234b2eb394e48523ee99eec4f2

Download Submit
C:\Windows\SysWOW64\Ginenk32.exe

Filesize
109KB

MD5
eb2e543c0b12fa444822cdddb7b06c76

SHA1
d62f01c8ff11f8bcf232fe90b2d3e2291ea0cf94

SHA256
270c57eef216c6edb24aac197bdec18f0b7153bec5d8faa07a4118ce0b865a6f

SHA512
318e1c25c9a9d8edaae34a85a9a440aef95eddede9715f2796c99bc2ca44cb5e8ed959addfbda904d6a03d9f3aebbf570efc69234b2eb394e48523ee99eec4f2

Download Submit
C:\Windows\SysWOW64\Gklnem32.exe

Filesize
109KB

MD5
e8177268e1a186cbb5a4f4bef3a6f49c

SHA1
ea69f50ce77a08bd3a4130ff6f9e1239a7fa6836

SHA256
2c7a9c1dffbd6ac17f5f55a1006f4c652219933c5d553b857dd69e3250639b9e

SHA512
30697033ea75a2f6a99aefdb8fc9cbf8f3bfc61887ce92ca080ab0b6312d7c169b567e7b51e932780f001c81323ea415425dee2bca43dbca0733add2654e51ac

Download Submit
C:\Windows\SysWOW64\Gklnem32.exe

Filesize
109KB

MD5
e8177268e1a186cbb5a4f4bef3a6f49c

SHA1
ea69f50ce77a08bd3a4130ff6f9e1239a7fa6836

SHA256
2c7a9c1dffbd6ac17f5f55a1006f4c652219933c5d553b857dd69e3250639b9e

SHA512
30697033ea75a2f6a99aefdb8fc9cbf8f3bfc61887ce92ca080ab0b6312d7c169b567e7b51e932780f001c81323ea415425dee2bca43dbca0733add2654e51ac

Download Submit
C:\Windows\SysWOW64\Gohapb32.exe

Filesize
109KB

MD5
1c94d231db9ffe7ee910f46a1be837c5

SHA1
70a84a5e2cc93c5c8e8e0680081622cf4201b6ae

SHA256
6e607776067d1f0553eae7e78ae44ae4b4e356b2deedc2b06410bbe82fb65eb1

SHA512
85ba7475044ba01694fddd21ada7dd636c1688d620802c4fe143c03ceb3c37571ea0eae07ecaf6d086d0f917a721ba291e18f9269861a11fc4d8575a43b9cac1

Download Submit
C:\Windows\SysWOW64\Gohapb32.exe

Filesize
109KB

MD5
1c94d231db9ffe7ee910f46a1be837c5

SHA1
70a84a5e2cc93c5c8e8e0680081622cf4201b6ae

SHA256
6e607776067d1f0553eae7e78ae44ae4b4e356b2deedc2b06410bbe82fb65eb1

SHA512
85ba7475044ba01694fddd21ada7dd636c1688d620802c4fe143c03ceb3c37571ea0eae07ecaf6d086d0f917a721ba291e18f9269861a11fc4d8575a43b9cac1

Download Submit
C:\Windows\SysWOW64\Hcabhido.exe

Filesize
109KB

MD5
02c5ae8b0c26d42d1c8f420c7b90b6f9

SHA1
0b6954875922391b051e93f7c05dbdac7e003075

SHA256
00551d08d3f05696b899f2cf7e4af6c65548526d4ce1b913cd75ba0b025e7776

SHA512
1f0bb25dac920f64ce263fd93ae391ef0602505b8c13229cf56382c0a53ea6a854406251c0bbb90ff1d9095ca8eac9dde7b50f5311fb2223c65e9756dad9ed68

Download Submit
C:\Windows\SysWOW64\Hcabhido.exe

Filesize
109KB

MD5
5d5f63dc6aefa73bac015f5107fa31fa

SHA1
7f9c27065ff57af6bc7931001226255ad4f564a2

SHA256
958c680e82b278ec6ce556dee9ea77efb020e0d5124bf9d95b1e600c8d57b9a0

SHA512
962c1345a3b7ff0624a00e4034e94ead93058bf2964b75e5be6344ce88a23fdd156edbbfefac7e46dd7de67c48acb25ea82a02f943421a69b5ea6d34baaf6455

Download Submit
C:\Windows\SysWOW64\Hcabhido.exe

Filesize
109KB

MD5
5d5f63dc6aefa73bac015f5107fa31fa

SHA1
7f9c27065ff57af6bc7931001226255ad4f564a2

SHA256
958c680e82b278ec6ce556dee9ea77efb020e0d5124bf9d95b1e600c8d57b9a0

SHA512
962c1345a3b7ff0624a00e4034e94ead93058bf2964b75e5be6344ce88a23fdd156edbbfefac7e46dd7de67c48acb25ea82a02f943421a69b5ea6d34baaf6455

Download Submit
C:\Windows\SysWOW64\Hcaibo32.exe

Filesize
109KB

MD5
0471ba7439fe40afcd1ebd50a2e83f7c

SHA1
932f5d5036781a05fae0acd1050ba3e5005bdc42

SHA256
3931f8870a8fe041eca8ef0f4abf260b6b08a68ea5aceba13032a6246672d030

SHA512
dd90fc1ba3e3815e8f44f6b52739111e79eaf6db4a0c2c830a255a3be988e3ecb71c684aa22620f204d0239258a5732b546cf96338c5e990e846f423ad1dc3db

Download Submit
C:\Windows\SysWOW64\Hcaibo32.exe

Filesize
109KB

MD5
7b4c6dd28a62307c12c559edcdc414a9

SHA1
48aad9fef42e1d519318308cd668886e88c53814

SHA256
a90cea78918b0669b539a979ccb7dd3fa63ef46ad1145e4a78f8970c8bcc690b

SHA512
18c9cf20c4d058c176cf07667511fb7e61e226c1553caad933734deedfdbff95d1950e497b45b2ce16e6cab570e34078ed6d8902f315b21f0b871d0eeffa28cf

Download Submit
C:\Windows\SysWOW64\Hcaibo32.exe

Filesize
109KB

MD5
7b4c6dd28a62307c12c559edcdc414a9

SHA1
48aad9fef42e1d519318308cd668886e88c53814

SHA256
a90cea78918b0669b539a979ccb7dd3fa63ef46ad1145e4a78f8970c8bcc690b

SHA512
18c9cf20c4d058c176cf07667511fb7e61e226c1553caad933734deedfdbff95d1950e497b45b2ce16e6cab570e34078ed6d8902f315b21f0b871d0eeffa28cf

Download Submit
C:\Windows\SysWOW64\Hcefei32.dll

Filesize
7KB

MD5
2f0f1492f104a60a3218d525b96555db

SHA1
a7b9a1d693ba6412b730a81aa84e602620c268ac

SHA256
cd7cc816c22ca7d281ed37b6e7dc25a4c085e8707f999668101317966f57a123

SHA512
8a13980f05af34ac5160099221f10c037d2ce5787d39ea11958f6d2ccfb99a0fdf45485896a9aa9b533055300936b29aeba7ddbfab5ef37c28f23ce140e99eeb

Download Submit
C:\Windows\SysWOW64\Hcflch32.exe

Filesize
109KB

MD5
c3d00ecf8f18dee55d51eca714dbd812

SHA1
1893e7a2dd789bae8a8050e08104e82c2c188c16

SHA256
eba90b6e0611d2143bb54cd2a2acf80ee442c1adb3077b99e14fe9e3330e98a2

SHA512
b0e977c865507b72ab971aacdf449310c403c3815af8c4c3f3615f99ba42104e1e75a59745aeb5d0838e1edb2ea6068b97f2f8ed88d6b8348bd4a265eda5cf9f

Download Submit
C:\Windows\SysWOW64\Hcflch32.exe

Filesize
109KB

MD5
c3d00ecf8f18dee55d51eca714dbd812

SHA1
1893e7a2dd789bae8a8050e08104e82c2c188c16

SHA256
eba90b6e0611d2143bb54cd2a2acf80ee442c1adb3077b99e14fe9e3330e98a2

SHA512
b0e977c865507b72ab971aacdf449310c403c3815af8c4c3f3615f99ba42104e1e75a59745aeb5d0838e1edb2ea6068b97f2f8ed88d6b8348bd4a265eda5cf9f

Download Submit
C:\Windows\SysWOW64\Hebkid32.exe

Filesize
109KB

MD5
e26405748981d3a9fb672fd219311d3f

SHA1
1cd40322351a6ca80be8547e3888fa0d15e125e0

SHA256
5ca9aa139721521dce28973a7006281f4ec7c42c23b75058eca452ba021d62b4

SHA512
387a5a0b0569ab3b8df6003f07d4e4cb5366ab12aa86d46779e3b2d545d4f3c6ea32ced5370a32455c290a3c744288440f124c6d0ed21b9a5b57775fa680ffb6

Download Submit
C:\Windows\SysWOW64\Hebkid32.exe

Filesize
109KB

MD5
e26405748981d3a9fb672fd219311d3f

SHA1
1cd40322351a6ca80be8547e3888fa0d15e125e0

SHA256
5ca9aa139721521dce28973a7006281f4ec7c42c23b75058eca452ba021d62b4

SHA512
387a5a0b0569ab3b8df6003f07d4e4cb5366ab12aa86d46779e3b2d545d4f3c6ea32ced5370a32455c290a3c744288440f124c6d0ed21b9a5b57775fa680ffb6

Download Submit
C:\Windows\SysWOW64\Hklglk32.exe

Filesize
109KB

MD5
f7b2bb25b7645e9b5c6b751ab86865c0

SHA1
dde9af174c9ff531b822bd19dd01516aba2813aa

SHA256
bc33387f9be2d81b41b264eabddc237e5ae0d20dee83f2af0d353f5e78e4e7c0

SHA512
722ef3a8521cff945641117fef3f007b79965e8167fe77426d9a51bc6b7e12599ce8021e07a192485c4c475350f82202c139cca295ac1aa9f9d708834bcd84d0

Download Submit
C:\Windows\SysWOW64\Hklglk32.exe

Filesize
109KB

MD5
f7b2bb25b7645e9b5c6b751ab86865c0

SHA1
dde9af174c9ff531b822bd19dd01516aba2813aa

SHA256
bc33387f9be2d81b41b264eabddc237e5ae0d20dee83f2af0d353f5e78e4e7c0

SHA512
722ef3a8521cff945641117fef3f007b79965e8167fe77426d9a51bc6b7e12599ce8021e07a192485c4c475350f82202c139cca295ac1aa9f9d708834bcd84d0

Download Submit
C:\Windows\SysWOW64\Idfhibdn.exe

Filesize
109KB

MD5
776740d125ca5223628994302eabfc21

SHA1
d0b2e44e85bbf0fbd3c9a89f1857960083d6002e

SHA256
41da9e9226232cd6bf86491aae8a9742af938031144880c8adb40001c4d52570

SHA512
8103e81c85f32bea82e686aa285a6461250132084e88c848fee2f15e2e4f31a3d933afa72a5fe0c7c485dbb51fdb1ab6e00ab1d9870d75cd780950a2457c05f8

Download Submit
C:\Windows\SysWOW64\Igpkok32.exe

Filesize
109KB

MD5
b9ae9921c6dbb9eb04e78f629b4b5bed

SHA1
879562b83444aad85cf9ac7e89cd34a45b245190

SHA256
9fbe11340caf9940436d3a7ddf30da8fb87a3085ee37fe36cea04d3307dfa820

SHA512
d32e1f7af047429104a7341e5327e043419a9ab0b279e7867df10cf5f207a74fecaf1d2f4a2e41731229e29d3728cd53b0b2368af2e3ee6642571ff5e70f7451

Download Submit
C:\Windows\SysWOW64\Igpkok32.exe

Filesize
109KB

MD5
b9ae9921c6dbb9eb04e78f629b4b5bed

SHA1
879562b83444aad85cf9ac7e89cd34a45b245190

SHA256
9fbe11340caf9940436d3a7ddf30da8fb87a3085ee37fe36cea04d3307dfa820

SHA512
d32e1f7af047429104a7341e5327e043419a9ab0b279e7867df10cf5f207a74fecaf1d2f4a2e41731229e29d3728cd53b0b2368af2e3ee6642571ff5e70f7451

Download Submit
C:\Windows\SysWOW64\Ijlkfg32.exe

Filesize
109KB

MD5
415f61525114f129f15483212f7f4dc7

SHA1
a383cc9dfc656250fde64ae10a517866341f382c

SHA256
f403d1d1c8779b05bef1dc2f75a1c925ef0650eaf28e8164fec7f2f9e946674f

SHA512
90ec3afe1202fcc6ef7159d858799fa70272a3171fae928d428911e95eab246b413da588d6d607dc14180544d7b9f5b6c1aa5a2bb9cee667e439a19a591194ec

Download Submit
C:\Windows\SysWOW64\Ijlkfg32.exe

Filesize
109KB

MD5
415f61525114f129f15483212f7f4dc7

SHA1
a383cc9dfc656250fde64ae10a517866341f382c

SHA256
f403d1d1c8779b05bef1dc2f75a1c925ef0650eaf28e8164fec7f2f9e946674f

SHA512
90ec3afe1202fcc6ef7159d858799fa70272a3171fae928d428911e95eab246b413da588d6d607dc14180544d7b9f5b6c1aa5a2bb9cee667e439a19a591194ec

Download Submit
C:\Windows\SysWOW64\Jflnafno.exe

Filesize
109KB

MD5
0d666d627f5672fbcf0215f49f43008f

SHA1
ff3322aabbe9f77adda1ad38dbe6e64f8bef80cf

SHA256
ac9e45e9fe7ac05d6e8b257af29995388d27ebf98599210731c8e5c18b38cc2d

SHA512
ca26525b35ae0f3693b1916997c3dad6f8e56a6cab37e0e3d51a02c9e48d7cbc1e9637a92db5ec692d5e7e256cdb72f8ceade87f9db889ba78fce6adc85fdfa8

Download Submit
C:\Windows\SysWOW64\Jflnafno.exe

Filesize
109KB

MD5
0d666d627f5672fbcf0215f49f43008f

SHA1
ff3322aabbe9f77adda1ad38dbe6e64f8bef80cf

SHA256
ac9e45e9fe7ac05d6e8b257af29995388d27ebf98599210731c8e5c18b38cc2d

SHA512
ca26525b35ae0f3693b1916997c3dad6f8e56a6cab37e0e3d51a02c9e48d7cbc1e9637a92db5ec692d5e7e256cdb72f8ceade87f9db889ba78fce6adc85fdfa8

Download Submit
C:\Windows\SysWOW64\Kaflio32.exe

Filesize
109KB

MD5
09c42121f6e37a609e0289e92b1716ef

SHA1
9c75eff6264c3657d3466e56aa3ad94b35672a14

SHA256
7daeb209a65df3df7c1c7b0038f433cf7a00ee8f29abe2fa8252b538ece7ed4d

SHA512
8e1884972b3c16cf44b9d3fefa73c9ec0b9c68597ddfb74d99e3b156201c2608d9deb9a98b60b75d395a299dedecae2ae133aae70826160228ec24e462da97aa

Download Submit
C:\Windows\SysWOW64\Kaflio32.exe

Filesize
109KB

MD5
09c42121f6e37a609e0289e92b1716ef

SHA1
9c75eff6264c3657d3466e56aa3ad94b35672a14

SHA256
7daeb209a65df3df7c1c7b0038f433cf7a00ee8f29abe2fa8252b538ece7ed4d

SHA512
8e1884972b3c16cf44b9d3fefa73c9ec0b9c68597ddfb74d99e3b156201c2608d9deb9a98b60b75d395a299dedecae2ae133aae70826160228ec24e462da97aa

Download Submit
C:\Windows\SysWOW64\Kdcbic32.exe

Filesize
109KB

MD5
b633087be1870cd07c0f710cf073fa76

SHA1
1815f0f5263e42ce48b7ba3f2fd03d4ba33c98e0

SHA256
e6f73edfe441ec9e3522e650d098cef5dcf1a92e49d2ed131479acea6b8d66c0

SHA512
7c6b3fb18dae04b48ff6e52725a949f66bbf200cc5f897489a5756dd60c8c2dfee9198ba78998c6865df618ae30663d33730a3380b295e2924e189e2b2934959

Download Submit
C:\Windows\SysWOW64\Kfgpblda.exe

Filesize
109KB

MD5
e3e5a16dd7e402abc6d52d2503dd7238

SHA1
7c3b6e728fc212dafbfbe493acc53ae0744ddcf8

SHA256
029cb39d86381981d468376721ef98af3f5ea7c38ec02ecad8b5a93849e7af2b

SHA512
668368929780f5c29f7751a36451974a882cddc4601b96b99da8c78c95522b74ab678e9f4deee3759df9e09779188c9d6512784e4bd37d162c1260df88c46d6a

Download Submit
C:\Windows\SysWOW64\Kggjghkd.exe

Filesize
109KB

MD5
52e0b429d8ceecb07ab673e278f69c4d

SHA1
f061d538087b7c9bdc4836005928bd113f9741d0

SHA256
d86fd823d55a24bd407ff663de511569cb3b8ed510f1a9c8a28fc13ad73ac0a2

SHA512
d65c82a95a287036947c778c93d63b66b438f50edcd663d4c17755a0afb132d58eb711ed26d28afd721f7ecf7830ac6641825e8ba786678bd5a17e174febbeea

Download Submit
C:\Windows\SysWOW64\Kggjghkd.exe

Filesize
109KB

MD5
52e0b429d8ceecb07ab673e278f69c4d

SHA1
f061d538087b7c9bdc4836005928bd113f9741d0

SHA256
d86fd823d55a24bd407ff663de511569cb3b8ed510f1a9c8a28fc13ad73ac0a2

SHA512
d65c82a95a287036947c778c93d63b66b438f50edcd663d4c17755a0afb132d58eb711ed26d28afd721f7ecf7830ac6641825e8ba786678bd5a17e174febbeea

Download Submit
C:\Windows\SysWOW64\Ldgnbg32.exe

Filesize
109KB

MD5
132992e9755a3a65f02b1f6efb68db77

SHA1
5da4a2802d20c1ef9410b5bcf84c038d120099f1

SHA256
d9b23198c95ac2376ee0587748df4345987c6b15a194bad510bc99088522070d

SHA512
3913023f04f813f97233cde15fc2550d1673996f5b1fe68d23810c8f4d5e465ee6688f293efbac197aca91dcfc7615ed7c7ed770891c9f8a15cff95b43bcd854

Download Submit
C:\Windows\SysWOW64\Ldgnbg32.exe

Filesize
109KB

MD5
132992e9755a3a65f02b1f6efb68db77

SHA1
5da4a2802d20c1ef9410b5bcf84c038d120099f1

SHA256
d9b23198c95ac2376ee0587748df4345987c6b15a194bad510bc99088522070d

SHA512
3913023f04f813f97233cde15fc2550d1673996f5b1fe68d23810c8f4d5e465ee6688f293efbac197aca91dcfc7615ed7c7ed770891c9f8a15cff95b43bcd854

Download Submit
C:\Windows\SysWOW64\Ldgnbg32.exe

Filesize
109KB

MD5
132992e9755a3a65f02b1f6efb68db77

SHA1
5da4a2802d20c1ef9410b5bcf84c038d120099f1

SHA256
d9b23198c95ac2376ee0587748df4345987c6b15a194bad510bc99088522070d

SHA512
3913023f04f813f97233cde15fc2550d1673996f5b1fe68d23810c8f4d5e465ee6688f293efbac197aca91dcfc7615ed7c7ed770891c9f8a15cff95b43bcd854

Download Submit
C:\Windows\SysWOW64\Maeaajpl.exe

Filesize
109KB

MD5
e6857a9b6c29e9baea0146f833378a6b

SHA1
239775ffcb785b003ac5ab3e4fe128e5e4135b2b

SHA256
ba18d4962ad1185371ee88de456cd0808fd2ca1bad30835b76506f0d19d2cbe7

SHA512
68528d22f6690068b848d7923963a2103532f59344eab3e256d75a54873b090edbda39479cce0b001c905f00dc9a2a6101fcfe44ecb0a8ec4baae353df57d819

Download Submit
C:\Windows\SysWOW64\Maeaajpl.exe

Filesize
109KB

MD5
e6857a9b6c29e9baea0146f833378a6b

SHA1
239775ffcb785b003ac5ab3e4fe128e5e4135b2b

SHA256
ba18d4962ad1185371ee88de456cd0808fd2ca1bad30835b76506f0d19d2cbe7

SHA512
68528d22f6690068b848d7923963a2103532f59344eab3e256d75a54873b090edbda39479cce0b001c905f00dc9a2a6101fcfe44ecb0a8ec4baae353df57d819

Download Submit
C:\Windows\SysWOW64\Mdjapphl.exe

Filesize
109KB

MD5
6b7d957e571c32cfb5b79d57d0ab881c

SHA1
9042d47cea7531869984a42b358aa36fbf050823

SHA256
b92a2c1f6bf6ab20256068a5388b359510997a25f0e0c61957959a67fd0bef12

SHA512
ce6e993e3f720cc295b3701abd9c7c451fa700f56f60750d71590eae2d46289d45af14f30587face0ea86831a35692edfaec0d02442e2eb00b70024f88b5a716

Download Submit
C:\Windows\SysWOW64\Mdlgmgdh.exe

Filesize
109KB

MD5
f7fb2880f7f3f9a7a247d4166063f9b9

SHA1
32fe5324cda940cf105d53c80d14109e3805584c

SHA256
dcf6d299c3f7e9c641dd256dfa71b66adc1483072aea893a1c67005d267e1998

SHA512
1d7b763f56a5c31fdefd87043a7325a7ba1b615e9aeeeed4cd22c29756d6dd1b214613bddbc7907099bd015f064293cfe26cb5ee63495c74bdb267d5cc9e4ca3

Download Submit
C:\Windows\SysWOW64\Mdlgmgdh.exe

Filesize
109KB

MD5
f7fb2880f7f3f9a7a247d4166063f9b9

SHA1
32fe5324cda940cf105d53c80d14109e3805584c

SHA256
dcf6d299c3f7e9c641dd256dfa71b66adc1483072aea893a1c67005d267e1998

SHA512
1d7b763f56a5c31fdefd87043a7325a7ba1b615e9aeeeed4cd22c29756d6dd1b214613bddbc7907099bd015f064293cfe26cb5ee63495c74bdb267d5cc9e4ca3

Download Submit
C:\Windows\SysWOW64\Ndbnkefp.exe

Filesize
109KB

MD5
df2bc6555a88b22909de056325de0ed1

SHA1
31383f483b943e7104f4d9edea07514ffccaa7fe

SHA256
cc673d171019b6b82382f746c6ad4c952527f93ddbd7216dee1e86f826f8505a

SHA512
ab68375bd9df79d61c8214f55123b3b8f9126604bde59ae3055009a6ba78ebe051c2c7d471259154cc6aead3208d3b41feb56febd4d949f56237664b341c0aa0

Download Submit
C:\Windows\SysWOW64\Nhpijldj.exe

Filesize
109KB

MD5
08e0f0b32d9a843791cc79f459778290

SHA1
d130d4da3b31aa6dafc4e85f30268f78a067850f

SHA256
911eb249cb904174a17c3d4513e9315bf707b874f0b67167bc4a1da7e01deb74

SHA512
e48d5e17439a7a16b87322095ff2b8bbaa27f6c67aee8b15c676961a4dd3af54791947bcdf5570d9bb3788dd5474912b1b12915b3fb947454cf203fb178053f1

Download Submit
C:\Windows\SysWOW64\Nmbhgjoi.exe

Filesize
109KB

MD5
2d5c5c37916b6f07865bfd3d4a0c4f8c

SHA1
252d61ccc92aea574617dd673145abc5940e2362

SHA256
e6804605dbb8451f0957803ec0110b1303092727575a6c469a988de6dcb3614c

SHA512
78525909ff90b436e5b551b0e47215c1b451aec72fd981abee0fe5ba1f07977c50154e1644918a9189464d2c5e20a6c465dcd53506f811dfe8479907a0ba5306

Download Submit
C:\Windows\SysWOW64\Nmbhgjoi.exe

Filesize
109KB

MD5
2d5c5c37916b6f07865bfd3d4a0c4f8c

SHA1
252d61ccc92aea574617dd673145abc5940e2362

SHA256
e6804605dbb8451f0957803ec0110b1303092727575a6c469a988de6dcb3614c

SHA512
78525909ff90b436e5b551b0e47215c1b451aec72fd981abee0fe5ba1f07977c50154e1644918a9189464d2c5e20a6c465dcd53506f811dfe8479907a0ba5306

Download Submit
C:\Windows\SysWOW64\Nmbhgjoi.exe

Filesize
109KB

MD5
956dec4b9b0ffd9ae656c2f96434980e

SHA1
e8468607e86e19f45834bcc5a9c08cbf77932161

SHA256
6eb92e86ff5224f43dc933f29119eddd4f4edb85598548c75550c242fd01b65f

SHA512
a3b31cc0ec25cdda1b2b35b292a2a9b56f9278c70a57dfdfd9d185ab7dfe99608035f7cfc25affc38002c24f90c561e9ed31c62bcdf393fd936455bc645e1adc

Download Submit
C:\Windows\SysWOW64\Npldnp32.exe

Filesize
109KB

MD5
f3551e4cda543e840057422e84d84f14

SHA1
e80bd9ece8d46026b9369d01b219332ac36e5496

SHA256
c6ec7789f432ef51a6902c30110db9fc8b16a4cd0754a7e3e73c83997e4bc7a5

SHA512
147cee948a9f040052723099984092be3de80c82043c0a1f9b946efe0e17b9c5f4808692b50facae28daabe1b2b8421327d8dc416149edb1ce5a4529c1f9e038

Download Submit
C:\Windows\SysWOW64\Nqdeefpi.exe

Filesize
109KB

MD5
9705012a2edf3664c002ae6480a6920f

SHA1
edce360ba84e6d14daea92359bd3df46a51eb404

SHA256
0e7acf41cbc62e1f76f0f5de4ce804a60ccc155aeb6d6240f20e28912315655c

SHA512
0b1afe317c1bba282aa58fbd9858ec0bfe923e46e9afa129d53a333c8aecec24233638b4162a6b7065b3854ca261f9772eb27d91e96680a979aa21317bd2764d

Download Submit
C:\Windows\SysWOW64\Ofjgmdgg.exe

Filesize
109KB

MD5
4e2cc2043c6e649562166d041dba9166

SHA1
e7802331178e7995883e24c5e6ab0df2a48c0f67

SHA256
c830be38d637ceb85aa8c42a922462c35b7672d26f3974679bb3fdbf365d6ede

SHA512
441424107fc8d8e58b61acfe1c173704d5b5900eec2e1ae6294a74fcbe837a91a6bb0e2b30c1ab1b98ef9c9b6f90d6b11373652c82d86cb7c3f1a8ce822d503e

Download Submit
C:\Windows\SysWOW64\Ognginic.exe

Filesize
109KB

MD5
989a3faaa2399cc01927dc3d6fb70295

SHA1
83effa0ab08b2f847732fd4e356d48cd1a0e58ef

SHA256
cf7b7d350d2e04c811e84d894523994cc52af2c0bebb1a676f953074e305be7c

SHA512
95a33a0e02b47a13c8d7ec981f05b446eb0defc7110ca31a544406fca901b52c7e49c18bb1df5a8a0e85e0d8a1f6ed1672c5f08daab4925fd3a0a0ef5f90083e

Download Submit
C:\Windows\SysWOW64\Omlkmign.exe

Filesize
109KB

MD5
af02957c336774e92a435d3656617bd5

SHA1
f8d73536c0147bff213db2bca2af42ca2eb4a226

SHA256
ba3eb533c2f072ea597f42c7405596fd13caf16cf4fb83d3149a2e039493d65f

SHA512
306e5595baba12b3dfdec262c8f0207115d5807003cdcfd89cfe870b1af51b7e04297120a6b8f597d162bab0f66beada7c996ad5d0a319b7fe52e87e33dd221f

Download Submit
C:\Windows\SysWOW64\Omlkmign.exe

Filesize
109KB

MD5
af02957c336774e92a435d3656617bd5

SHA1
f8d73536c0147bff213db2bca2af42ca2eb4a226

SHA256
ba3eb533c2f072ea597f42c7405596fd13caf16cf4fb83d3149a2e039493d65f

SHA512
306e5595baba12b3dfdec262c8f0207115d5807003cdcfd89cfe870b1af51b7e04297120a6b8f597d162bab0f66beada7c996ad5d0a319b7fe52e87e33dd221f

Download Submit
C:\Windows\SysWOW64\Oqgkadod.exe

Filesize
109KB

MD5
b487a3a7c93840c3a6745bf119e878fe

SHA1
309b011e5a1c50a8ec1c4817c0dc2d613a1c13f1

SHA256
0d9569cb185f4ff1dd5fc9aeb170288572baacaf6c9a9089e0e72cddff112ac8

SHA512
7c78c35e6de3f147d8322b4cf6b4b66bbdaf878fb0d4f4bfefea36bb4bb4ffce0c1c526326883cb2f00c6e748450bb10accc9a933a1efe570ba005cc6fbae4a0

Download Submit
C:\Windows\SysWOW64\Pdmikb32.exe

Filesize
109KB

MD5
92b9ad83d03aaf0500440cd4c0f63bdd

SHA1
6575c06dfe00884c69fe7815a7f2f1ffac965e3a

SHA256
d75cc53822553e5d6d5b66ea1d114f3fbf2995ce7d5866a8389af84a0fbb8094

SHA512
6e7a74b4771dee7854cbd2bdddf12970ae19f4129b6a2dc25e1d523ea2467c55303a253c1cf7d30bbe5887d907162d675fb9da7522f4aadc10a5631ed99828a1

Download Submit
C:\Windows\SysWOW64\Pdmikb32.exe

Filesize
109KB

MD5
92b9ad83d03aaf0500440cd4c0f63bdd

SHA1
6575c06dfe00884c69fe7815a7f2f1ffac965e3a

SHA256
d75cc53822553e5d6d5b66ea1d114f3fbf2995ce7d5866a8389af84a0fbb8094

SHA512
6e7a74b4771dee7854cbd2bdddf12970ae19f4129b6a2dc25e1d523ea2467c55303a253c1cf7d30bbe5887d907162d675fb9da7522f4aadc10a5631ed99828a1

Download Submit
C:\Windows\SysWOW64\Pllieg32.exe

Filesize
109KB

MD5
d50c778da4516c402cd2a6878bb9945d

SHA1
978f520902fea68b6d17eeddb0c951cf00e01ee8

SHA256
6142c3558beee6a9123fd0d9e0bbeb129c7e5a2b50ff132bf598e10e839998bd

SHA512
55ac493ac1e8ea79bd835e3bda59f7e0f1e13efac2bcb8d3637a14a14b869a7ccd027e92d77c2d93ab63c228c119c66a29cd85f0fba2dbb456f382d8d66627b6

Download Submit
memory/316-159-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/412-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/416-144-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/456-310-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/732-208-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/792-127-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/992-136-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1064-268-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1128-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1132-403-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1292-292-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1444-442-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1620-334-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1628-382-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1716-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1748-39-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1804-374-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1832-200-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1848-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1872-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1944-394-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1996-47-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2016-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2064-192-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2176-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2244-430-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2488-224-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2496-240-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2580-418-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2676-358-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2708-255-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2904-424-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2928-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3140-120-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3476-328-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3512-304-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3560-72-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3580-215-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3604-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3856-286-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3976-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4056-112-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4164-388-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4348-151-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4412-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4652-232-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4656-87-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4668-184-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4700-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4724-167-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4784-376-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4804-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4812-412-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4836-436-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4852-95-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4860-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4888-352-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4948-410-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5032-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5040-316-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5056-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5064-346-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5088-274-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5104-248-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads