706317dbb8ac4fab4d45c1a4416be976946d23a458312379cdfdb9bfac4584dd

Analysis

max time kernel
137s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe
Size

136KB
MD5

af6ab3a8f404a5b7d13d4e582b5f6a10
SHA1

3c836ad3e63ca24287a4fd61a07919b8f0d61156
SHA256

706317dbb8ac4fab4d45c1a4416be976946d23a458312379cdfdb9bfac4584dd
SHA512

d9d6f20561151873323838504e2be137262724c0ddfe8d292f92970d1f3898be50dfa6b52826f2b4e997e924ea1c1666dafaaedbe42895c795bdd38b2aed80b3
SSDEEP

3072:dbhcIbDuL9Ehk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/gU:DcJL9EhFtCApaH8m3QIvMWH5H3U

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjlpbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifckkhfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flpkcbqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papfgbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eekjep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfehpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oahgnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkkgbmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcain32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbefln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqikmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiopca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbjkkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jknfcofa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebcdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjbjjdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgeqmjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjkbnfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cihjeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ficlmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkhjph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmjemflb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinqbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kakmna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpchaqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nejgbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklbmllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bckkca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplnogmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdihfq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abflfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohnljine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eimlgnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifckkhfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abgcqjhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Didqkeeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqofippg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agiahlkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjpmfpid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmgiaig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hqfqfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmbfiokn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcabhido.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kggcnoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnohlgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnindhpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbnbhfde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiodha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qajlje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpojd32.exe

Executes dropped EXE 64 IoCs

pid	Process
2852	Mnlnbl32.exe
3152	Mblcnj32.exe
3256	Nbnpcj32.exe
4424	Noeahkfc.exe
4340	Nklbmllg.exe
4740	Nlkngo32.exe
3588	Niooqcad.exe
4932	Najceeoo.exe
3856	Okchnk32.exe
2644	Oehlkc32.exe
4572	Oblmdhdo.exe
2616	Okgaijaj.exe
2912	Ohkbbn32.exe
4744	Oiknlagg.exe
5032	Oeaoab32.exe
464	Pahpfc32.exe
1396	Plndcl32.exe
5028	Pakllc32.exe
4860	Pidabppl.exe
2188	Papfgbmg.exe
3432	Pkhjph32.exe
2668	Qkjgegae.exe
2224	Qepkbpak.exe
1084	Allpejfe.exe
2092	Aeddnp32.exe
220	Achegd32.exe
3100	Akcjkfij.exe
2716	Ajdjin32.exe
2688	Afkknogn.exe
3452	Bhldpj32.exe
2372	Bjlpjm32.exe
4432	Bcddcbab.exe
4972	Bkoigdom.exe
3064	Bjpjel32.exe
1292	Bcinna32.exe
4872	Bmabggdm.exe
1332	Bckkca32.exe
3728	Ckfphc32.exe
3248	Ccmgiaig.exe
1524	Cijpahho.exe
2232	Cbbdjm32.exe
2896	Ckkiccep.exe
5084	Cfqmpl32.exe
3544	Cmjemflb.exe
1308	Cbgnemjj.exe
1652	Cmmbbejp.exe
4176	Dbjkkl32.exe
2260	Dpphjp32.exe
3564	Dpbdopck.exe
4624	Djhimica.exe
4308	Dpdaepai.exe
3456	Dimenegi.exe
320	Ecbjkngo.exe
516	Eiobceef.exe
2220	Ebhglj32.exe
3296	Eiaoid32.exe
5016	Ebjcajjd.exe
4496	Emphocjj.exe
628	Eblpgjha.exe
2112	Embddb32.exe
2076	Efjimhnh.exe
4848	Emdajb32.exe
4460	Fjhacf32.exe
1820	Fpejlmcf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hiilcp32.dll	Pidabppl.exe
File opened for modification	C:\Windows\SysWOW64\Inkaqb32.exe	Ibbcfa32.exe
File created	C:\Windows\SysWOW64\Nnjdkikf.dll	Cbqonf32.exe
File opened for modification	C:\Windows\SysWOW64\Kmhccpci.exe	Jfokff32.exe
File created	C:\Windows\SysWOW64\Dokmlmhl.dll	Hienlpel.exe
File created	C:\Windows\SysWOW64\Ajjokd32.exe	Qapnmopa.exe
File created	C:\Windows\SysWOW64\Pgllad32.exe	Pdnpeh32.exe
File created	C:\Windows\SysWOW64\Aqdbfa32.exe	Akgjnj32.exe
File created	C:\Windows\SysWOW64\Hepoddcc.exe	Hcabhido.exe
File opened for modification	C:\Windows\SysWOW64\Nbnpcj32.exe	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Oeopnmoa.exe	Onhhmpoo.exe
File created	C:\Windows\SysWOW64\Efampahd.exe	Epgdch32.exe
File opened for modification	C:\Windows\SysWOW64\Lpbokjho.exe	Liifnp32.exe
File created	C:\Windows\SysWOW64\Nhfjgq32.dll	Lmheph32.exe
File created	C:\Windows\SysWOW64\Lonqoi32.dll	Hcabhido.exe
File created	C:\Windows\SysWOW64\Eiaoid32.exe	Ebhglj32.exe
File created	C:\Windows\SysWOW64\Jpmcbhlp.dll	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Lkhpjc32.dll	Ckhecmcf.exe
File created	C:\Windows\SysWOW64\Cadpqeqg.dll	Iencmm32.exe
File created	C:\Windows\SysWOW64\Femdjbab.dll	Ifleji32.exe
File created	C:\Windows\SysWOW64\Apalniie.dll	Libido32.exe
File opened for modification	C:\Windows\SysWOW64\Mhefhf32.exe	Malnklgg.exe
File created	C:\Windows\SysWOW64\Aobbbd32.dll	Idahjg32.exe
File opened for modification	C:\Windows\SysWOW64\Phlikg32.exe	Pnfdnnbo.exe
File created	C:\Windows\SysWOW64\Bpocpj32.dll	Jjemle32.exe
File created	C:\Windows\SysWOW64\Kjipmoai.exe	Kcphpdil.exe
File created	C:\Windows\SysWOW64\Pdnjmc32.dll	Lqikmc32.exe
File created	C:\Windows\SysWOW64\Klmlfi32.dll	Ijjnpg32.exe
File created	C:\Windows\SysWOW64\Icpkgc32.dll	Hiiggoaf.exe
File created	C:\Windows\SysWOW64\Dmjmekgn.exe	Cgiohbfi.exe
File opened for modification	C:\Windows\SysWOW64\Iencmm32.exe	Indkpcdk.exe
File opened for modification	C:\Windows\SysWOW64\Cibkohef.exe	Cfcoblfb.exe
File opened for modification	C:\Windows\SysWOW64\Oddmoj32.exe	Oogdfc32.exe
File created	C:\Windows\SysWOW64\Hhobjf32.exe	Hcaibo32.exe
File created	C:\Windows\SysWOW64\Hohjgpmo.exe	Hhobjf32.exe
File created	C:\Windows\SysWOW64\Celgjlpn.exe	Cnboma32.exe
File opened for modification	C:\Windows\SysWOW64\Npldnp32.exe	Niblafgi.exe
File created	C:\Windows\SysWOW64\Jfikaqme.exe	Joobdfei.exe
File created	C:\Windows\SysWOW64\Hiiggoaf.exe	Hcpojd32.exe
File created	C:\Windows\SysWOW64\Mdcbee32.dll	Gqokekph.exe
File created	C:\Windows\SysWOW64\Onhhmpoo.exe	Nkjlqd32.exe
File created	C:\Windows\SysWOW64\Ihheqd32.exe	Igghilhi.exe
File created	C:\Windows\SysWOW64\Bhamin32.dll	Lccdghmc.exe
File opened for modification	C:\Windows\SysWOW64\Mhoind32.exe	Mhmmieil.exe
File opened for modification	C:\Windows\SysWOW64\Jcfejfag.exe	Jllmml32.exe
File created	C:\Windows\SysWOW64\Gjpank32.dll	Bhkmec32.exe
File created	C:\Windows\SysWOW64\Felbnn32.exe	Enbjad32.exe
File created	C:\Windows\SysWOW64\Mjjkejin.dll	Jhnojl32.exe
File created	C:\Windows\SysWOW64\Ghijbq32.dll	Egdqph32.exe
File created	C:\Windows\SysWOW64\Hccomh32.exe	Hligqnjp.exe
File opened for modification	C:\Windows\SysWOW64\Legben32.exe	Kakmna32.exe
File created	C:\Windows\SysWOW64\Aemghi32.dll	Legben32.exe
File created	C:\Windows\SysWOW64\Onighcgh.dll	Abgcqjhp.exe
File created	C:\Windows\SysWOW64\Anmmkd32.exe	Ahpdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Kmjinjnj.exe	Kkkldg32.exe
File opened for modification	C:\Windows\SysWOW64\Kblkap32.exe	Kmobii32.exe
File created	C:\Windows\SysWOW64\Heeeiopa.dll	Cbbnpg32.exe
File created	C:\Windows\SysWOW64\Fjemge32.dll	Ofhcdlgg.exe
File opened for modification	C:\Windows\SysWOW64\Cinpdl32.exe	Cbdhgaid.exe
File opened for modification	C:\Windows\SysWOW64\Jllmml32.exe	Jfbdpabn.exe
File opened for modification	C:\Windows\SysWOW64\Adikdfna.exe	Aolblopj.exe
File created	C:\Windows\SysWOW64\Inkaqb32.exe	Ibbcfa32.exe
File created	C:\Windows\SysWOW64\Epeohn32.exe	Eilfldoi.exe
File created	C:\Windows\SysWOW64\Meahle32.dll	Elilmi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11688	11608	WerFault.exe	860

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmkbfeab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cehdib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fekclnif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phdpmbnc.dll"	Kqmkae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejglcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eeddfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmhccpci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calbnnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipmgkhgl.dll"	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cemeoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcogo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcndab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eainbfne.dll"	Lcbmlbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cehlcikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiiombp.dll"	Dghadidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajqphlf.dll"	Kbinlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljephmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Midbjmkg.dll"	Cfcoblfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbqpa32.dll"	Nnfkgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnboma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Allpejfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnodbhfi.dll"	Bjpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekaapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Diafqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmpdgdmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpdaepai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkkceedp.dll"	Embddb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpbbak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbdhgaid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fifhbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlkngo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgiohbfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohgopgfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpoiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejiiippb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiokacgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqlmkp32.dll"	Bdgehobe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plhppp32.dll"	Njmopj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Achegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gepgfb32.dll"	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cihjeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gckjlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epeohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pndhhnda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meahle32.dll"	Elilmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihheqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dimenegi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjnifbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnjfibml.dll"	Bnfihkqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmcke32.dll"	Jckeokan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnpclpq.dll"	Jlobkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodoah32.dll"	Njkkbehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbhhfbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phneqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dalkek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbbpmo32.dll"	Ehmibdol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnlnbl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2852	4392	NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe	86
PID 4392 wrote to memory of 2852	4392	NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe	86
PID 4392 wrote to memory of 2852	4392	NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe	86
PID 2852 wrote to memory of 3152	2852	Mnlnbl32.exe	87
PID 2852 wrote to memory of 3152	2852	Mnlnbl32.exe	87
PID 2852 wrote to memory of 3152	2852	Mnlnbl32.exe	87
PID 3152 wrote to memory of 3256	3152	Mblcnj32.exe	88
PID 3152 wrote to memory of 3256	3152	Mblcnj32.exe	88
PID 3152 wrote to memory of 3256	3152	Mblcnj32.exe	88
PID 3256 wrote to memory of 4424	3256	Nbnpcj32.exe	89
PID 3256 wrote to memory of 4424	3256	Nbnpcj32.exe	89
PID 3256 wrote to memory of 4424	3256	Nbnpcj32.exe	89
PID 4424 wrote to memory of 4340	4424	Noeahkfc.exe	90
PID 4424 wrote to memory of 4340	4424	Noeahkfc.exe	90
PID 4424 wrote to memory of 4340	4424	Noeahkfc.exe	90
PID 4340 wrote to memory of 4740	4340	Nklbmllg.exe	91
PID 4340 wrote to memory of 4740	4340	Nklbmllg.exe	91
PID 4340 wrote to memory of 4740	4340	Nklbmllg.exe	91
PID 4740 wrote to memory of 3588	4740	Nlkngo32.exe	92
PID 4740 wrote to memory of 3588	4740	Nlkngo32.exe	92
PID 4740 wrote to memory of 3588	4740	Nlkngo32.exe	92
PID 3588 wrote to memory of 4932	3588	Niooqcad.exe	93
PID 3588 wrote to memory of 4932	3588	Niooqcad.exe	93
PID 3588 wrote to memory of 4932	3588	Niooqcad.exe	93
PID 4932 wrote to memory of 3856	4932	Najceeoo.exe	94
PID 4932 wrote to memory of 3856	4932	Najceeoo.exe	94
PID 4932 wrote to memory of 3856	4932	Najceeoo.exe	94
PID 3856 wrote to memory of 2644	3856	Okchnk32.exe	95
PID 3856 wrote to memory of 2644	3856	Okchnk32.exe	95
PID 3856 wrote to memory of 2644	3856	Okchnk32.exe	95
PID 2644 wrote to memory of 4572	2644	Oehlkc32.exe	96
PID 2644 wrote to memory of 4572	2644	Oehlkc32.exe	96
PID 2644 wrote to memory of 4572	2644	Oehlkc32.exe	96
PID 4572 wrote to memory of 2616	4572	Oblmdhdo.exe	97
PID 4572 wrote to memory of 2616	4572	Oblmdhdo.exe	97
PID 4572 wrote to memory of 2616	4572	Oblmdhdo.exe	97
PID 2616 wrote to memory of 2912	2616	Okgaijaj.exe	98
PID 2616 wrote to memory of 2912	2616	Okgaijaj.exe	98
PID 2616 wrote to memory of 2912	2616	Okgaijaj.exe	98
PID 2912 wrote to memory of 4744	2912	Ohkbbn32.exe	99
PID 2912 wrote to memory of 4744	2912	Ohkbbn32.exe	99
PID 2912 wrote to memory of 4744	2912	Ohkbbn32.exe	99
PID 4744 wrote to memory of 5032	4744	Oiknlagg.exe	100
PID 4744 wrote to memory of 5032	4744	Oiknlagg.exe	100
PID 4744 wrote to memory of 5032	4744	Oiknlagg.exe	100
PID 5032 wrote to memory of 464	5032	Oeaoab32.exe	102
PID 5032 wrote to memory of 464	5032	Oeaoab32.exe	102
PID 5032 wrote to memory of 464	5032	Oeaoab32.exe	102
PID 464 wrote to memory of 1396	464	Pahpfc32.exe	103
PID 464 wrote to memory of 1396	464	Pahpfc32.exe	103
PID 464 wrote to memory of 1396	464	Pahpfc32.exe	103
PID 1396 wrote to memory of 5028	1396	Plndcl32.exe	104
PID 1396 wrote to memory of 5028	1396	Plndcl32.exe	104
PID 1396 wrote to memory of 5028	1396	Plndcl32.exe	104
PID 5028 wrote to memory of 4860	5028	Pakllc32.exe	105
PID 5028 wrote to memory of 4860	5028	Pakllc32.exe	105
PID 5028 wrote to memory of 4860	5028	Pakllc32.exe	105
PID 4860 wrote to memory of 2188	4860	Pidabppl.exe	106
PID 4860 wrote to memory of 2188	4860	Pidabppl.exe	106
PID 4860 wrote to memory of 2188	4860	Pidabppl.exe	106
PID 2188 wrote to memory of 3432	2188	Papfgbmg.exe	107
PID 2188 wrote to memory of 3432	2188	Papfgbmg.exe	107
PID 2188 wrote to memory of 3432	2188	Papfgbmg.exe	107
PID 3432 wrote to memory of 2668	3432	Pkhjph32.exe	108

C:\Users\Admin\AppData\Local\Temp\NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.af6ab3a8f404a5b7d13d4e582b5f6a10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\Mnlnbl32.exe
  C:\Windows\system32\Mnlnbl32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\Mblcnj32.exe
    C:\Windows\system32\Mblcnj32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\Nbnpcj32.exe
      C:\Windows\system32\Nbnpcj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
      - C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        23⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        24⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        26⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        28⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        29⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        30⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        31⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        32⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        33⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        34⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        36⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        37⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        39⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        41⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        42⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        43⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        44⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        46⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        47⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        49⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        50⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        51⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3456
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        54⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        55⤵
        Executes dropped EXE
        
        PID:516
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        57⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        58⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        59⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        60⤵
        Executes dropped EXE
        
        PID:628
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        62⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        63⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        64⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        65⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        66⤵
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        67⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        68⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        69⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        70⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        71⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        72⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        73⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        74⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        75⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        76⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        77⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        78⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        79⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        80⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        81⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        82⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        83⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        84⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        86⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        87⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        88⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        91⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        92⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        93⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        94⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        95⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        96⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        97⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        98⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        99⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        100⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        101⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        102⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        103⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        104⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        105⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        106⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        107⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        109⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        110⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        111⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        113⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        114⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        115⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        116⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        117⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        118⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        119⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        120⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        121⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        124⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        125⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        126⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        128⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        129⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        130⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        131⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        132⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        133⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        134⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        135⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        136⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        137⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        138⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        139⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        140⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        141⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        142⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        143⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        144⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        145⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        146⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        147⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        148⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        149⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        150⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        151⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        152⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        153⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        154⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        155⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        156⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        157⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        158⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        159⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        160⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        161⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        162⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        163⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        164⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        165⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        166⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        167⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        168⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        169⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        170⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        171⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        172⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        173⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        175⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        176⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        177⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        178⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        179⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        181⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        182⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        183⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        184⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        185⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        186⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        187⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        188⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        190⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        191⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        192⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        193⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        194⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        195⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        196⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        197⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        198⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        199⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        200⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        201⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        203⤵
        Drops file in System32 directory
        
        PID:7696
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        205⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        207⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        208⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        209⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        211⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        213⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        214⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        215⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7396
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        218⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        219⤵
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        220⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        221⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        222⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        223⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        224⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        225⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        227⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        228⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        229⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        230⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        232⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        233⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        234⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        235⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        236⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        237⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        238⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        239⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        240⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        241⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        242⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        243⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        244⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        245⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        246⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        247⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        248⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        249⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        250⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        251⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        252⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        253⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        254⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        256⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        257⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        259⤵
        Drops file in System32 directory
        
        PID:8816
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8864
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        263⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        265⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        267⤵
        Drops file in System32 directory
        
        PID:9168
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        268⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        269⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        271⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        272⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        273⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        274⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        275⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        277⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        278⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        279⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        280⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        281⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        282⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        283⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        284⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        285⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        286⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        287⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        288⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        289⤵
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        290⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        291⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        292⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        293⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        294⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        295⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        296⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        297⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        298⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        299⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3592
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        301⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        302⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        303⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        304⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        305⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        306⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        307⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        308⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        309⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        310⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        311⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1208
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        314⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        315⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        316⤵
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        317⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        318⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        319⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        320⤵
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        321⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        323⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        324⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        325⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        326⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        327⤵
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8652
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        329⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        330⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        331⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        332⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Didqkeeq.exe
        
        C:\Windows\system32\Didqkeeq.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5312
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        334⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        335⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Digmqe32.exe
        
        C:\Windows\system32\Digmqe32.exe
        336⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Edlann32.exe
        
        C:\Windows\system32\Edlann32.exe
        337⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        338⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        339⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Eilfldoi.exe
        
        C:\Windows\system32\Eilfldoi.exe
        340⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Epeohn32.exe
        
        C:\Windows\system32\Epeohn32.exe
        341⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        342⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Edcgnmml.exe
        
        C:\Windows\system32\Edcgnmml.exe
        343⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        344⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        345⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        346⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Egdqph32.exe
        
        C:\Windows\system32\Egdqph32.exe
        347⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        348⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Fdhail32.exe
        
        C:\Windows\system32\Fdhail32.exe
        349⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        350⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        351⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Fcmnkh32.exe
        
        C:\Windows\system32\Fcmnkh32.exe
        352⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        353⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Fdmjdkda.exe
        
        C:\Windows\system32\Fdmjdkda.exe
        354⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        355⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        356⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        357⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        359⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        360⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        361⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        362⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        363⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Gjqinamq.exe
        
        C:\Windows\system32\Gjqinamq.exe
        364⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        365⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        366⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        367⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        368⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Gnanioad.exe
        
        C:\Windows\system32\Gnanioad.exe
        369⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Gqokekph.exe
        
        C:\Windows\system32\Gqokekph.exe
        370⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        371⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Hcbpme32.exe
        
        C:\Windows\system32\Hcbpme32.exe
        372⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        373⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2608
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        375⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        376⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Najagp32.exe
        
        C:\Windows\system32\Najagp32.exe
        377⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Ndinck32.exe
        
        C:\Windows\system32\Ndinck32.exe
        378⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Nonbqd32.exe
        
        C:\Windows\system32\Nonbqd32.exe
        379⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        380⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        381⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Nejgbn32.exe
        
        C:\Windows\system32\Nejgbn32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6304
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        383⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Nkjlqd32.exe
        
        C:\Windows\system32\Nkjlqd32.exe
        384⤵
        Drops file in System32 directory
        
        PID:7408
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        385⤵
        Drops file in System32 directory
        
        PID:1308
        
        C:\Windows\SysWOW64\Oeopnmoa.exe
        
        C:\Windows\system32\Oeopnmoa.exe
        386⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2260
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        388⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        389⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Onmahojj.exe
        
        C:\Windows\system32\Onmahojj.exe
        390⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Odgjdibf.exe
        
        C:\Windows\system32\Odgjdibf.exe
        391⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        392⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        393⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Ohdbkh32.exe
        
        C:\Windows\system32\Ohdbkh32.exe
        394⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        395⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ofhcdlgg.exe
        
        C:\Windows\system32\Ofhcdlgg.exe
        396⤵
        Drops file in System32 directory
        
        PID:2916
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        397⤵
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        398⤵
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        399⤵
        Drops file in System32 directory
        
        PID:3868
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        400⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        401⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Phlikg32.exe
        
        C:\Windows\system32\Phlikg32.exe
        402⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        403⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        404⤵
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        405⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        406⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        407⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        408⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Phbolflm.exe
        
        C:\Windows\system32\Phbolflm.exe
        409⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        410⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        411⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Qkchna32.exe
        
        C:\Windows\system32\Qkchna32.exe
        412⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Qdllffpo.exe
        
        C:\Windows\system32\Qdllffpo.exe
        413⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Aoapcood.exe
        
        C:\Windows\system32\Aoapcood.exe
        414⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        415⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        416⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Aocmio32.exe
        
        C:\Windows\system32\Aocmio32.exe
        417⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        418⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        419⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        420⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        421⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        422⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Abgcqjhp.exe
        
        C:\Windows\system32\Abgcqjhp.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Aiqkmd32.exe
        
        C:\Windows\system32\Aiqkmd32.exe
        424⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        425⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Bichcc32.exe
        
        C:\Windows\system32\Bichcc32.exe
        426⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Bomppneg.exe
        
        C:\Windows\system32\Bomppneg.exe
        427⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        428⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        429⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Bnbmqjjo.exe
        
        C:\Windows\system32\Bnbmqjjo.exe
        430⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        431⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Bbpeghpe.exe
        
        C:\Windows\system32\Bbpeghpe.exe
        432⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        433⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        434⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        435⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        436⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        437⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        438⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        439⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        440⤵
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        441⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        442⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        443⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        444⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Cfgace32.exe
        
        C:\Windows\system32\Cfgace32.exe
        445⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Chinkndp.exe
        
        C:\Windows\system32\Chinkndp.exe
        446⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        449⤵
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        450⤵
        Drops file in System32 directory
        
        PID:8476
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        451⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        452⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        453⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        454⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        455⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Decdeama.exe
        
        C:\Windows\system32\Decdeama.exe
        456⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        457⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        458⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        459⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4256
        
        C:\Windows\SysWOW64\Eoconenj.exe
        
        C:\Windows\system32\Eoconenj.exe
        461⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        462⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        463⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Elilmi32.exe
        
        C:\Windows\system32\Elilmi32.exe
        464⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4040
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        467⤵
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        468⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        469⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        470⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Fhefmjlp.exe
        
        C:\Windows\system32\Fhefmjlp.exe
        471⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        473⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        474⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        475⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        476⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        477⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        478⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        479⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        480⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        481⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        482⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        483⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        484⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        485⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        486⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        487⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        488⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Gchflq32.exe
        
        C:\Windows\system32\Gchflq32.exe
        489⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        490⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        491⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        492⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Gjghdj32.exe
        
        C:\Windows\system32\Gjghdj32.exe
        493⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        494⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        495⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        496⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Hcaibo32.exe
        
        C:\Windows\system32\Hcaibo32.exe
        497⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Hhobjf32.exe
        
        C:\Windows\system32\Hhobjf32.exe
        498⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        499⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        500⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        501⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        502⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        503⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Hcipcnac.exe
        
        C:\Windows\system32\Hcipcnac.exe
        504⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Hfgloiqf.exe
        
        C:\Windows\system32\Hfgloiqf.exe
        505⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        506⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Igghilhi.exe
        
        C:\Windows\system32\Igghilhi.exe
        507⤵
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        508⤵
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        509⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        510⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        511⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        512⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        513⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        514⤵
        Drops file in System32 directory
        
        PID:1912
        
        C:\Windows\SysWOW64\Iqdfmajd.exe
        
        C:\Windows\system32\Iqdfmajd.exe
        515⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        516⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        517⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ifckkhfi.exe
        
        C:\Windows\system32\Ifckkhfi.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Jmmcgbnf.exe
        
        C:\Windows\system32\Jmmcgbnf.exe
        519⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        521⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        522⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        523⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Jckeokan.exe
        
        C:\Windows\system32\Jckeokan.exe
        524⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        525⤵
        Drops file in System32 directory
        
        PID:7900
        
        C:\Windows\SysWOW64\Jqofippg.exe
        
        C:\Windows\system32\Jqofippg.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        527⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        528⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        529⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        530⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        531⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Kpilekqj.exe
        
        C:\Windows\system32\Kpilekqj.exe
        533⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        534⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        535⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        536⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        537⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        538⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        540⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        541⤵
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        542⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        543⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        544⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        545⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        546⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        547⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        548⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        549⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        550⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Libido32.exe
        
        C:\Windows\system32\Libido32.exe
        551⤵
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        552⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        553⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        554⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        555⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        556⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        557⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        558⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        559⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        560⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        561⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Mabdlk32.exe
        
        C:\Windows\system32\Mabdlk32.exe
        562⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Mhmmieil.exe
        
        C:\Windows\system32\Mhmmieil.exe
        563⤵
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        564⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Nipffmmg.exe
        
        C:\Windows\system32\Nipffmmg.exe
        565⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        566⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        567⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        568⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        569⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        570⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        571⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        572⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        573⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Niglfl32.exe
        
        C:\Windows\system32\Niglfl32.exe
        574⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        575⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        576⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        577⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        578⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        579⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        580⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        581⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        582⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        583⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        584⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oahgnh32.exe
        
        C:\Windows\system32\Oahgnh32.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Ogdofo32.exe
        
        C:\Windows\system32\Ogdofo32.exe
        586⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        587⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        588⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        589⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        590⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        591⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        592⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        593⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        594⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        595⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        596⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        597⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        598⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        599⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Pphckb32.exe
        
        C:\Windows\system32\Pphckb32.exe
        600⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        601⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Pnlcdg32.exe
        
        C:\Windows\system32\Pnlcdg32.exe
        602⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        603⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        604⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Qajlje32.exe
        
        C:\Windows\system32\Qajlje32.exe
        605⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9904
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        607⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        608⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        609⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10036
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        610⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        611⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        612⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        613⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        614⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        615⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9256
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        616⤵
        Drops file in System32 directory
        
        PID:9308
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        617⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        618⤵
        Modifies registry class
        
        PID:9468
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        619⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        620⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        621⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        622⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        623⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        624⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        625⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        626⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ceeaim32.exe
        
        C:\Windows\system32\Ceeaim32.exe
        627⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        628⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        629⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        630⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        631⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9444
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        632⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        633⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        634⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        635⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        636⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        637⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        638⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        639⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        640⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        641⤵
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        642⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        643⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        644⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        645⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        646⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        647⤵
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Eihlahjd.exe
        
        C:\Windows\system32\Eihlahjd.exe
        648⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        649⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Eeomfioh.exe
        
        C:\Windows\system32\Eeomfioh.exe
        650⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ehmibdol.exe
        
        C:\Windows\system32\Ehmibdol.exe
        651⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Engaon32.exe
        
        C:\Windows\system32\Engaon32.exe
        652⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        653⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ejnbdp32.exe
        
        C:\Windows\system32\Ejnbdp32.exe
        654⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Eahjqicj.exe
        
        C:\Windows\system32\Eahjqicj.exe
        655⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Flmonbbp.exe
        
        C:\Windows\system32\Flmonbbp.exe
        656⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Fajgfiag.exe
        
        C:\Windows\system32\Fajgfiag.exe
        657⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9792
        
        C:\Windows\SysWOW64\Fbjcplhj.exe
        
        C:\Windows\system32\Fbjcplhj.exe
        659⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Ficlmf32.exe
        
        C:\Windows\system32\Ficlmf32.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10316
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        661⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Fifhbf32.exe
        
        C:\Windows\system32\Fifhbf32.exe
        662⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Foenplji.exe
        
        C:\Windows\system32\Foenplji.exe
        663⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Feofmf32.exe
        
        C:\Windows\system32\Feofmf32.exe
        664⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Gklnem32.exe
        
        C:\Windows\system32\Gklnem32.exe
        665⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Gaffbg32.exe
        
        C:\Windows\system32\Gaffbg32.exe
        666⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Glkkop32.exe
        
        C:\Windows\system32\Glkkop32.exe
        667⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        668⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Ghbkdald.exe
        
        C:\Windows\system32\Ghbkdald.exe
        669⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        670⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        671⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Gbjlgj32.exe
        
        C:\Windows\system32\Gbjlgj32.exe
        672⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Giddddad.exe
        
        C:\Windows\system32\Giddddad.exe
        673⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Gkeakl32.exe
        
        C:\Windows\system32\Gkeakl32.exe
        674⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Gaoihfoo.exe
        
        C:\Windows\system32\Gaoihfoo.exe
        675⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Hhiaepfl.exe
        
        C:\Windows\system32\Hhiaepfl.exe
        676⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Hocjaj32.exe
        
        C:\Windows\system32\Hocjaj32.exe
        677⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        678⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        679⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        680⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11208
        
        C:\Windows\SysWOW64\Hepoddcc.exe
        
        C:\Windows\system32\Hepoddcc.exe
        681⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        682⤵
        Drops file in System32 directory
        
        PID:10244
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        683⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        684⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        685⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        686⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        687⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Iheaqolo.exe
        
        C:\Windows\system32\Iheaqolo.exe
        688⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Iooimi32.exe
        
        C:\Windows\system32\Iooimi32.exe
        689⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        690⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        691⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        692⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Ileflmpb.exe
        
        C:\Windows\system32\Ileflmpb.exe
        693⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Iocchhof.exe
        
        C:\Windows\system32\Iocchhof.exe
        694⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        695⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        696⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        697⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ifphkbep.exe
        
        C:\Windows\system32\Ifphkbep.exe
        698⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        699⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Jfbdpabn.exe
        
        C:\Windows\system32\Jfbdpabn.exe
        700⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Jllmml32.exe
        
        C:\Windows\system32\Jllmml32.exe
        701⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        702⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        703⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        704⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        705⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        706⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        707⤵
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Jfikaqme.exe
        
        C:\Windows\system32\Jfikaqme.exe
        708⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Jkfcigkm.exe
        
        C:\Windows\system32\Jkfcigkm.exe
        709⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        710⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Jmepcj32.exe
        
        C:\Windows\system32\Jmepcj32.exe
        711⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        712⤵
        Drops file in System32 directory
        
        PID:10268
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        713⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        714⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        715⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        716⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        717⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Kkofofbb.exe
        
        C:\Windows\system32\Kkofofbb.exe
        718⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Kbinlp32.exe
        
        C:\Windows\system32\Kbinlp32.exe
        719⤵
        Modifies registry class
        
        PID:10868
        
        C:\Windows\SysWOW64\Kmobii32.exe
        
        C:\Windows\system32\Kmobii32.exe
        720⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Kblkap32.exe
        
        C:\Windows\system32\Kblkap32.exe
        721⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        722⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        723⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        724⤵
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        725⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        726⤵
        Modifies registry class
        
        PID:10416
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        727⤵
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        728⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        729⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        730⤵
        Drops file in System32 directory
        
        PID:11008
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        731⤵
        Modifies registry class
        
        PID:11148
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        732⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        733⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Lbgjmnno.exe
        
        C:\Windows\system32\Lbgjmnno.exe
        734⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        735⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        736⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10796
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        737⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        738⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        739⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        740⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        741⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Mldhacpj.exe
        
        C:\Windows\system32\Mldhacpj.exe
        742⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        743⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Mihikgod.exe
        
        C:\Windows\system32\Mihikgod.exe
        744⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Mpbaga32.exe
        
        C:\Windows\system32\Mpbaga32.exe
        745⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        746⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        747⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        748⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        749⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9144
        
        C:\Windows\SysWOW64\Nlknbb32.exe
        
        C:\Windows\system32\Nlknbb32.exe
        750⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        751⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Njmopj32.exe
        
        C:\Windows\system32\Njmopj32.exe
        752⤵
        Modifies registry class
        
        PID:10800
        
        C:\Windows\SysWOW64\Nlnkgbhp.exe
        
        C:\Windows\system32\Nlnkgbhp.exe
        753⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Nbhcdl32.exe
        
        C:\Windows\system32\Nbhcdl32.exe
        754⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Niblafgi.exe
        
        C:\Windows\system32\Niblafgi.exe
        755⤵
        Drops file in System32 directory
        
        PID:11356
        
        C:\Windows\SysWOW64\Npldnp32.exe
        
        C:\Windows\system32\Npldnp32.exe
        756⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Nffljjfc.exe
        
        C:\Windows\system32\Nffljjfc.exe
        757⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Nmpdgdmp.exe
        
        C:\Windows\system32\Nmpdgdmp.exe
        758⤵
        Modifies registry class
        
        PID:11476
        
        C:\Windows\SysWOW64\Ndjldo32.exe
        
        C:\Windows\system32\Ndjldo32.exe
        759⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Njceqili.exe
        
        C:\Windows\system32\Njceqili.exe
        760⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        761⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11608 -s 400
        762⤵
        Program crash
        
        PID:11688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 11608 -ip 11608
1⤵
PID:11636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Achegd32.exe

Filesize
136KB

MD5
2633720b92b9f40b4b35cb7504866b22

SHA1
8948c2edb042f2d57ecb17d46bf9e9cc76a20bd6

SHA256
06ef5207ea2de0f914733197aad60f9989f5efe915209ac648add1e323f8c646

SHA512
ebdf6cb873e219b65d4689be01c5c4e91ecb58ee204ea18142dbd456b647fce21d5b7be5f6c51bc9e330004c7a5c9cd99f82cb210cfa942eb487223c48b70289

Download Submit
C:\Windows\SysWOW64\Achegd32.exe

Filesize
136KB

MD5
2633720b92b9f40b4b35cb7504866b22

SHA1
8948c2edb042f2d57ecb17d46bf9e9cc76a20bd6

SHA256
06ef5207ea2de0f914733197aad60f9989f5efe915209ac648add1e323f8c646

SHA512
ebdf6cb873e219b65d4689be01c5c4e91ecb58ee204ea18142dbd456b647fce21d5b7be5f6c51bc9e330004c7a5c9cd99f82cb210cfa942eb487223c48b70289

Download Submit
C:\Windows\SysWOW64\Aeddnp32.exe

Filesize
136KB

MD5
dfb00b3b132df98026963257ef6fe0cd

SHA1
054b0ecc0c16c17dad3587f9805d5c20188ccbc1

SHA256
dbabe942772d449c1389a4e4737c1c52859b77c916baa2e3d229717c1e31a961

SHA512
2034b7f7b177f198d0755ed007ff068fcee0af353304fe2b9c71f3d49298a50bfecf1c651318ee9584f4db1c2319fd34c65d76203401b801ec545fabbd711b08

Download Submit
C:\Windows\SysWOW64\Aeddnp32.exe

Filesize
136KB

MD5
dfb00b3b132df98026963257ef6fe0cd

SHA1
054b0ecc0c16c17dad3587f9805d5c20188ccbc1

SHA256
dbabe942772d449c1389a4e4737c1c52859b77c916baa2e3d229717c1e31a961

SHA512
2034b7f7b177f198d0755ed007ff068fcee0af353304fe2b9c71f3d49298a50bfecf1c651318ee9584f4db1c2319fd34c65d76203401b801ec545fabbd711b08

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
136KB

MD5
03b6d6491afe7ed531ef52ffbfc5d1b1

SHA1
ea76d8f9d86c70dd2e2dc3411fc25a5f7d340a4e

SHA256
ba122bc0df0b544f9e483c87c7173abf8289e118402e5ae28f6c81b6a7c11e0a

SHA512
510983feb9a922ec9b51f428e48efc94a1003e2eac16005b7cbbae8ebc6ed499cc49530d3abac6fe88a47e7cc343e69fac7e972536a1fde21ae00bbee1d10265

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
136KB

MD5
03b6d6491afe7ed531ef52ffbfc5d1b1

SHA1
ea76d8f9d86c70dd2e2dc3411fc25a5f7d340a4e

SHA256
ba122bc0df0b544f9e483c87c7173abf8289e118402e5ae28f6c81b6a7c11e0a

SHA512
510983feb9a922ec9b51f428e48efc94a1003e2eac16005b7cbbae8ebc6ed499cc49530d3abac6fe88a47e7cc343e69fac7e972536a1fde21ae00bbee1d10265

Download Submit
C:\Windows\SysWOW64\Ajdjin32.exe

Filesize
136KB

MD5
ab225ac9ed7fa2f447a7efb157845880

SHA1
3a38283787f8e68029e203616e2818b959331898

SHA256
8aff4c1d431c042cd82869bcaa1769e37ec3ac5b677a20284c6ac5a823b85c3b

SHA512
dffc73bde937f59ec5f4ad9ccee4c4fd1fca18fb5ed0df3a140584947ead2ee764ca80dd65380dd4130fc70b38a9a884399e64b8982dac00208bd4d25f52dd80

Download Submit
C:\Windows\SysWOW64\Ajdjin32.exe

Filesize
136KB

MD5
ab225ac9ed7fa2f447a7efb157845880

SHA1
3a38283787f8e68029e203616e2818b959331898

SHA256
8aff4c1d431c042cd82869bcaa1769e37ec3ac5b677a20284c6ac5a823b85c3b

SHA512
dffc73bde937f59ec5f4ad9ccee4c4fd1fca18fb5ed0df3a140584947ead2ee764ca80dd65380dd4130fc70b38a9a884399e64b8982dac00208bd4d25f52dd80

Download Submit
C:\Windows\SysWOW64\Ajjokd32.exe

Filesize
136KB

MD5
ced2cc765620bf8b88ffb5c098ada013

SHA1
7185d9c30318ebe1e911f03d6a82a03b6969fafe

SHA256
fd9f29c34179b0ba55625b0e0103cf71cf5f07b40105ee0198ba9c2d8c96efe8

SHA512
6970cd2a178b189e49a7da2e3c8795b87c2b5f1139c3fad27d73a0f03d39faca13a2e631262e3db5056f48028de615856df8fae4cf2b29c99cfa0ec969c84a9d

Download Submit
C:\Windows\SysWOW64\Ajmgof32.exe

Filesize
136KB

MD5
7c6c5bbda94b94c0d0ec8412bc1aa36d

SHA1
473d1896f9bfec5910a8b4a1e022ae6cf970eca8

SHA256
6d67534c48d9edc14b437b36080341f01c5a429992f2d221ea9a1357ff1588d2

SHA512
6277c4aec8dce8891fd3335e381fd38b55a87909c9f8d188567714cd04b708cea98d4311174abb92823c79ccf3a3e74769e4dbf275da9f588d693a7e9feeb5fe

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
136KB

MD5
4c042e66c0aa21212b9cbe26478e3488

SHA1
e21e4d2181a333b958cf9e78426e27eae7ed1b8d

SHA256
500abf3ea307e431ac221331570dc4199b0597185a1b9679836c52ab392a4aff

SHA512
9d8aabaeb5280d82a39d5cb78711d028b2ec015e8b07e69539f324d9b61e1b3f081eb36051017353ef7368ce18229289e8156f9b54d0d2fc9850878e3228b01d

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
136KB

MD5
4c042e66c0aa21212b9cbe26478e3488

SHA1
e21e4d2181a333b958cf9e78426e27eae7ed1b8d

SHA256
500abf3ea307e431ac221331570dc4199b0597185a1b9679836c52ab392a4aff

SHA512
9d8aabaeb5280d82a39d5cb78711d028b2ec015e8b07e69539f324d9b61e1b3f081eb36051017353ef7368ce18229289e8156f9b54d0d2fc9850878e3228b01d

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
136KB

MD5
4c042e66c0aa21212b9cbe26478e3488

SHA1
e21e4d2181a333b958cf9e78426e27eae7ed1b8d

SHA256
500abf3ea307e431ac221331570dc4199b0597185a1b9679836c52ab392a4aff

SHA512
9d8aabaeb5280d82a39d5cb78711d028b2ec015e8b07e69539f324d9b61e1b3f081eb36051017353ef7368ce18229289e8156f9b54d0d2fc9850878e3228b01d

Download Submit
C:\Windows\SysWOW64\Allpejfe.exe

Filesize
136KB

MD5
3749a3a5d41ffed832582404a6b9c7d9

SHA1
af0ceb5de32f3950d1da7d42bff9a4ccd92f4bf3

SHA256
b0230f1f6f37910c156329729bd64f7600eb4e9b62ca51e79521a3df89c230e2

SHA512
d8a90267565a23a89f52a7ea895664b50e9d82d2c646bc4954914317fad0d9a7f194dd358bdfadc3c9b926886ee825a2b862fbe40f32c6df4170120ccef7dffc

Download Submit
C:\Windows\SysWOW64\Allpejfe.exe

Filesize
136KB

MD5
3749a3a5d41ffed832582404a6b9c7d9

SHA1
af0ceb5de32f3950d1da7d42bff9a4ccd92f4bf3

SHA256
b0230f1f6f37910c156329729bd64f7600eb4e9b62ca51e79521a3df89c230e2

SHA512
d8a90267565a23a89f52a7ea895664b50e9d82d2c646bc4954914317fad0d9a7f194dd358bdfadc3c9b926886ee825a2b862fbe40f32c6df4170120ccef7dffc

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
136KB

MD5
ad047e3c47446443e1d1a70f2e1505f0

SHA1
eacf9f72e4fc2cc4a65ea9748a0ff6b7db7338a1

SHA256
273bc02011a50ff92cfeb6f6d0a326dda9cded775150dc0578ba7c8bb18f6b5b

SHA512
9b2c4506433cdc19c201d25ce9382ced2575448ae959a2a653809a05de66c377add41fb17d2ba7fe59d710562088e362c16b0cee09935999f66c0a0454fd63fb

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
136KB

MD5
ad047e3c47446443e1d1a70f2e1505f0

SHA1
eacf9f72e4fc2cc4a65ea9748a0ff6b7db7338a1

SHA256
273bc02011a50ff92cfeb6f6d0a326dda9cded775150dc0578ba7c8bb18f6b5b

SHA512
9b2c4506433cdc19c201d25ce9382ced2575448ae959a2a653809a05de66c377add41fb17d2ba7fe59d710562088e362c16b0cee09935999f66c0a0454fd63fb

Download Submit
C:\Windows\SysWOW64\Bhldpj32.exe

Filesize
136KB

MD5
9caf4345130100456d11e128edbe9528

SHA1
f805304c1c2f4cdfedf977f6c6ba2927cd24ff15

SHA256
18b1715d6a04c8acc1cab5e8dfc5a0affd5fbae0b0d95b2b04d2022fbb8d4f9c

SHA512
984c08d71207fc22b775a882c4ef3475a30a52e363b21628dcdbb6851a69b62cb26ba63bcb1327190a157a833fc512768e2ee42d4a0082c92cf873daf594a038

Download Submit
C:\Windows\SysWOW64\Bhldpj32.exe

Filesize
136KB

MD5
9caf4345130100456d11e128edbe9528

SHA1
f805304c1c2f4cdfedf977f6c6ba2927cd24ff15

SHA256
18b1715d6a04c8acc1cab5e8dfc5a0affd5fbae0b0d95b2b04d2022fbb8d4f9c

SHA512
984c08d71207fc22b775a882c4ef3475a30a52e363b21628dcdbb6851a69b62cb26ba63bcb1327190a157a833fc512768e2ee42d4a0082c92cf873daf594a038

Download Submit
C:\Windows\SysWOW64\Bhldpj32.exe

Filesize
136KB

MD5
9caf4345130100456d11e128edbe9528

SHA1
f805304c1c2f4cdfedf977f6c6ba2927cd24ff15

SHA256
18b1715d6a04c8acc1cab5e8dfc5a0affd5fbae0b0d95b2b04d2022fbb8d4f9c

SHA512
984c08d71207fc22b775a882c4ef3475a30a52e363b21628dcdbb6851a69b62cb26ba63bcb1327190a157a833fc512768e2ee42d4a0082c92cf873daf594a038

Download Submit
C:\Windows\SysWOW64\Bjlpjm32.exe

Filesize
136KB

MD5
bbf108931ffd703a52fdcdf909da26e9

SHA1
c0da481a8e182c4619a4ea1a47f376df4c508fab

SHA256
147db39670b2b1a58e4fb6f12d1e81e8383987b5c3d455be10562efdb7d0b79c

SHA512
8749e11d9290a30bb49639c8090cf3f42e3bd2f168dd58388e2948f6662863178b4bd29aafd947c78c2e75ec37a17a4d6573abb265e5f808b53d051c6fdb58f8

Download Submit
C:\Windows\SysWOW64\Bjlpjm32.exe

Filesize
136KB

MD5
bbf108931ffd703a52fdcdf909da26e9

SHA1
c0da481a8e182c4619a4ea1a47f376df4c508fab

SHA256
147db39670b2b1a58e4fb6f12d1e81e8383987b5c3d455be10562efdb7d0b79c

SHA512
8749e11d9290a30bb49639c8090cf3f42e3bd2f168dd58388e2948f6662863178b4bd29aafd947c78c2e75ec37a17a4d6573abb265e5f808b53d051c6fdb58f8

Download Submit
C:\Windows\SysWOW64\Cbnbhfde.exe

Filesize
128KB

MD5
8694769c31814105d8121ae22af1fe42

SHA1
be4b9711a489b87fa9ee4908c98a4f303613f9f8

SHA256
5443d5f6195d3203a9db0a3484790df33230d93a75c3e33732a3c2850c1a851d

SHA512
f0254ff51c500d0fbdf877f50bf043a7732fda46e8c2c3b307e19126cc3f6472f1ad766b719bd2edc1a3c6d86e55da95d02fa4300ad4888e6396a82cf8d3e042

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
136KB

MD5
8869ac8782df0e4f06a460eeaae38027

SHA1
b18e2f7fedb7b714d801abaeda3f666fe78d42ab

SHA256
2a594172a3fbf6d99cee0cb6f24f907bf5aa94a11b7abf6ebeca8207fc8c57a5

SHA512
3e6994f6eb7f82af3ee915bc760b0c01c8cf930802d5ae201c513e9677c528e8eda08a864e2b37c88c9228fd467b8113ca3ded9215f727e48e35028e2d97e7f7

Download Submit
C:\Windows\SysWOW64\Dbjkkl32.exe

Filesize
136KB

MD5
61275261fdc95187b4af4e6a0d9e6dc9

SHA1
85eb0d91ad2659b6990c943d0e302dc4fd3f4686

SHA256
0036966c45d5a63a2ecfb14faa11ca7022aba1f5ce5e50cddeb56fe62eb70434

SHA512
e1c8b08a92bb8f0bd17aeca9ab2d7e7a9633695506398bd3f79391833850312568edc283b1ea4b472cd4bf37d64836e58b7ebd8b7fa997034690260cbc4f09b6

Download Submit
C:\Windows\SysWOW64\Dcphdqmj.exe

Filesize
136KB

MD5
6c4a069f1cb46d2c9e6c7c7229d7e197

SHA1
b3e28b7830751e3aad3e14d5bd7e676664747257

SHA256
33ac52b6f0150eb6fa6f92fc02f9cf570f13e21effacf8fb6725a276738536c3

SHA512
c8d38afdcd7441d7074f2a8de12f8b68cfc412d4dacd865389a17dbd14c25886dfcc1aedcb90c546e067360a52401d20b19bfc86e74c2e71be574f23c8c21402

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
136KB

MD5
bbf36b40ac0d9580398be81184d9144e

SHA1
a8a20353101d35250a75009a0df2084aa25b3b44

SHA256
cae8bdc2186bf6f12c5af2801a6e4e62cd02946e104624d81c14516a4437e342

SHA512
9c8850ac2133d1fcb2e7c02db04919b5761ad9d9a60b397f8b9991d7b3582f9787d6a7dbc40b3e23212163c685017b5a1612b8401f3607fa20fa4ec8585a6f6e

Download Submit
C:\Windows\SysWOW64\Epeohn32.exe

Filesize
136KB

MD5
2830b6649171eb955e2bb40117ae3433

SHA1
4ee4f1f1b1fa798e9d0d8e84c8af33a3cd3cfcea

SHA256
ec88549afc5fb7ce36934a8291d4a580f6de92453857bdc0c4d792e10f1c4abe

SHA512
91b30007d082c30c1135572c8f259fea23ec32beeb8ba2f5b976143aed817851642a8c7bfb800fd5b7fb21f092352974b7a034a4d406217f67de6a184e232a2e

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
136KB

MD5
e7a44b7465afb35e2aa4b73405e5d6d2

SHA1
70290b77ceb9b8b5ddad4899845865d61f82e473

SHA256
bec3098a099d44f034f1727e0a47add14cbd2152e8a06c6cd35ae7459d47a400

SHA512
7d9d2003fa260ecdb6449567c7af4796878f125d9e9f28c397bc4fcdf81d4bdc412fed2406cd30a6b50973bae37ef6962bc6782bdf0c3a6d80d9cb96b50d00be

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
136KB

MD5
7a3fd2eed5ca7538607518492f8bfbc8

SHA1
b1c83957efa70195e7901234741edd9ddee470e1

SHA256
0997a39458cda91f09172237cc109191839584f11bd63347d48e8059bbe41bb6

SHA512
38f93057ae5516bc381ffae37d87991a4a946aa722e00db4ca1dced570b7c2d566746e6aa8788b9a3f2887a6e6f90b466f11fe13c56f01b281974680492504f8

Download Submit
C:\Windows\SysWOW64\Gljgbllj.exe

Filesize
136KB

MD5
685ba210fe9c64021ed49c5439ea1994

SHA1
78157002c0ebe967c8478bd6f223947d08397279

SHA256
60307448bf2fd20b776fc70e22307d97603ed50f22346fc713c818508baa57a6

SHA512
32d17070fb78fef5a8e38b579ec2eebbd54b9a05090436404f1e9ea3b7c4d6863e3e329efa69f0ab15d53f5555c2a75c2b10dcbd08211db5ea434de009ba714e

Download Submit
C:\Windows\SysWOW64\Hildmn32.exe

Filesize
136KB

MD5
8d9ccb0c467658bd44eebdf0f5b5cff3

SHA1
950081114081e4df418b858bcb51ed76127e7af5

SHA256
06fd584ddd390247fc99562466424d06fc1bd79fa93d2f5b43e3381d9fe90b0f

SHA512
ac6e907574c5b3c9daa648f09aa3750010d9402b33d2419ec29b4720b0b704be8f38c40141018d1ac31f9fca2358a744eac8f6e58e0c88eac50974343283e7f4

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
136KB

MD5
b3acdc0c3b8ebe10804edc19b9216152

SHA1
37f3b836c79da196b1e6a7b18b486bcb8363bdb1

SHA256
b985e7769bb66829f6da0f30431718966faf0dc105922d6b6a7078c43f9c1d68

SHA512
c0848a897f0278149d92f118c4a5d86a1d16f49eaa550ebe30b292ee20fa1a194a7cd5dd53bc91c7df221f994aa00a02808c1e5996329eff197a6e607bdc5311

Download Submit
C:\Windows\SysWOW64\Ijdnka32.exe

Filesize
136KB

MD5
5f487b567b3531e6f1d0c5be9119894d

SHA1
da573d511bac3381a434a8213f4880a0887025ae

SHA256
24343c3bb66f0b51b64b4778fb28e7f65868cbdb8a342c286892ea8870aaaead

SHA512
de7d38f519511d7ac2952e02c784494816437542cb115bd143250dad565f668a9effb2e7fce154248671973436b939778d274d413eda0179e8b05464a6474af8

Download Submit
C:\Windows\SysWOW64\Iqdfmajd.exe

Filesize
136KB

MD5
d70c06cc396e2d6b81150d118d12f3ab

SHA1
0ffb9a9f45a25f65fd80d8ef96ec006202624222

SHA256
c356b9a014fc374de980b5c355b49256bd14d58f23f520e06be8a82db650386f

SHA512
54bdd8ecacefb81f24d1a3712365870c318078581c37daf629d42bd2c58bc4ebe0406ef983648a81f14b54be3e58455d7bd786779a8b5c30b37c65e93e37a007

Download Submit
C:\Windows\SysWOW64\Mblcnj32.exe

Filesize
136KB

MD5
72acdbb0e199fe23df4be183b9ef2e9b

SHA1
8d5563c0405b6f668c6569246ae23c41fee9c174

SHA256
73a60e2d99a27f32d2507c00679d567d588f6eb44e6513043bc124fa55622d47

SHA512
f53cf52846e3fdad14384984256ce35e1c6e36d4b602f3449c69bf0851ffbd690f0e52b5d643c94ed7b05251e41287402349c918c5aa112b93d1bb576d570747

Download Submit
C:\Windows\SysWOW64\Mblcnj32.exe

Filesize
136KB

MD5
72acdbb0e199fe23df4be183b9ef2e9b

SHA1
8d5563c0405b6f668c6569246ae23c41fee9c174

SHA256
73a60e2d99a27f32d2507c00679d567d588f6eb44e6513043bc124fa55622d47

SHA512
f53cf52846e3fdad14384984256ce35e1c6e36d4b602f3449c69bf0851ffbd690f0e52b5d643c94ed7b05251e41287402349c918c5aa112b93d1bb576d570747

Download Submit
C:\Windows\SysWOW64\Mnlnbl32.exe

Filesize
136KB

MD5
7ea0b3e45329aa209ff6c758558528be

SHA1
acd74df41f58999236bfa3b647a9e6bb7a6d3ee3

SHA256
f69cbe8830235063e5c52848d870ef1d62a255983788eb1bf27212a8ee43a8f0

SHA512
658a2d6fa0136483dd07e5d1a178c16f612de4985e06a833588742f116e57e7964f2baa878efcd82a03b9d62be2ffcc52c8da3ef531c764a2d5b5c4819c3af66

Download Submit
C:\Windows\SysWOW64\Mnlnbl32.exe

Filesize
136KB

MD5
7ea0b3e45329aa209ff6c758558528be

SHA1
acd74df41f58999236bfa3b647a9e6bb7a6d3ee3

SHA256
f69cbe8830235063e5c52848d870ef1d62a255983788eb1bf27212a8ee43a8f0

SHA512
658a2d6fa0136483dd07e5d1a178c16f612de4985e06a833588742f116e57e7964f2baa878efcd82a03b9d62be2ffcc52c8da3ef531c764a2d5b5c4819c3af66

Download Submit
C:\Windows\SysWOW64\Najceeoo.exe

Filesize
136KB

MD5
10db19e10dfe49a4316db0c8e9edde1f

SHA1
fe7ad0669c91734118945a2f92dcdb9a3d083e6a

SHA256
c2883454b8ba70d49e0e9edd9b5aeb8a2094157791cb8fc389d87029a8e5bd0e

SHA512
b672311cc1befcc348c75b7a14f8ea6171841890186b967d199b0df35f64ee8300407fc15d18bfe1bd96c3a6e82f26d40f2c8b6ffbb843e3b88a8098af54fc95

Download Submit
C:\Windows\SysWOW64\Najceeoo.exe

Filesize
136KB

MD5
10db19e10dfe49a4316db0c8e9edde1f

SHA1
fe7ad0669c91734118945a2f92dcdb9a3d083e6a

SHA256
c2883454b8ba70d49e0e9edd9b5aeb8a2094157791cb8fc389d87029a8e5bd0e

SHA512
b672311cc1befcc348c75b7a14f8ea6171841890186b967d199b0df35f64ee8300407fc15d18bfe1bd96c3a6e82f26d40f2c8b6ffbb843e3b88a8098af54fc95

Download Submit
C:\Windows\SysWOW64\Nbnpcj32.exe

Filesize
136KB

MD5
6ba16ae2b5ec1390e2cf436ab5eb8057

SHA1
bc2e8acd060f34425acdbcded0479d596948fa9a

SHA256
e8d2fe193105748c1d4f272f24875e5cc81693b2e89582af8e3f7da2272c634a

SHA512
69e64145d1c5d2aa03d469b0cb3a8a482aca25138e3e952a35a190468b0304c72f176496b3c6ad8f23621efe617956cd4126603032ae12e11877d33c78a81d5d

Download Submit
C:\Windows\SysWOW64\Nbnpcj32.exe

Filesize
136KB

MD5
6ba16ae2b5ec1390e2cf436ab5eb8057

SHA1
bc2e8acd060f34425acdbcded0479d596948fa9a

SHA256
e8d2fe193105748c1d4f272f24875e5cc81693b2e89582af8e3f7da2272c634a

SHA512
69e64145d1c5d2aa03d469b0cb3a8a482aca25138e3e952a35a190468b0304c72f176496b3c6ad8f23621efe617956cd4126603032ae12e11877d33c78a81d5d

Download Submit
C:\Windows\SysWOW64\Niooqcad.exe

Filesize
136KB

MD5
5330608f6c2d6ba77db660677e0d23c0

SHA1
3e84bbcbefa42c5f0c5c34b6dd01033906279fb5

SHA256
d2abc38aa9abbf63a72ba4295c1e8bad642b00544b16062a3b545d868686bcb4

SHA512
c9465b57186ecf7466e4e594287a18f9d3ad7e049188fc5499aa4f54ec6e228f32f07ea8eefbc8a3ca9607c8e8217c1a32391104921b3218ccbd36d50097ac5b

Download Submit
C:\Windows\SysWOW64\Niooqcad.exe

Filesize
136KB

MD5
5330608f6c2d6ba77db660677e0d23c0

SHA1
3e84bbcbefa42c5f0c5c34b6dd01033906279fb5

SHA256
d2abc38aa9abbf63a72ba4295c1e8bad642b00544b16062a3b545d868686bcb4

SHA512
c9465b57186ecf7466e4e594287a18f9d3ad7e049188fc5499aa4f54ec6e228f32f07ea8eefbc8a3ca9607c8e8217c1a32391104921b3218ccbd36d50097ac5b

Download Submit
C:\Windows\SysWOW64\Nklbmllg.exe

Filesize
136KB

MD5
2bd6eda5ba52c40a3c76bed5c0c5b475

SHA1
6c1f1d444affb65bba8172615d75a6c935acf6d2

SHA256
272ddc64096f500d8602b95de7e16bf9c2c1ecb42b0be2b6d3fe41bacf6fd801

SHA512
f07c9ba6a1881656ac4c9de95c15e56e41729c7f38aa6ab21a62d6ee04574564eb375a575fe148976b6a60f5053309c9cb58a29dbedb54da4daeb0bba61206b6

Download Submit
C:\Windows\SysWOW64\Nklbmllg.exe

Filesize
136KB

MD5
2bd6eda5ba52c40a3c76bed5c0c5b475

SHA1
6c1f1d444affb65bba8172615d75a6c935acf6d2

SHA256
272ddc64096f500d8602b95de7e16bf9c2c1ecb42b0be2b6d3fe41bacf6fd801

SHA512
f07c9ba6a1881656ac4c9de95c15e56e41729c7f38aa6ab21a62d6ee04574564eb375a575fe148976b6a60f5053309c9cb58a29dbedb54da4daeb0bba61206b6

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
136KB

MD5
bf7457861343866200a12b7faea2f0e9

SHA1
6c05c61060ababf9faadc9be53590ee429d0443c

SHA256
541da8641fb879b7722011e05817c0ef7948f4dcb0a66e1439113154b0071271

SHA512
d9734ae63ec3479f5ba2807570e23c3942827690f6e234ae4c709cb81f7751c49765825aacb6c02673dd43163ff531e5c11e7d7106bb9031af2402e545954bef

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
136KB

MD5
bf7457861343866200a12b7faea2f0e9

SHA1
6c05c61060ababf9faadc9be53590ee429d0443c

SHA256
541da8641fb879b7722011e05817c0ef7948f4dcb0a66e1439113154b0071271

SHA512
d9734ae63ec3479f5ba2807570e23c3942827690f6e234ae4c709cb81f7751c49765825aacb6c02673dd43163ff531e5c11e7d7106bb9031af2402e545954bef

Download Submit
C:\Windows\SysWOW64\Noeahkfc.exe

Filesize
136KB

MD5
ce1ba34a763c08950ca057c3a86d1b78

SHA1
51a20df348d819dfd766c8bd7cc344a99e0a4715

SHA256
2f67147a08da8152621627c26d99726b041fa668bf2987a24fc7c0cc2fbacf7a

SHA512
38de5b0e4f34e41351f7e9f84c572eabfbb841ad3e524aab7d57f511fd0db4f6825537a45d5bf20c27a1ff69f3a6b92b531fac8bd95213478d63b3503e3ddeb5

Download Submit
C:\Windows\SysWOW64\Noeahkfc.exe

Filesize
136KB

MD5
ce1ba34a763c08950ca057c3a86d1b78

SHA1
51a20df348d819dfd766c8bd7cc344a99e0a4715

SHA256
2f67147a08da8152621627c26d99726b041fa668bf2987a24fc7c0cc2fbacf7a

SHA512
38de5b0e4f34e41351f7e9f84c572eabfbb841ad3e524aab7d57f511fd0db4f6825537a45d5bf20c27a1ff69f3a6b92b531fac8bd95213478d63b3503e3ddeb5

Download Submit
C:\Windows\SysWOW64\Obfhmd32.exe

Filesize
136KB

MD5
aebecc0affd5e570d576e95c1c191816

SHA1
3495969d865692154b5ce39c6f819556f0fb8809

SHA256
5ff15faede238fd1512fc862385b606684eb5250c7aed9c7b74337231159c580

SHA512
7817e9504d205269c8a32074174291c1c63e38524aa3f8c35507d346c7dcceabf44d0466131d77d1ff527d51d56bf49bc0f38244df9efe541643bbf6bb674ee1

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
136KB

MD5
6b0299742dbabec6361970d1e2f561ab

SHA1
ef928fc6d96f282f3d17908951a660d59d1b8056

SHA256
cfdb8bdb245e894e50663cc51a472d28b99ca016857a59242a1ce05e52082bc2

SHA512
81720c34312947a95ad914e1a564e2f9b4b4a2a4c1cc178c7efe5bcb58b9c636794306d91d1bf4ba739f104ebc762093a7f731735ed4a0759a8f36d96a75dd29

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
136KB

MD5
6b0299742dbabec6361970d1e2f561ab

SHA1
ef928fc6d96f282f3d17908951a660d59d1b8056

SHA256
cfdb8bdb245e894e50663cc51a472d28b99ca016857a59242a1ce05e52082bc2

SHA512
81720c34312947a95ad914e1a564e2f9b4b4a2a4c1cc178c7efe5bcb58b9c636794306d91d1bf4ba739f104ebc762093a7f731735ed4a0759a8f36d96a75dd29

Download Submit
C:\Windows\SysWOW64\Oeaoab32.exe

Filesize
136KB

MD5
255eb90c2473ab6c3229804c5e24707c

SHA1
1da6186f489749104f1456dbd4ce8aebc1667750

SHA256
b961a691ccd8a07e4ceeadf8ed3bc26c07d3aed15417633e3a184ad5d6526821

SHA512
7a0d7ab453c67d07c3d039311d488a09384e1cc333175d4951b81ae318597ed741115c44491181fcffd7ae31be8bf10866cb5eba057a2558b4ca1a3e0d3a8c6a

Download Submit
C:\Windows\SysWOW64\Oeaoab32.exe

Filesize
136KB

MD5
255eb90c2473ab6c3229804c5e24707c

SHA1
1da6186f489749104f1456dbd4ce8aebc1667750

SHA256
b961a691ccd8a07e4ceeadf8ed3bc26c07d3aed15417633e3a184ad5d6526821

SHA512
7a0d7ab453c67d07c3d039311d488a09384e1cc333175d4951b81ae318597ed741115c44491181fcffd7ae31be8bf10866cb5eba057a2558b4ca1a3e0d3a8c6a

Download Submit
C:\Windows\SysWOW64\Oehlkc32.exe

Filesize
136KB

MD5
fc369f22c63a3f77259d600c46d3a37e

SHA1
75a8094f482ff733bb57513533c3ae3e705ed43e

SHA256
2ececd2b207fbd0a44956390b1e54dd1ef72604fb818ca952064d11a73723de0

SHA512
69090a67e8c69717a92fd732a3563fb877aadf89e121ac63b3a37563190fbc208fe3d5c015b73334fffbab7194cef56e00eaf2076c629742498c8dc4d8ab328a

Download Submit
C:\Windows\SysWOW64\Oehlkc32.exe

Filesize
136KB

MD5
fc369f22c63a3f77259d600c46d3a37e

SHA1
75a8094f482ff733bb57513533c3ae3e705ed43e

SHA256
2ececd2b207fbd0a44956390b1e54dd1ef72604fb818ca952064d11a73723de0

SHA512
69090a67e8c69717a92fd732a3563fb877aadf89e121ac63b3a37563190fbc208fe3d5c015b73334fffbab7194cef56e00eaf2076c629742498c8dc4d8ab328a

Download Submit
C:\Windows\SysWOW64\Ohkbbn32.exe

Filesize
136KB

MD5
05935198e986fc5cbee18c018544ade2

SHA1
264f73e5b61479e07b159cebfbb7558ababf9ef2

SHA256
0420e2d1c0bceb32a56514856fa9462eb92cb73e133cfe624aaa2fe21e83c20e

SHA512
29873f4a2aea73e6d073d1943b2aaee83a673c37e286cd2e5efc7c75d04856c1bb6a17126b8b95bc1ee54b5e21823e8769ea4ca07f097457a84406deefe26e5c

Download Submit
C:\Windows\SysWOW64\Ohkbbn32.exe

Filesize
136KB

MD5
05935198e986fc5cbee18c018544ade2

SHA1
264f73e5b61479e07b159cebfbb7558ababf9ef2

SHA256
0420e2d1c0bceb32a56514856fa9462eb92cb73e133cfe624aaa2fe21e83c20e

SHA512
29873f4a2aea73e6d073d1943b2aaee83a673c37e286cd2e5efc7c75d04856c1bb6a17126b8b95bc1ee54b5e21823e8769ea4ca07f097457a84406deefe26e5c

Download Submit
C:\Windows\SysWOW64\Oiknlagg.exe

Filesize
136KB

MD5
4d592ed21004bdf8d44b564b2d7f6cbf

SHA1
ecdb87de28690ec61034935571d510b4cd14084d

SHA256
9caa70ae3678edcbccbec95b9a3f95a13fc5386bb00d976b54051bb1e09fcfb0

SHA512
9c5bc6e19ed21aabaa179cbc353acb2c0ff0bd266b24df102362359a0d599bd9dcdc8c6c950d25312568832567fa8e34372735fb6514dfdc7d5db588c9393fb0

Download Submit
C:\Windows\SysWOW64\Oiknlagg.exe

Filesize
136KB

MD5
4d592ed21004bdf8d44b564b2d7f6cbf

SHA1
ecdb87de28690ec61034935571d510b4cd14084d

SHA256
9caa70ae3678edcbccbec95b9a3f95a13fc5386bb00d976b54051bb1e09fcfb0

SHA512
9c5bc6e19ed21aabaa179cbc353acb2c0ff0bd266b24df102362359a0d599bd9dcdc8c6c950d25312568832567fa8e34372735fb6514dfdc7d5db588c9393fb0

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
136KB

MD5
d3ca4ca2abfe18985748ee4f6773ce58

SHA1
6569c4dde1946dcc1d433fa342caf220cce8cb5d

SHA256
b04e6f74bbe6ee19884555bdbff6c98d7f593de58c3be5b7b893b9b4a923a932

SHA512
767650a3436467399d7f48c3bd130be1be13b2d3b315de2464b6eb668f439a89c187a1342fddbd2ceb4cc5be04e240df0adbf21c1ff513032e4009566de7a01e

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
136KB

MD5
d3ca4ca2abfe18985748ee4f6773ce58

SHA1
6569c4dde1946dcc1d433fa342caf220cce8cb5d

SHA256
b04e6f74bbe6ee19884555bdbff6c98d7f593de58c3be5b7b893b9b4a923a932

SHA512
767650a3436467399d7f48c3bd130be1be13b2d3b315de2464b6eb668f439a89c187a1342fddbd2ceb4cc5be04e240df0adbf21c1ff513032e4009566de7a01e

Download Submit
C:\Windows\SysWOW64\Okgaijaj.exe

Filesize
136KB

MD5
5acc404553819715232f3007ec29fecc

SHA1
4bcbc775f0b5f722f8f1a2f86039f08793c3c2d3

SHA256
212baa706b7e8969620898daa5e6e9ca2cfbcf5e4930addf566e3d94e680569a

SHA512
2ac01b1a536bffc5d7db5fc83e075aceab7179330971e48948f4062caf0d42a03f60020a691f2a6e93f70dc02eba2fbe3fe3d761c9335cf62f576badc72f4c0e

Download Submit
C:\Windows\SysWOW64\Okgaijaj.exe

Filesize
136KB

MD5
5acc404553819715232f3007ec29fecc

SHA1
4bcbc775f0b5f722f8f1a2f86039f08793c3c2d3

SHA256
212baa706b7e8969620898daa5e6e9ca2cfbcf5e4930addf566e3d94e680569a

SHA512
2ac01b1a536bffc5d7db5fc83e075aceab7179330971e48948f4062caf0d42a03f60020a691f2a6e93f70dc02eba2fbe3fe3d761c9335cf62f576badc72f4c0e

Download Submit
C:\Windows\SysWOW64\Pahpfc32.exe

Filesize
136KB

MD5
ef790ec6a37c80720fd801f952697016

SHA1
d9c4116303d3d593e9b92e53bec50813999a2e93

SHA256
ed2b98b192d2882b5b10c382d0bf9c4a9217d0bdc598ae5ade019fd2c5f6f495

SHA512
c1fff391310c50474220995e17226a9b9e0cd95a47481d315538dcfbeabcb90ba591a46c9f501c090d4806d4e74b3deaf37d71570e6b3d830dffa71f9990c7e6

Download Submit
C:\Windows\SysWOW64\Pahpfc32.exe

Filesize
136KB

MD5
ef790ec6a37c80720fd801f952697016

SHA1
d9c4116303d3d593e9b92e53bec50813999a2e93

SHA256
ed2b98b192d2882b5b10c382d0bf9c4a9217d0bdc598ae5ade019fd2c5f6f495

SHA512
c1fff391310c50474220995e17226a9b9e0cd95a47481d315538dcfbeabcb90ba591a46c9f501c090d4806d4e74b3deaf37d71570e6b3d830dffa71f9990c7e6

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
136KB

MD5
8f538986da1baf5a4cb87341614aceae

SHA1
e6d6c2900e5c0739d4390c0925659e05c18cdcbd

SHA256
2c5d767a11826d88d3fe64438c05450b69259bbf45dc201624684196229e15c9

SHA512
763765c7122eb41cab4d2b836d624af12d67d6096f754be670b61c33160d736f26fe5751f7864faec4b2dd0291bea9b1bd2b5c3f317c86c589146b26e077e0db

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
136KB

MD5
8f538986da1baf5a4cb87341614aceae

SHA1
e6d6c2900e5c0739d4390c0925659e05c18cdcbd

SHA256
2c5d767a11826d88d3fe64438c05450b69259bbf45dc201624684196229e15c9

SHA512
763765c7122eb41cab4d2b836d624af12d67d6096f754be670b61c33160d736f26fe5751f7864faec4b2dd0291bea9b1bd2b5c3f317c86c589146b26e077e0db

Download Submit
C:\Windows\SysWOW64\Papfgbmg.exe

Filesize
136KB

MD5
e28531816ef44e081797a2a408a66cc7

SHA1
400f73df0d71e80c538a20353f062c2ba4c6365f

SHA256
66a4c84d2b000c0639b9e8c2d0767a45c57bacaf6f05fa1767b781dec3ed76b7

SHA512
d9282304039bf4eee09b06dffa25d818f0b29cf15aeabb00e029de10db5f8e03c6e2fe751530094480a6f27622119f3bc1a490a7565d944d39a11b0e8c96b1cd

Download Submit
C:\Windows\SysWOW64\Papfgbmg.exe

Filesize
136KB

MD5
e28531816ef44e081797a2a408a66cc7

SHA1
400f73df0d71e80c538a20353f062c2ba4c6365f

SHA256
66a4c84d2b000c0639b9e8c2d0767a45c57bacaf6f05fa1767b781dec3ed76b7

SHA512
d9282304039bf4eee09b06dffa25d818f0b29cf15aeabb00e029de10db5f8e03c6e2fe751530094480a6f27622119f3bc1a490a7565d944d39a11b0e8c96b1cd

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
136KB

MD5
90862f44756dd8c11adcabc06574a26a

SHA1
76351039089e3bb92f5d1c3e47c53ad484eea6c1

SHA256
19823da4abdb2416cdfa361290bb618a52e7a8c18290a159d34b30136d5916ed

SHA512
b53df31dc775eeed0f5a6f52c69ef342787a23034f29cf5840fc2a7ecadc64ca6ccdb9b57ea6e0ec2eb49bf18cbb87c8182b7a473109585cfef39a3b4e4c498d

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
136KB

MD5
90862f44756dd8c11adcabc06574a26a

SHA1
76351039089e3bb92f5d1c3e47c53ad484eea6c1

SHA256
19823da4abdb2416cdfa361290bb618a52e7a8c18290a159d34b30136d5916ed

SHA512
b53df31dc775eeed0f5a6f52c69ef342787a23034f29cf5840fc2a7ecadc64ca6ccdb9b57ea6e0ec2eb49bf18cbb87c8182b7a473109585cfef39a3b4e4c498d

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
136KB

MD5
90862f44756dd8c11adcabc06574a26a

SHA1
76351039089e3bb92f5d1c3e47c53ad484eea6c1

SHA256
19823da4abdb2416cdfa361290bb618a52e7a8c18290a159d34b30136d5916ed

SHA512
b53df31dc775eeed0f5a6f52c69ef342787a23034f29cf5840fc2a7ecadc64ca6ccdb9b57ea6e0ec2eb49bf18cbb87c8182b7a473109585cfef39a3b4e4c498d

Download Submit
C:\Windows\SysWOW64\Pkhjph32.exe

Filesize
136KB

MD5
1f580fbcf274bc163ea4c5aadb1800a2

SHA1
68957573a9f9e499bbbe1b93c0eb1cecdccef714

SHA256
b3f560439cba0a61cca0d357829382145024dbe7bfce870ef8d09c3510c6c246

SHA512
da0e7f4303cb3a90ad8d17a6aa8c151ed966cf54df6176525c271bd01123555a72bee8997b060e7b0648bef2ffbc82ce5f5a92bff98a3e9f8e71b89f2e56b9fc

Download Submit
C:\Windows\SysWOW64\Pkhjph32.exe

Filesize
136KB

MD5
1f580fbcf274bc163ea4c5aadb1800a2

SHA1
68957573a9f9e499bbbe1b93c0eb1cecdccef714

SHA256
b3f560439cba0a61cca0d357829382145024dbe7bfce870ef8d09c3510c6c246

SHA512
da0e7f4303cb3a90ad8d17a6aa8c151ed966cf54df6176525c271bd01123555a72bee8997b060e7b0648bef2ffbc82ce5f5a92bff98a3e9f8e71b89f2e56b9fc

Download Submit
C:\Windows\SysWOW64\Plndcl32.exe

Filesize
136KB

MD5
d968b63a7fc026edb63db43734250080

SHA1
a68e2dbd9f983b5a03a71d11da1b6421aca77d9c

SHA256
f9fc9f124027e5e099cc5cf37342890e7708905871dac75feac6b18c75119a25

SHA512
853db03e52b19ce89dfaab768e1da3a5794d90f019bf38984f8fa81ba4650ddd46c4ae79ad0c05b8c6dcc66451aa695e46c76ec615b8a0ed5d7ab534c51193c7

Download Submit
C:\Windows\SysWOW64\Plndcl32.exe

Filesize
136KB

MD5
d968b63a7fc026edb63db43734250080

SHA1
a68e2dbd9f983b5a03a71d11da1b6421aca77d9c

SHA256
f9fc9f124027e5e099cc5cf37342890e7708905871dac75feac6b18c75119a25

SHA512
853db03e52b19ce89dfaab768e1da3a5794d90f019bf38984f8fa81ba4650ddd46c4ae79ad0c05b8c6dcc66451aa695e46c76ec615b8a0ed5d7ab534c51193c7

Download Submit
C:\Windows\SysWOW64\Pnhacn32.exe

Filesize
128KB

MD5
bc3012c06bfda4990678f2b12e187c53

SHA1
5d9a7aa866f64c4402856a505d87791239f4768b

SHA256
35e50c93b1a18b37a12543adf29a2324da49b378b574b7100a053ca781aa124c

SHA512
02285dd2e941874655288e7b9aa2116713e22478e203d7da9e2d29d80cd32e50211dd4365242969e4863cbb2894f94ef0e3f4e044a0bf61d3c2abb5299787b36

Download Submit
C:\Windows\SysWOW64\Qepkbpak.exe

Filesize
136KB

MD5
659a2e546b2ed021782afe2e933390f5

SHA1
8c24a22007b8715ab66c5e8d67c22b5dab194f72

SHA256
103cd49c464315799f63aa9528c122f503171c74a54b47234767a93ad2a3b053

SHA512
4803db57914a011d1fbeb6f62c48fbf8769fd0b30eee7233b0b4642214549a9ba4df6c4724b30bf410ed810fd852b91b3abc14736261a18fb09867b693e6272d

Download Submit
C:\Windows\SysWOW64\Qepkbpak.exe

Filesize
136KB

MD5
659a2e546b2ed021782afe2e933390f5

SHA1
8c24a22007b8715ab66c5e8d67c22b5dab194f72

SHA256
103cd49c464315799f63aa9528c122f503171c74a54b47234767a93ad2a3b053

SHA512
4803db57914a011d1fbeb6f62c48fbf8769fd0b30eee7233b0b4642214549a9ba4df6c4724b30bf410ed810fd852b91b3abc14736261a18fb09867b693e6272d

Download Submit
C:\Windows\SysWOW64\Qepkbpak.exe

Filesize
136KB

MD5
659a2e546b2ed021782afe2e933390f5

SHA1
8c24a22007b8715ab66c5e8d67c22b5dab194f72

SHA256
103cd49c464315799f63aa9528c122f503171c74a54b47234767a93ad2a3b053

SHA512
4803db57914a011d1fbeb6f62c48fbf8769fd0b30eee7233b0b4642214549a9ba4df6c4724b30bf410ed810fd852b91b3abc14736261a18fb09867b693e6272d

Download Submit
C:\Windows\SysWOW64\Qkjgegae.exe

Filesize
136KB

MD5
29e2a0d5c885c3ce1ef06cac6ffd7609

SHA1
e18c490d197d1c0012ef30cd2a587b653ad42c82

SHA256
46775289cb82b715efac8373be8671cb8a646d589cd9139884e3e413f13387d6

SHA512
2164eb608f6be3f3ffb3a2cd1ecdbc8c5e6268684d4c443790fae8476ae618599266cc979dbcafedd0271e132ead6d5ab5863f92bc734373503c5b22fc16d660

Download Submit
C:\Windows\SysWOW64\Qkjgegae.exe

Filesize
136KB

MD5
29e2a0d5c885c3ce1ef06cac6ffd7609

SHA1
e18c490d197d1c0012ef30cd2a587b653ad42c82

SHA256
46775289cb82b715efac8373be8671cb8a646d589cd9139884e3e413f13387d6

SHA512
2164eb608f6be3f3ffb3a2cd1ecdbc8c5e6268684d4c443790fae8476ae618599266cc979dbcafedd0271e132ead6d5ab5863f92bc734373503c5b22fc16d660

Download Submit
memory/220-210-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/320-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/464-130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/516-395-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/628-420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1084-194-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1292-276-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1308-336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-288-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1524-310-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-342-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2076-434-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2092-202-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2112-426-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2188-162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2220-396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-312-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-254-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2616-97-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2644-86-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-178-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2716-225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2912-106-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3064-270-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3100-218-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3152-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3248-300-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3256-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3296-402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3432-169-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3452-241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-378-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-330-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3564-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3588-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4308-372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4340-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-81-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4432-262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4496-414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4624-370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4744-114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-65-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5016-408-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-324-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads