ef0f40a6c0a06b24fa7ec40c787ecdcaacc3639ac88832f811119f69d44fe805

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe
Size

400KB
MD5

fc69e65eb9f946797a0c8041e20fb4a0
SHA1

b1b76a04e3cb0b13eb6eaf52fec1b2acb08c3006
SHA256

ef0f40a6c0a06b24fa7ec40c787ecdcaacc3639ac88832f811119f69d44fe805
SHA512

7f56a200bf35987ba81607e7292fda88d15a0838e0241735d910f471ab00433af1a286be913d11d082524b3627e4f965caa940bd2c4fd3a48f398d9d1ceb205d
SSDEEP

6144:353wEFdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:1wORrgryg426RQagrkj

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgpogili.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Filiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmaffnce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoabad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbdjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghpendjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlnipg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqdblmhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giqkkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjlic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooagno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbfheo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klifnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oileggkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efdjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaefgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igedlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpofii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eglgbdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflnfcgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhfmdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfodbqfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajjjocap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdbhkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbileede.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkjafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejflhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkpmdbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbfgkffn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqcjepfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hheoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niipjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkjlic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlbbkfoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhbfff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglnbhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbedga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgenbfoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbmoen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbcjnilj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckkiccep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhniccb.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	Ndokbi32.exe
884	Nngokoej.exe
4108	Ncdgcf32.exe
3180	Nnjlpo32.exe
3248	Ngdmod32.exe
1224	Npmagine.exe
2100	Nfjjppmm.exe
1576	Oponmilc.exe
3916	Ocpgod32.exe
3040	Oneklm32.exe
4508	Ofqpqo32.exe
2468	Oqhacgdh.exe
3092	Pcijeb32.exe
4544	Pmannhhj.exe
2572	Pjeoglgc.exe
4192	Pqpgdfnp.exe
1988	Pjhlml32.exe
4708	Pdmpje32.exe
3588	Balpgb32.exe
3440	Bjddphlq.exe
2240	Bclhhnca.exe
4980	Bmemac32.exe
1116	Cfmajipb.exe
2912	Chmndlge.exe
1268	Cnffqf32.exe
772	Cfbkeh32.exe
2560	Cmnpgb32.exe
1868	Cdhhdlid.exe
1620	Dhfajjoj.exe
4948	Dmcibama.exe
4772	Dfknkg32.exe
4924	Deokon32.exe
2544	Dknpmdfc.exe
3424	Dahhio32.exe
4540	Edfdej32.exe
3356	Ekpmbddq.exe
4572	Eajeon32.exe
2520	Ehdmlhcj.exe
1168	Eehnem32.exe
4024	Ehfjah32.exe
3320	Emcbio32.exe
228	Eejjjl32.exe
956	Eglgbdep.exe
4988	Eemgplno.exe
4368	Eoekia32.exe
3172	Feocelll.exe
4196	Fnjhjn32.exe
3616	Fddqghpd.exe
4692	Fahaplon.exe
4140	Fdfmlhna.exe
4328	Fkqeib32.exe
1364	Fggfnc32.exe
3000	Fnaokmco.exe
4872	Fdkggg32.exe
1036	Fkeodaai.exe
1964	Gaogak32.exe
1488	Gglpibgm.exe
2120	Gnfhfl32.exe
3188	Gdppbfff.exe
4880	Ggnlobej.exe
4280	Gadqlkep.exe
3376	Ghniielm.exe
1612	Gohaeo32.exe
3428	Ghpendjj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ogjkhmfa.dll	Hgghjjid.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Eajeon32.exe	Ekpmbddq.exe
File opened for modification	C:\Windows\SysWOW64\Gdppbfff.exe	Gnfhfl32.exe
File created	C:\Windows\SysWOW64\Likcilhh.exe	Lflgmqhd.exe
File created	C:\Windows\SysWOW64\Lddkje32.dll	Ppopjp32.exe
File created	C:\Windows\SysWOW64\Dcjnoece.exe	Dmpfbk32.exe
File created	C:\Windows\SysWOW64\Egcjff32.dll	Dfmcfp32.exe
File created	C:\Windows\SysWOW64\Iqklon32.exe	Hpfcdojl.exe
File created	C:\Windows\SysWOW64\Akqfkp32.exe	Ahbjoe32.exe
File opened for modification	C:\Windows\SysWOW64\Lfodbqfa.exe	Llipehgk.exe
File created	C:\Windows\SysWOW64\Mlnipg32.exe	Miomdk32.exe
File created	C:\Windows\SysWOW64\Coaadq32.dll	Bjfjka32.exe
File created	C:\Windows\SysWOW64\Pefabkej.exe	Pkpmdbfd.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Adhdjpjf.exe
File opened for modification	C:\Windows\SysWOW64\Fnkfmm32.exe	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Jboqnpjm.dll	Mbjnbqhp.exe
File opened for modification	C:\Windows\SysWOW64\Mleoafmn.exe	Mifcejnj.exe
File opened for modification	C:\Windows\SysWOW64\Anaomkdb.exe	Akccap32.exe
File created	C:\Windows\SysWOW64\Jdockf32.dll	Niojoeel.exe
File created	C:\Windows\SysWOW64\Dahhio32.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Eoekia32.exe	Eemgplno.exe
File created	C:\Windows\SysWOW64\Nincmhle.dll	Likcilhh.exe
File opened for modification	C:\Windows\SysWOW64\Hcblpdgg.exe	Hlhccj32.exe
File opened for modification	C:\Windows\SysWOW64\Pecellgl.exe	Pknqoc32.exe
File opened for modification	C:\Windows\SysWOW64\Nofefp32.exe	Njjmni32.exe
File created	C:\Windows\SysWOW64\Bipfed32.dll	Ehdmlhcj.exe
File created	C:\Windows\SysWOW64\Ecjbbo32.dll	Dcjnoece.exe
File created	C:\Windows\SysWOW64\Embkoi32.exe	Efhcbodf.exe
File created	C:\Windows\SysWOW64\Ehiffj32.dll	Gijekg32.exe
File created	C:\Windows\SysWOW64\Eokqkh32.exe	Emmdom32.exe
File created	C:\Windows\SysWOW64\Ankkea32.dll	Ebimgcfi.exe
File created	C:\Windows\SysWOW64\Qdaniq32.exe	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Gadqlkep.exe	Ggnlobej.exe
File created	C:\Windows\SysWOW64\Gafian32.dll	Pjehmfch.exe
File created	C:\Windows\SysWOW64\Eglgbdep.exe	Eejjjl32.exe
File created	C:\Windows\SysWOW64\Lnijaa32.dll	Iijaka32.exe
File created	C:\Windows\SysWOW64\Jkomldme.dll	Cjjcfabm.exe
File created	C:\Windows\SysWOW64\Fpodlbng.exe	Fmqgpgoc.exe
File created	C:\Windows\SysWOW64\Iakiia32.exe	Igedlh32.exe
File opened for modification	C:\Windows\SysWOW64\Mhoipb32.exe	Mngegmbc.exe
File created	C:\Windows\SysWOW64\Mbcqpq32.dll	Gnfhfl32.exe
File created	C:\Windows\SysWOW64\Cibmlmeb.exe	Cfcqpa32.exe
File created	C:\Windows\SysWOW64\Okilfdgl.dll	Dpckjfgg.exe
File opened for modification	C:\Windows\SysWOW64\Ealkjh32.exe	Ejbbmnnb.exe
File opened for modification	C:\Windows\SysWOW64\Fmqgpgoc.exe	Fdhcgaic.exe
File created	C:\Windows\SysWOW64\Bhpfqcln.exe	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Lomjicei.exe	Lpgmhg32.exe
File opened for modification	C:\Windows\SysWOW64\Amaqjp32.exe	Aqkpeopg.exe
File created	C:\Windows\SysWOW64\Oebfih32.dll	Fajgkfio.exe
File opened for modification	C:\Windows\SysWOW64\Leopnglc.exe	Lndham32.exe
File created	C:\Windows\SysWOW64\Nbcjnilj.exe	Nklbmllg.exe
File created	C:\Windows\SysWOW64\Hdlpneli.exe	Hnagak32.exe
File opened for modification	C:\Windows\SysWOW64\Hdbfodfa.exe	Hkjafn32.exe
File opened for modification	C:\Windows\SysWOW64\Nohehq32.exe	Nlihle32.exe
File created	C:\Windows\SysWOW64\Aonhqi32.dll	Aglnbhal.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpla32.exe	Embkoi32.exe
File created	C:\Windows\SysWOW64\Kbddfmgl.exe	Kkjlic32.exe
File created	C:\Windows\SysWOW64\Nchjdo32.exe	Nhbfff32.exe
File opened for modification	C:\Windows\SysWOW64\Aokcklid.exe	Qjnkcekm.exe
File created	C:\Windows\SysWOW64\Embccf32.dll	Ehhpla32.exe
File opened for modification	C:\Windows\SysWOW64\Gmcdffmq.exe	Ggilil32.exe
File opened for modification	C:\Windows\SysWOW64\Nbcjnilj.exe	Nklbmllg.exe
File opened for modification	C:\Windows\SysWOW64\Cmjemflb.exe	Cjliajmo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6212	8096	WerFault.exe	581

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemgplno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpnoh32.dll"	Nlihle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqdblmhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgiklme.dll"	Hpofii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icnklbmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akqgne32.dll"	Aqkpeopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdmmbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgghjjid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahbjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pigbqakg.dll"	Eejeiocj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gglpibgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghmbno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjjghcfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhdckaeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfcjfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hildmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hecjke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fahaplon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmoel32.dll"	Fkqeib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kldmckic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhagaamj.dll"	Klifnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klkcdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfefkkqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dahhio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igfkfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kefdbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ploknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjkmhmpl.dll"	Dhhfedil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mleoafmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flippejg.dll"	Qjlnnemp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ploija32.dll"	Aihaoqlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niojoeel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikokan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mehjol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqjenbhh.dll"	Ooagno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blhdmebn.dll"	Kbddfmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbnngbbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkgmlcm.dll"	Gaefgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lndham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpjbq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmaffnce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klgmcn32.dll"	Jbdbjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcknj32.dll"	Jbileede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmipblaq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdhcgaic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkoch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhblllfo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2332	1340	NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe	86
PID 1340 wrote to memory of 2332	1340	NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe	86
PID 1340 wrote to memory of 2332	1340	NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe	86
PID 2332 wrote to memory of 884	2332	Ndokbi32.exe	87
PID 2332 wrote to memory of 884	2332	Ndokbi32.exe	87
PID 2332 wrote to memory of 884	2332	Ndokbi32.exe	87
PID 884 wrote to memory of 4108	884	Nngokoej.exe	88
PID 884 wrote to memory of 4108	884	Nngokoej.exe	88
PID 884 wrote to memory of 4108	884	Nngokoej.exe	88
PID 4108 wrote to memory of 3180	4108	Ncdgcf32.exe	89
PID 4108 wrote to memory of 3180	4108	Ncdgcf32.exe	89
PID 4108 wrote to memory of 3180	4108	Ncdgcf32.exe	89
PID 3180 wrote to memory of 3248	3180	Nnjlpo32.exe	90
PID 3180 wrote to memory of 3248	3180	Nnjlpo32.exe	90
PID 3180 wrote to memory of 3248	3180	Nnjlpo32.exe	90
PID 3248 wrote to memory of 1224	3248	Ngdmod32.exe	91
PID 3248 wrote to memory of 1224	3248	Ngdmod32.exe	91
PID 3248 wrote to memory of 1224	3248	Ngdmod32.exe	91
PID 1224 wrote to memory of 2100	1224	Npmagine.exe	92
PID 1224 wrote to memory of 2100	1224	Npmagine.exe	92
PID 1224 wrote to memory of 2100	1224	Npmagine.exe	92
PID 2100 wrote to memory of 1576	2100	Nfjjppmm.exe	93
PID 2100 wrote to memory of 1576	2100	Nfjjppmm.exe	93
PID 2100 wrote to memory of 1576	2100	Nfjjppmm.exe	93
PID 1576 wrote to memory of 3916	1576	Oponmilc.exe	94
PID 1576 wrote to memory of 3916	1576	Oponmilc.exe	94
PID 1576 wrote to memory of 3916	1576	Oponmilc.exe	94
PID 3916 wrote to memory of 3040	3916	Ocpgod32.exe	95
PID 3916 wrote to memory of 3040	3916	Ocpgod32.exe	95
PID 3916 wrote to memory of 3040	3916	Ocpgod32.exe	95
PID 3040 wrote to memory of 4508	3040	Oneklm32.exe	97
PID 3040 wrote to memory of 4508	3040	Oneklm32.exe	97
PID 3040 wrote to memory of 4508	3040	Oneklm32.exe	97
PID 4508 wrote to memory of 2468	4508	Ofqpqo32.exe	98
PID 4508 wrote to memory of 2468	4508	Ofqpqo32.exe	98
PID 4508 wrote to memory of 2468	4508	Ofqpqo32.exe	98
PID 2468 wrote to memory of 3092	2468	Oqhacgdh.exe	99
PID 2468 wrote to memory of 3092	2468	Oqhacgdh.exe	99
PID 2468 wrote to memory of 3092	2468	Oqhacgdh.exe	99
PID 3092 wrote to memory of 4544	3092	Pcijeb32.exe	100
PID 3092 wrote to memory of 4544	3092	Pcijeb32.exe	100
PID 3092 wrote to memory of 4544	3092	Pcijeb32.exe	100
PID 4544 wrote to memory of 2572	4544	Pmannhhj.exe	101
PID 4544 wrote to memory of 2572	4544	Pmannhhj.exe	101
PID 4544 wrote to memory of 2572	4544	Pmannhhj.exe	101
PID 2572 wrote to memory of 4192	2572	Pjeoglgc.exe	102
PID 2572 wrote to memory of 4192	2572	Pjeoglgc.exe	102
PID 2572 wrote to memory of 4192	2572	Pjeoglgc.exe	102
PID 4192 wrote to memory of 1988	4192	Pqpgdfnp.exe	103
PID 4192 wrote to memory of 1988	4192	Pqpgdfnp.exe	103
PID 4192 wrote to memory of 1988	4192	Pqpgdfnp.exe	103
PID 1988 wrote to memory of 4708	1988	Pjhlml32.exe	104
PID 1988 wrote to memory of 4708	1988	Pjhlml32.exe	104
PID 1988 wrote to memory of 4708	1988	Pjhlml32.exe	104
PID 4708 wrote to memory of 3588	4708	Pdmpje32.exe	105
PID 4708 wrote to memory of 3588	4708	Pdmpje32.exe	105
PID 4708 wrote to memory of 3588	4708	Pdmpje32.exe	105
PID 3588 wrote to memory of 3440	3588	Balpgb32.exe	106
PID 3588 wrote to memory of 3440	3588	Balpgb32.exe	106
PID 3588 wrote to memory of 3440	3588	Balpgb32.exe	106
PID 3440 wrote to memory of 2240	3440	Bjddphlq.exe	108
PID 3440 wrote to memory of 2240	3440	Bjddphlq.exe	108
PID 3440 wrote to memory of 2240	3440	Bjddphlq.exe	108
PID 2240 wrote to memory of 4980	2240	Bclhhnca.exe	109

C:\Users\Admin\AppData\Local\Temp\NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fc69e65eb9f946797a0c8041e20fb4a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\Ndokbi32.exe
  C:\Windows\system32\Ndokbi32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\Nngokoej.exe
    C:\Windows\system32\Nngokoej.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\SysWOW64\Ncdgcf32.exe
      C:\Windows\system32\Ncdgcf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        24⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        26⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        27⤵
        Executes dropped EXE
        
        PID:772
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        28⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        29⤵
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        32⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        36⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        38⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2520
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        40⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        41⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        42⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        46⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        47⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        48⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        49⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        51⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        53⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        54⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        55⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        57⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2120
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        60⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        62⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        63⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        64⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        66⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        67⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        68⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        70⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        71⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        72⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        73⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        74⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        75⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        77⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        78⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        79⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        80⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        81⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        82⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        83⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        84⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        85⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        87⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        88⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        89⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        90⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        91⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        92⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        93⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        95⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        96⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        97⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        98⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        99⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        100⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        103⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        104⤵
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        105⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        106⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        107⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        108⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        109⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        110⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        111⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        113⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        114⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        115⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        116⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        117⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        118⤵
        Drops file in System32 directory
        
        PID:780
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        120⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        122⤵
        Drops file in System32 directory
        
        PID:2216
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        124⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        125⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        126⤵
        Drops file in System32 directory
        
        PID:3368
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        127⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        129⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        130⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        131⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        132⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6156
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        134⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        135⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        137⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        138⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        139⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        140⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        141⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        143⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        144⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        145⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        147⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        148⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        149⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        150⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        151⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        152⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        154⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        155⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        156⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        157⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        158⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        159⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        160⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        161⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        162⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        163⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        165⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        166⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        167⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        168⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        170⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        171⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        172⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        174⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        175⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        176⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        177⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        179⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        180⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        181⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        182⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Amfjeobf.exe
        
        C:\Windows\system32\Amfjeobf.exe
        184⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        188⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        189⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        190⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        191⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        192⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        193⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        194⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        195⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        196⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        197⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        198⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        199⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        200⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        201⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        202⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        203⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        205⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        206⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        208⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        209⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        210⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        211⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        212⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        213⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        214⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        215⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        216⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        217⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        218⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        220⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        221⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        222⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        223⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        224⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8028
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        229⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        230⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        231⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        232⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        233⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        234⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        235⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        236⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7952
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        238⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        239⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        240⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        241⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        243⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        244⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        245⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        246⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        247⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        250⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        251⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        253⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        254⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        255⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        256⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        257⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8284
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        259⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        260⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        261⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        262⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        263⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        264⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        265⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        266⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        267⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        268⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8728
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        271⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        272⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        273⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        275⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        276⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        277⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        279⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        280⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        281⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        283⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        284⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        285⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        287⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        288⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        289⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        290⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        291⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        293⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        294⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        295⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        296⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        297⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        298⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        299⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        300⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        301⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        51⤵
        
        PID:6124

C:\Windows\SysWOW64\Nemmoe32.exe
C:\Windows\system32\Nemmoe32.exe
1⤵
PID:5992
- C:\Windows\SysWOW64\Njiegl32.exe
  C:\Windows\system32\Njiegl32.exe
  2⤵
  PID:8516
- - C:\Windows\SysWOW64\Nbqmiinl.exe
    C:\Windows\system32\Nbqmiinl.exe
    3⤵
    PID:8656
  - - C:\Windows\SysWOW64\Neoieenp.exe
      C:\Windows\system32\Neoieenp.exe
      4⤵
      PID:8772
    - - C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        5⤵
        Drops file in System32 directory
        
        PID:8888
      - C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        7⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        8⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        9⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        10⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        11⤵
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        12⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        14⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        15⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        16⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        17⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        18⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        19⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        20⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4532
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        22⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9052
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        24⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        25⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        26⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        27⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        28⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        29⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        30⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        31⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        33⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        34⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        35⤵
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        37⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        38⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        39⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        40⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        41⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        42⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        43⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        44⤵
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        45⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        46⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        47⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        48⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        49⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        50⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        51⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        52⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        53⤵
        
        PID:9312

C:\Windows\SysWOW64\Oalipoiq.exe
C:\Windows\system32\Oalipoiq.exe
1⤵
PID:9380
- C:\Windows\SysWOW64\Olanmgig.exe
  C:\Windows\system32\Olanmgig.exe
  2⤵
  PID:9472
- - C:\Windows\SysWOW64\Oanfen32.exe
    C:\Windows\system32\Oanfen32.exe
    3⤵
    PID:9576
  - - C:\Windows\SysWOW64\Oldjcg32.exe
      C:\Windows\system32\Oldjcg32.exe
      4⤵
      PID:9648
    - - C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        5⤵
        
        PID:9744
      - C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        6⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        7⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        8⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        9⤵
        Drops file in System32 directory
        
        PID:10104

C:\Windows\SysWOW64\Pecellgl.exe
C:\Windows\system32\Pecellgl.exe
1⤵
PID:10156
- C:\Windows\SysWOW64\Pkpmdbfd.exe
  C:\Windows\system32\Pkpmdbfd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:10208
- - C:\Windows\SysWOW64\Pefabkej.exe
    C:\Windows\system32\Pefabkej.exe
    3⤵
    PID:4812
  - - C:\Windows\SysWOW64\Pkbjjbda.exe
      C:\Windows\system32\Pkbjjbda.exe
      4⤵
      Modifies registry class
      PID:9384
    - - C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9356
      - C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        6⤵
        Modifies registry class
        
        PID:9500
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        7⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        8⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        9⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        10⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        11⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        12⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        13⤵
        
        PID:10060

C:\Windows\SysWOW64\Ahpmjejp.exe
C:\Windows\system32\Ahpmjejp.exe
1⤵
PID:4960
- C:\Windows\SysWOW64\Aknifq32.exe
  C:\Windows\system32\Aknifq32.exe
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\Anmfbl32.exe
    C:\Windows\system32\Anmfbl32.exe
    3⤵
    PID:4636
  - - C:\Windows\SysWOW64\Ahbjoe32.exe
      C:\Windows\system32\Ahbjoe32.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:9392
    - - C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        5⤵
        
        PID:9548
      - C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        6⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        7⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        8⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        9⤵
        Drops file in System32 directory
        
        PID:4776
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        10⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1576
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        12⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        13⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        14⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        15⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        16⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        17⤵
        Drops file in System32 directory
        
        PID:9864
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        18⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        19⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        20⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        21⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        22⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        24⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        25⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        26⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        27⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        28⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        29⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        30⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        32⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        33⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        34⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        35⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        36⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        37⤵
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        38⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        39⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        40⤵
        Drops file in System32 directory
        
        PID:1928
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        41⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        42⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        43⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        44⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        45⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        46⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        47⤵
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        48⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        49⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        50⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3632

C:\Windows\SysWOW64\Oaifpi32.exe
C:\Windows\system32\Oaifpi32.exe
1⤵
PID:3976
- C:\Windows\SysWOW64\Oaplqh32.exe
  C:\Windows\system32\Oaplqh32.exe
  2⤵
  PID:6008

C:\Windows\SysWOW64\Pjdpelnc.exe
C:\Windows\system32\Pjdpelnc.exe
1⤵
- Drops file in System32 directory
PID:5904
- C:\Windows\SysWOW64\Qdaniq32.exe
  C:\Windows\system32\Qdaniq32.exe
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\Adhdjpjf.exe
    C:\Windows\system32\Adhdjpjf.exe
    3⤵
    - Drops file in System32 directory
    PID:4692

C:\Windows\SysWOW64\Pjkmomfn.exe
C:\Windows\system32\Pjkmomfn.exe
1⤵
PID:2012

C:\Windows\SysWOW64\Bphgeo32.exe
C:\Windows\system32\Bphgeo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2904
- C:\Windows\SysWOW64\Bhblllfo.exe
  C:\Windows\system32\Bhblllfo.exe
  2⤵
  - Modifies registry class
  PID:5808

C:\Windows\SysWOW64\Cammjakm.exe
C:\Windows\system32\Cammjakm.exe
1⤵
PID:5204
- C:\Windows\SysWOW64\Dahmfpap.exe
  C:\Windows\system32\Dahmfpap.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5336

C:\Windows\SysWOW64\Egaejeej.exe
C:\Windows\system32\Egaejeej.exe
1⤵
PID:5824
- C:\Windows\SysWOW64\Eghkjdoa.exe
  C:\Windows\system32\Eghkjdoa.exe
  2⤵
  PID:9308
- - C:\Windows\SysWOW64\Fgoakc32.exe
    C:\Windows\system32\Fgoakc32.exe
    3⤵
    - Drops file in System32 directory
    PID:6100
  - - C:\Windows\SysWOW64\Fnkfmm32.exe
      C:\Windows\system32\Fnkfmm32.exe
      4⤵
      PID:6468

C:\Windows\SysWOW64\Dnonkq32.exe
C:\Windows\system32\Dnonkq32.exe
1⤵
PID:5136

C:\Windows\SysWOW64\Hecjke32.exe
C:\Windows\system32\Hecjke32.exe
1⤵
- Modifies registry class
PID:3428
- C:\Windows\SysWOW64\Hppeim32.exe
  C:\Windows\system32\Hppeim32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:5884
- - C:\Windows\SysWOW64\Iolhkh32.exe
    C:\Windows\system32\Iolhkh32.exe
    3⤵
    PID:6452
  - - C:\Windows\SysWOW64\Jadgnb32.exe
      C:\Windows\system32\Jadgnb32.exe
      4⤵
      PID:5624
    - - C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        5⤵
        
        PID:5628
      - C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        6⤵
        
        PID:6896

C:\Windows\SysWOW64\Gihpkd32.exe
C:\Windows\system32\Gihpkd32.exe
1⤵
PID:4528

C:\Windows\SysWOW64\Kibeoo32.exe
C:\Windows\system32\Kibeoo32.exe
1⤵
PID:6628
- C:\Windows\SysWOW64\Kidben32.exe
  C:\Windows\system32\Kidben32.exe
  2⤵
  PID:6728
- - C:\Windows\SysWOW64\Kpnjah32.exe
    C:\Windows\system32\Kpnjah32.exe
    3⤵
    - Modifies registry class
    PID:3036
  - - C:\Windows\SysWOW64\Kifojnol.exe
      C:\Windows\system32\Kifojnol.exe
      4⤵
      PID:5472

C:\Windows\SysWOW64\Kiikpnmj.exe
C:\Windows\system32\Kiikpnmj.exe
1⤵
- Modifies registry class
PID:5828
- C:\Windows\SysWOW64\Lpgmhg32.exe
  C:\Windows\system32\Lpgmhg32.exe
  2⤵
  - Drops file in System32 directory
  PID:5620
- - C:\Windows\SysWOW64\Lomjicei.exe
    C:\Windows\system32\Lomjicei.exe
    3⤵
    PID:7128
  - - C:\Windows\SysWOW64\Mlhqcgnk.exe
      C:\Windows\system32\Mlhqcgnk.exe
      4⤵
      PID:7008
    - - C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        5⤵
        
        PID:788
      - C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        6⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268

C:\Windows\SysWOW64\Njjmni32.exe
C:\Windows\system32\Njjmni32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4572
- C:\Windows\SysWOW64\Nofefp32.exe
  C:\Windows\system32\Nofefp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6436
- - C:\Windows\SysWOW64\Niojoeel.exe
    C:\Windows\system32\Niojoeel.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:4580
  - - C:\Windows\SysWOW64\Ocdnln32.exe
      C:\Windows\system32\Ocdnln32.exe
      4⤵
      PID:5508
    - - C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        5⤵
        
        PID:6428
      - C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        6⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        7⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        8⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        9⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        10⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        11⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        12⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        13⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        14⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        15⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        16⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7448
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        18⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        19⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        20⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        21⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        22⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8096 -s 408
        23⤵
        Program crash
        
        PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8096 -ip 8096
1⤵
PID:6168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amaqjp32.exe

Filesize
400KB

MD5
faa2813f9339fd03eadb0ae3dc670b02

SHA1
784d12d8bb62c26100512f2768bf4c3f5feb8cb4

SHA256
fb3c96f1da4c364ded8c76979de6dcd5c1aac72b3e036d9aa9581af821ae7182

SHA512
32b6dd750ab9ce379f64f3f687a7aefedad6003149743a3f74d43829f465600471e78743147bceb84d9c3d2d8ff94ae18569633635e41454263f2825aa6b5c8e

Download Submit
C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
400KB

MD5
8072c2272a53fca82a7551ca2161b3d9

SHA1
e38effab40220c30ec895d0d2e97f4e7ec6e827b

SHA256
6b1530d704e0dfb59bf0c81f40d168566c2f818fbfb7b777b4772b2167c8ddc3

SHA512
add344296fd734dc9059f8cacbb7d0b99b45b2b883f5e6f50ff674b597c73b5f49b62780bc73a2286246d1c5435d34934725e1e4eccd8e1121984e26667f9ead

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
400KB

MD5
6049ecda5dd8c9ce49cb70ffe12fef4d

SHA1
6aa7fa84190efa6684d28b3aac6934bfcfcec420

SHA256
74e375ac4891975f9eda2fd94dbecfa53a3fc2c13a29254f58bf8c64a3febbea

SHA512
004182a9d6e0903efe5269cfdb6a553d6b4dcfaaa03d73dc9dc5797c4904effa26c8e21bb741542b0ce639aae7c661ee416cff9c4bd92114c2d029fee7c3e7ea

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
400KB

MD5
6049ecda5dd8c9ce49cb70ffe12fef4d

SHA1
6aa7fa84190efa6684d28b3aac6934bfcfcec420

SHA256
74e375ac4891975f9eda2fd94dbecfa53a3fc2c13a29254f58bf8c64a3febbea

SHA512
004182a9d6e0903efe5269cfdb6a553d6b4dcfaaa03d73dc9dc5797c4904effa26c8e21bb741542b0ce639aae7c661ee416cff9c4bd92114c2d029fee7c3e7ea

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
400KB

MD5
d3330a02a3418851b9a847e7612e16db

SHA1
af01fa7fffebef334a5cf4c3e79d1091d1fc49e6

SHA256
28a3ac5534471e89c235ee0184ff848d9e9dfe14f78ce08d0ad043e00ecab2f0

SHA512
fa6512dfe5ff57dcdfc32821e1626b7f7cdb5d96000acb32af1c2aa3bc9c8276f822ea98ad1365dd8bc755cce258f9504f4df8aa7944ef463c66d73f64514d8b

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
400KB

MD5
84589fb2ee855bbb741499ba1ec03977

SHA1
322fae577afdf41498c0526f96bc919c7d94c469

SHA256
953d8975ea41ce54961884020b444e81524bf46a530abd011e2530a5158a883a

SHA512
d0acd13bc651690bff044521ea681daf9643174b5a4d8eb515110242a78b77be6acc574d7620143576a97f785737f6b820c5b43ae3a913a8182e6e96fa6661cd

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
400KB

MD5
84589fb2ee855bbb741499ba1ec03977

SHA1
322fae577afdf41498c0526f96bc919c7d94c469

SHA256
953d8975ea41ce54961884020b444e81524bf46a530abd011e2530a5158a883a

SHA512
d0acd13bc651690bff044521ea681daf9643174b5a4d8eb515110242a78b77be6acc574d7620143576a97f785737f6b820c5b43ae3a913a8182e6e96fa6661cd

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
400KB

MD5
0fe78098fdc40d520984fd6216e07cd5

SHA1
63795f26ee063c01bc247879120ac0cd6eb5fde5

SHA256
83a7da831f6f84cb93332c4f2bdbad0c879e12c93e874304e31d5805488984b8

SHA512
22705057af91803be0e95190dbac6dff525c47397d051f393241871523dee00d3753e300b45dd4649cccdf5ebc71ea762033c8bd1552c4fcc0915a4b168990c4

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
400KB

MD5
0fe78098fdc40d520984fd6216e07cd5

SHA1
63795f26ee063c01bc247879120ac0cd6eb5fde5

SHA256
83a7da831f6f84cb93332c4f2bdbad0c879e12c93e874304e31d5805488984b8

SHA512
22705057af91803be0e95190dbac6dff525c47397d051f393241871523dee00d3753e300b45dd4649cccdf5ebc71ea762033c8bd1552c4fcc0915a4b168990c4

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
400KB

MD5
71422e38a812dedd1edd5dbeb1ee2203

SHA1
e8c3da9ed49ba69d76d9abdd8f788d0f1e3bc528

SHA256
34246935f6123e92e2d73a056512119f8b4882be80ca2a4e3407bbc5cac2d51f

SHA512
a7fd5f406c734acc6ac772bc1f8499432607c4bb94742c8b8a84013b7ea06134c8bd7520c94649cb0c9485dee638ff4aee2d52104e87945a1ae0a64ff0cd6c28

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
400KB

MD5
71422e38a812dedd1edd5dbeb1ee2203

SHA1
e8c3da9ed49ba69d76d9abdd8f788d0f1e3bc528

SHA256
34246935f6123e92e2d73a056512119f8b4882be80ca2a4e3407bbc5cac2d51f

SHA512
a7fd5f406c734acc6ac772bc1f8499432607c4bb94742c8b8a84013b7ea06134c8bd7520c94649cb0c9485dee638ff4aee2d52104e87945a1ae0a64ff0cd6c28

Download Submit
C:\Windows\SysWOW64\Bqdblmhl.exe

Filesize
400KB

MD5
60831737431d79af6f196f9ccda4c18b

SHA1
66af0240fc67d077b14124c4e0915b4d62276f37

SHA256
a02a79caa81454b9ebf54d4bdf31e729592d6eaa16a57095b5d20dd2010c6f0e

SHA512
401cd2819810cbc56bcda6c32c92b62e9390c1b69b9f0937425a8d83d36bd7b274aa9380b2180425ce2e3e8a0d3459c856886fbce7b4256323af2b1aaf6acae7

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
400KB

MD5
0f3f7cebdd20a316aa5e92f740aaa206

SHA1
c2f07eeb141f8e37bf6be476ffba8c25db7baf2d

SHA256
23bdfcfb25d989fbaac3bc635473bcfbb67c8b1164fee1e93f4095391277c53d

SHA512
09e9535e4288db8cb1450f5cae1d43e146367ccfb7779a796b1c26a5e9c1e50ec72673ecbe90ddc84d325e2272a32416620c96d691166e75e1c79af0db42c8fe

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
400KB

MD5
0f3f7cebdd20a316aa5e92f740aaa206

SHA1
c2f07eeb141f8e37bf6be476ffba8c25db7baf2d

SHA256
23bdfcfb25d989fbaac3bc635473bcfbb67c8b1164fee1e93f4095391277c53d

SHA512
09e9535e4288db8cb1450f5cae1d43e146367ccfb7779a796b1c26a5e9c1e50ec72673ecbe90ddc84d325e2272a32416620c96d691166e75e1c79af0db42c8fe

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
400KB

MD5
14ca6b9c10bd9cdf9f8e9e4eb75053e6

SHA1
19878b64d812c884810314e4592bdc122a986aba

SHA256
3b905220a696063988f2c9ffc5baac3dec65641a95625dc5c14a9fb4866ad8ab

SHA512
bc2b7f8bca2615d668d15ab94b5c606a9cdbe49b2d1880fa260286eed031ea4622438750e6d2e0218ed3a7e2c8626b0809c184378a6fbe261b37881d8e1f871f

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
400KB

MD5
14ca6b9c10bd9cdf9f8e9e4eb75053e6

SHA1
19878b64d812c884810314e4592bdc122a986aba

SHA256
3b905220a696063988f2c9ffc5baac3dec65641a95625dc5c14a9fb4866ad8ab

SHA512
bc2b7f8bca2615d668d15ab94b5c606a9cdbe49b2d1880fa260286eed031ea4622438750e6d2e0218ed3a7e2c8626b0809c184378a6fbe261b37881d8e1f871f

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
400KB

MD5
8874db77949c1628bef7a0851c0aa127

SHA1
8db1e0c13ff2d4d21b890068caba53f3f24164c2

SHA256
b4db476351a5c4388a8e2b3b04865d850e9dfb218c3475c62460dc49283c0cb5

SHA512
b027f26622756c17598ff4f81a94cc76949cd13b4aa1b00d8ed96ec58b7eaf3d5b9b88221cef4f6eafe5b6b3033ffcc3ad055c6552bb05cb9dd75edd03f1f4b6

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
400KB

MD5
624c3c54371cb776c035388041e6e8bf

SHA1
56f1f49139e672b9fa338822232e5fb427ab458f

SHA256
9c7e36d88925208b179d021b142725d2b22c25c08fa671b6df9a0ee7fb54733b

SHA512
f0f39c960c684431b5eaa1b0dc51853c8f9f1632ae7cf21624e4b67507b571feb1f5e249d78d393e63665889c1c22f8e1bfa0bfdb3fdb0ca212f5964b4fc0108

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
400KB

MD5
624c3c54371cb776c035388041e6e8bf

SHA1
56f1f49139e672b9fa338822232e5fb427ab458f

SHA256
9c7e36d88925208b179d021b142725d2b22c25c08fa671b6df9a0ee7fb54733b

SHA512
f0f39c960c684431b5eaa1b0dc51853c8f9f1632ae7cf21624e4b67507b571feb1f5e249d78d393e63665889c1c22f8e1bfa0bfdb3fdb0ca212f5964b4fc0108

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
400KB

MD5
9f6e4651c1be7a185300be1caeea35c0

SHA1
046fdbfb642e551c73538230c13e06f412e93355

SHA256
e9b55e6e19626269a6f8a53bb02f4ca82a17c10e1dc6dd9d2e32da55b715c4f6

SHA512
053e822973e832491a3c67605d32758b6ff0da98525fefbe0fd5fc86901e2595aa04b411b64d93709f07f607ff452ea16c4f73397d74b0161fb6d5309634dfbc

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
400KB

MD5
9f6e4651c1be7a185300be1caeea35c0

SHA1
046fdbfb642e551c73538230c13e06f412e93355

SHA256
e9b55e6e19626269a6f8a53bb02f4ca82a17c10e1dc6dd9d2e32da55b715c4f6

SHA512
053e822973e832491a3c67605d32758b6ff0da98525fefbe0fd5fc86901e2595aa04b411b64d93709f07f607ff452ea16c4f73397d74b0161fb6d5309634dfbc

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
400KB

MD5
e0891eb6fb7e5a711e124acf2a43bcce

SHA1
6c7c3cfc64e0b050779a6d696609d433ec776bec

SHA256
81d3e03296037c63ae0d771dc55e9ff92ecb5a0b4a8052d28d2cdc03de6319d0

SHA512
ba12c2908a569a7e6856d4b4b6a206d33fe228c10f176aa394df893c2e08baf2067faef02bb7b930a551b78376a9ccbfd3a5408ebfec86d9f5377541f6c748d9

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
400KB

MD5
e0891eb6fb7e5a711e124acf2a43bcce

SHA1
6c7c3cfc64e0b050779a6d696609d433ec776bec

SHA256
81d3e03296037c63ae0d771dc55e9ff92ecb5a0b4a8052d28d2cdc03de6319d0

SHA512
ba12c2908a569a7e6856d4b4b6a206d33fe228c10f176aa394df893c2e08baf2067faef02bb7b930a551b78376a9ccbfd3a5408ebfec86d9f5377541f6c748d9

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
400KB

MD5
bdf4c691f13e40ac0bb45acb457e71a5

SHA1
52d229b319a37160890f23f3085c06f2156fca3d

SHA256
697c224971a70d87d0ccc297442f916225d7e2717d2b4e727aa491871cf53774

SHA512
926e5aa490dcdb6853d5bbbe9c59ab19f021159c88184cf93156cb61cb73e57be2bae494bd48b6bf0d2fb209fd03c44f840322398b79efbcdff218593fc360aa

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
400KB

MD5
bdf4c691f13e40ac0bb45acb457e71a5

SHA1
52d229b319a37160890f23f3085c06f2156fca3d

SHA256
697c224971a70d87d0ccc297442f916225d7e2717d2b4e727aa491871cf53774

SHA512
926e5aa490dcdb6853d5bbbe9c59ab19f021159c88184cf93156cb61cb73e57be2bae494bd48b6bf0d2fb209fd03c44f840322398b79efbcdff218593fc360aa

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
400KB

MD5
23d72ad8947c8cdb5cd59d35e5b7a707

SHA1
8f712cef18eb6e4e045f1dce4a88c2e691656b78

SHA256
f9f8bced5f044a7ce3702802ad4a2a456523804fe87394b7683a53d62cbf0623

SHA512
740b8837c3e3470d02416cb297e7dbc51032f72832720606eb9426ca1d252bf5d0ae4896c41f96df9ad0a456663153e9b44a5f59c0282dbe9329feee0eed03d8

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
400KB

MD5
23d72ad8947c8cdb5cd59d35e5b7a707

SHA1
8f712cef18eb6e4e045f1dce4a88c2e691656b78

SHA256
f9f8bced5f044a7ce3702802ad4a2a456523804fe87394b7683a53d62cbf0623

SHA512
740b8837c3e3470d02416cb297e7dbc51032f72832720606eb9426ca1d252bf5d0ae4896c41f96df9ad0a456663153e9b44a5f59c0282dbe9329feee0eed03d8

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
400KB

MD5
23d72ad8947c8cdb5cd59d35e5b7a707

SHA1
8f712cef18eb6e4e045f1dce4a88c2e691656b78

SHA256
f9f8bced5f044a7ce3702802ad4a2a456523804fe87394b7683a53d62cbf0623

SHA512
740b8837c3e3470d02416cb297e7dbc51032f72832720606eb9426ca1d252bf5d0ae4896c41f96df9ad0a456663153e9b44a5f59c0282dbe9329feee0eed03d8

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
400KB

MD5
51c837eb1bb735fb0bfb4b729064af4c

SHA1
82ca872fa72e8ea077c57c1f51f168d229eff6f1

SHA256
6e182088ab5a2289bb4e5896779a1f10629ad4ff5a7b4460fdd38c2d6bd0db04

SHA512
2a72d1464bb92e495b6ea691346c26026f6952da6c04da0b95c4afc2c6c56a541d7a7f1ff1008a91a803e8d76683a62063be79467b2fbe6a8beaac9e5251cae2

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
400KB

MD5
51c837eb1bb735fb0bfb4b729064af4c

SHA1
82ca872fa72e8ea077c57c1f51f168d229eff6f1

SHA256
6e182088ab5a2289bb4e5896779a1f10629ad4ff5a7b4460fdd38c2d6bd0db04

SHA512
2a72d1464bb92e495b6ea691346c26026f6952da6c04da0b95c4afc2c6c56a541d7a7f1ff1008a91a803e8d76683a62063be79467b2fbe6a8beaac9e5251cae2

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
400KB

MD5
bb2930f5ad3210160137db1fc8998f32

SHA1
8c19637ef924bd4ce70d509ee7216e5ee18315f5

SHA256
4b4b665f7afc4f212123b87107664290b448394bc7a23fdf729932327733d6f9

SHA512
5c78ae0e882f50be157ed379fdf85d6aadae567baeb6fae1f0fb6dd1686e14242930d49a7c25a7ae2eba81aec378e27fcafe9d2590c754be585178ace58f5c41

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
400KB

MD5
bb2930f5ad3210160137db1fc8998f32

SHA1
8c19637ef924bd4ce70d509ee7216e5ee18315f5

SHA256
4b4b665f7afc4f212123b87107664290b448394bc7a23fdf729932327733d6f9

SHA512
5c78ae0e882f50be157ed379fdf85d6aadae567baeb6fae1f0fb6dd1686e14242930d49a7c25a7ae2eba81aec378e27fcafe9d2590c754be585178ace58f5c41

Download Submit
C:\Windows\SysWOW64\Djklmo32.exe

Filesize
400KB

MD5
be368f2b0d23b03ee302487450cac699

SHA1
d0fa82e10c933c51b544cc9d31c2fd194a0096ae

SHA256
e06776b77ad780dab5da623bac95da617327d848176399638cdf312863998d22

SHA512
18c79263564270c306ba86906067bb900639f447e52c4c07ec478c022b9b33bd7b85392a1f01d398b41ff2ca786accce3f3997d104d029a78dcc9def5cf06673

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
400KB

MD5
27ccb20b5b0d68305c30966d39136209

SHA1
50457a2a00ed58d254f5299b2743db6476c1024b

SHA256
26fa21764b93a947acb787c5b1f20b0539380b77e105629167001b2864b441b0

SHA512
a4ff5f62b74135062f7e2006c87db981e7cf2e924f7db375cdcf96bea4a0e2b2b9314b178d0bb8b4ef251975c9d9f2b3166cce2048aa7c50e70789c206de05eb

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
400KB

MD5
27ccb20b5b0d68305c30966d39136209

SHA1
50457a2a00ed58d254f5299b2743db6476c1024b

SHA256
26fa21764b93a947acb787c5b1f20b0539380b77e105629167001b2864b441b0

SHA512
a4ff5f62b74135062f7e2006c87db981e7cf2e924f7db375cdcf96bea4a0e2b2b9314b178d0bb8b4ef251975c9d9f2b3166cce2048aa7c50e70789c206de05eb

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
400KB

MD5
1ef01f60e35d59eb8219f3599b30f883

SHA1
8071c060e259ca34fae8c91b0cfa4c7774a5d042

SHA256
657d3dfbf64407aaa90460470c9bfa04e0eef8c3952cb649e5a2d44eea074387

SHA512
2c0c85d46ae83c9d374c02927e442b57aa594d05cee00b68116e1ac13edebb632fd70a4745a7327e640a8d638e4684d15149b739cd7ce59ea94afe708e1ab9d5

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
400KB

MD5
515e3beace38353396eaa308be831554

SHA1
9406ef98b581d285c5c0168a28b5ad727d46eccf

SHA256
676f3baac0b87a6837ad450cd69291ec5204ece3a17a50149b5a9e151db105bd

SHA512
6cf46d242191cf77033c1127a19d5e584a6af8869d3438c5e845f8700c158e748fa6656326648195b80cafd84b9aded12b2d92ef15ceb9bca47d2e36d43d3dbc

Download Submit
C:\Windows\SysWOW64\Efdjgo32.exe

Filesize
400KB

MD5
0b365c2a5ff2018749d9e51288d2619d

SHA1
5f54a14dafbfbf83dcac3f8b57884be2e3f7e2a6

SHA256
80b1830fa60b6177e4bbf11ddf445b95ed89832989fc47f3ee7cd3391f16ce5a

SHA512
29acd2d3fe947cfc6c1352a7b7c046ad7c14acb4d5f3d10e6ac96f44547673a2e7a49b0343205d5c98175ceb615af1ba66ee28177cbade5c0fce4bb1093b611b

Download Submit
C:\Windows\SysWOW64\Gdmmbq32.exe

Filesize
400KB

MD5
ff846c8108e825ecdee431d89b243605

SHA1
faffbeae3450585cfbf2cac69660a017690e2bce

SHA256
6f990096bea77acd0e20ca989daf5e7b9c6f4fdc208951598407b659abb9a3b8

SHA512
ada1acba525b566453aeb3f90c3829f40828b1f2b10880e83e9ba350fcb619898de2d6f6d3b983632754d7576615a867a10af74b68affd908ee87100aad00989

Download Submit
C:\Windows\SysWOW64\Ggeboaob.exe

Filesize
400KB

MD5
ffd3d04ccd5ec1b29c92b45f7a009a62

SHA1
d69f6408943d825588bb97bbbf4d14fbb2fee33d

SHA256
a1d6933bafb008c9d1143982863b42d3027b01b452bb5b41829ffd6c16f06a73

SHA512
23b32b486d811bc502a7523cbe37e34eebbb43190ed465bb9b272f09887bf22811cdd2d7c3b1bccfc9ca0acda3a691d0b8fb4a68992b6a30030ae801a24b66d7

Download Submit
C:\Windows\SysWOW64\Haafcb32.exe

Filesize
400KB

MD5
15456201b9d035b5bb8a73f1f82e2815

SHA1
621c5e77329e46589094a1c87c5702854fc3191c

SHA256
019f1ebda3fcc07c4dfa814df663a8065292d8f6d01b5fbe1cbae3532d22ca64

SHA512
4e8de81d94ee7e9d83e540ad2596230ca61b57b92629e86ac0db53b410172ca44ce654526b6d5cf2bd6fc9897bfca65e0f11bcfc8cbbdaa78b0269722a3d484e

Download Submit
C:\Windows\SysWOW64\Hdnldd32.exe

Filesize
400KB

MD5
3018e9f0316544189e45698a8bf2f5f8

SHA1
0ada28d392985821a86cb09b2988ffca9adea56b

SHA256
0deb623ef40d22e6fdb27a55faa6e4f91c33e7500b751b518c85d95735b2f2c2

SHA512
e0c6f718bb7605b4270b22fbf2ee11cc1e770e49ef3c2bb36aa9757e23b695c444ee33c726b647376f6f0a95aed52625fcd22167a8b90cd7184fce3abd5dd7b4

Download Submit
C:\Windows\SysWOW64\Hginecde.exe

Filesize
400KB

MD5
e62de790d33a43726a4dc13d9e8bb80c

SHA1
b9a1dc857aae1677c8c71608a7ddfe8c80aa5891

SHA256
d8e3af155371ddd6dfb859c2f97d3e0cb656ecac24b39ee284d0d3b877e4f51c

SHA512
19c8960cff73195663791de2a11c85181f3c4a1de858bf0267a2f8a6325dc92bb4f180fe9bb145cbb5e12c19f5418e168641d5bce9a01ed251804e873728d889

Download Submit
C:\Windows\SysWOW64\Hildmn32.exe

Filesize
128KB

MD5
0dc1bd1d45471a69da19ff1883b9534f

SHA1
f9477729b632ee99b67a1c209a60579c4b8ed92d

SHA256
8ab5eda386d9634689bc6c3e00a8f79b59aaa6e385716a476f699b9b2f8741fb

SHA512
b54eee49371fc5bd1d34a7889666755e3fe2b9d3e8c8f3873b4326b42e7e7159ce607017ef5a78c2b71a6679d1b3fb1444f690fc4ac197814ed2aab90c3d6ce5

Download Submit
C:\Windows\SysWOW64\Ikbfgppo.exe

Filesize
400KB

MD5
5d02307a53d72b0e719ec1eb2a83c150

SHA1
b839afc2a8813ad4956f49cf101fd64406129927

SHA256
9303d1d716c54a2c31dc7629f1e05c1cf5464040adac7e703df52008697d273f

SHA512
248d3168124ed5ce226d7b9391f511ded32b463f4e6841bda7c10521c0c7b815049421f93e7c054c38a92372705f5aff22e7b79775ff272fbf2665aaa43f9d7a

Download Submit
C:\Windows\SysWOW64\Ilmmni32.exe

Filesize
400KB

MD5
a9bb8bbf51693ec6f2f1c851e534a6f3

SHA1
dcb2b0aa18c4fcd9cfb70ee7505a9d7b7fbbd360

SHA256
bae3146dd2e98278160a0c42fe3e8776072b972d810c33206c4df253210d768e

SHA512
116c453d6694358c391c2cdfb3e930da8ed5a218c265e737267457ff2d8103c4acae3f90739c5a1625fcc9abba94840fbe203d785977724cdaaff06df41c38d9

Download Submit
C:\Windows\SysWOW64\Jbileede.exe

Filesize
400KB

MD5
cc43c2c8b36992daef8594d85af489b4

SHA1
93717129e3eb087bfd6fcd202d49f7a5a17a4cff

SHA256
8a7b02cdedcb8754e3959ada5293b9e92a0d12324b79de7dcbac99bdaaf3ce77

SHA512
4956b72dcace632831b81818f85a31b605ba019299df017b8a35643e3eec3957f48ddccb02cc704738f92161ffdb7d6bd063e93bd86bbc47331a15e10ea2cbc1

Download Submit
C:\Windows\SysWOW64\Jnkcogno.exe

Filesize
400KB

MD5
305b7c55fd1edd2e7a385fc621153443

SHA1
c6f316bfe1ff39056031e5aaf89c57020550b9a7

SHA256
31afe7dc5493df71344a0e052ddbcace3ee02e7a79700d21816d1ee6d444044d

SHA512
09a01e8b8b81d1a932b33a08b3582d6cd0642dddf833f53a92fc2860e1ed95e29eb269266dd37e571bf0ff5f988edde0576b0aa090c09ed11f5af0c5b7a08f37

Download Submit
C:\Windows\SysWOW64\Jqdoem32.exe

Filesize
400KB

MD5
c3e0216040a52febda920c4529f17a1f

SHA1
197e53be51cfd31dab72e9c5f4d15a573cade797

SHA256
03b1434782aca1e451abf642727e6c767fbe0b8840a53b1a426ed00b243160d7

SHA512
f0e1fa1274604a3100d480db108e9747a472bb428cf59cf894624ce17c798bfd35bdd1f40c0e1faa37775ab77b4db30054c98e23db5c5a3105e34527e4c6871a

Download Submit
C:\Windows\SysWOW64\Lijlof32.exe

Filesize
400KB

MD5
3e64e76dd3d7f9d8109518f90f08b66d

SHA1
c538dbf2bb67d6c5399c9a1cb79daf76cbf3edf5

SHA256
ef4273c26b6a360f2c3e73be5cee716c8300bb4ce376d9ee864bd5deb5423a14

SHA512
666aebb7b8fd9163b5c598b6a431fc22d5f732882a38bbd56f135e33f6d94d1c7a7b804b32eb6126366ce27e3226278ed7f94926c584a4d1cebeae349c162187

Download Submit
C:\Windows\SysWOW64\Lnnikdnj.exe

Filesize
400KB

MD5
4d7311ca37ab571b23977d61ef2e323a

SHA1
21aa8fdc1511657a3a443839f759a10910ea5b2d

SHA256
d2cf87259b93abd39a96ecc2a47b6c185d81090f6caba179ea5665142191efae

SHA512
cdef5d002d28c405c4df60c49e4bc40c4d522db4212e85d596df6c283ffd7811c100e5ab145459010c36ffb6d74401de51cbd1c75a36ea35883f8ffe93a4aad0

Download Submit
C:\Windows\SysWOW64\Mhilfa32.exe

Filesize
400KB

MD5
0dfd4b2449465b94005ab8c322418493

SHA1
753f57c248eddc5663fa68b6eb5e8cf90b499812

SHA256
aa0805c82591f2232ff127900d68820f0bcb361e1f2ad7280701640e32dc8bdf

SHA512
dc57b97cec82c8deaedb2752c5b7321198caa1c887db599267d374b78f81edd061bbeea3e03120febd85da05163ee9d895cd2e9a624cd5d95fb354a7ad2911ab

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
400KB

MD5
2ac2a3b58836880dfda0cd870e783b39

SHA1
3f4a8fd8a2927a2002539e570cb368391d354614

SHA256
f11ab39ba5fe3c104c68cb168c71023e083ea459b19e7efb26a87686e131cf94

SHA512
7f64c447718d6d66baa144118167ec1823d06bb21e5f86f1dc0aa86dcdad294c344f9f46ab0b7e779baf13adc6b53c4c5f2522ec149365e4adc6923331d64a2e

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
400KB

MD5
2ac2a3b58836880dfda0cd870e783b39

SHA1
3f4a8fd8a2927a2002539e570cb368391d354614

SHA256
f11ab39ba5fe3c104c68cb168c71023e083ea459b19e7efb26a87686e131cf94

SHA512
7f64c447718d6d66baa144118167ec1823d06bb21e5f86f1dc0aa86dcdad294c344f9f46ab0b7e779baf13adc6b53c4c5f2522ec149365e4adc6923331d64a2e

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
400KB

MD5
c5216795e1a4571de7987299f4d90370

SHA1
06d3846b4dd15fe95aeee1c878f4a0d3c4f311ba

SHA256
50d279c3b426d871a3e8e1be8ed85cd6a926c701e04c69ab53d6d78570095bd2

SHA512
ba8f63c62897c05a1b5d02a40c290229a775bb7df2d843a9407880edb606492613e0a880d25dfda42f7946d152a217607d22a88a3dd653d3df282fda6feddea1

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
400KB

MD5
c5216795e1a4571de7987299f4d90370

SHA1
06d3846b4dd15fe95aeee1c878f4a0d3c4f311ba

SHA256
50d279c3b426d871a3e8e1be8ed85cd6a926c701e04c69ab53d6d78570095bd2

SHA512
ba8f63c62897c05a1b5d02a40c290229a775bb7df2d843a9407880edb606492613e0a880d25dfda42f7946d152a217607d22a88a3dd653d3df282fda6feddea1

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
400KB

MD5
ac6a1675035bda5b59fcfd5c54c56758

SHA1
9a681b8c566a219aec239e549fa5e5eb09390a23

SHA256
db44acfabe586af3b8776ece657ddde7e6fbd7b72e3fd853b26b1933e7d95327

SHA512
7a77e17ddbef21a944f5b3549562ad48f05949127fe98ab15ecbe747e29a7359a7cb280915abf38091dca0cd24bd0fed98d97c9e897ee0a6308f18f63898c5f6

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
400KB

MD5
ac6a1675035bda5b59fcfd5c54c56758

SHA1
9a681b8c566a219aec239e549fa5e5eb09390a23

SHA256
db44acfabe586af3b8776ece657ddde7e6fbd7b72e3fd853b26b1933e7d95327

SHA512
7a77e17ddbef21a944f5b3549562ad48f05949127fe98ab15ecbe747e29a7359a7cb280915abf38091dca0cd24bd0fed98d97c9e897ee0a6308f18f63898c5f6

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
400KB

MD5
8a890eeee3af85951c223715e1c5e56f

SHA1
20481940d5d4df2e545065c513f1acc57c1d9799

SHA256
e066333e7b3fe0918064340c975bd0c5f0d4654990b8739827face8190665d60

SHA512
90775b64d2ee675ac0b21893c7ec1e7722b0a52070c0be6d7c17bb054c71ad751efc9ff136317475b51ed78dda316a5b60265cf351a91d0b6f64a10e15ce7c6d

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
400KB

MD5
8a890eeee3af85951c223715e1c5e56f

SHA1
20481940d5d4df2e545065c513f1acc57c1d9799

SHA256
e066333e7b3fe0918064340c975bd0c5f0d4654990b8739827face8190665d60

SHA512
90775b64d2ee675ac0b21893c7ec1e7722b0a52070c0be6d7c17bb054c71ad751efc9ff136317475b51ed78dda316a5b60265cf351a91d0b6f64a10e15ce7c6d

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
400KB

MD5
bf9b990502dff9e1d425dc9d71ec2208

SHA1
ba929f04d0e147bbf66b36784a93410cb7f598e0

SHA256
8d2dfbc3ea922cc9a90ecb154acf19f86ee36c487e5cf48ef8840dadf6d2908e

SHA512
c592dd187430ad33f9d72beccc70bee7bf3249ad0ad1ed5f72a24557e4438d789f295b5a144a97b0823190bc96203d949f3264472ff10e8f4ccf7e39ffbc00ae

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
400KB

MD5
bf9b990502dff9e1d425dc9d71ec2208

SHA1
ba929f04d0e147bbf66b36784a93410cb7f598e0

SHA256
8d2dfbc3ea922cc9a90ecb154acf19f86ee36c487e5cf48ef8840dadf6d2908e

SHA512
c592dd187430ad33f9d72beccc70bee7bf3249ad0ad1ed5f72a24557e4438d789f295b5a144a97b0823190bc96203d949f3264472ff10e8f4ccf7e39ffbc00ae

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
400KB

MD5
9a2bbe8ca64d2dd0d2bc31ed00391ea1

SHA1
b7a4f703fbdca09d0f425cf289c120c5521b8c00

SHA256
74502b3afcd5bdc0ec7eaa7fe8f265d9e483faf951a1500b83320ade694461da

SHA512
c60139f2c043dae8d4c77a1ea0eb64d6f1bb1d1894ebfad9b930eab7bfb76490b488e3b8a362a0f7aaa31f5918558f28a84524fc66a7066005b936c5906373dd

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
400KB

MD5
9a2bbe8ca64d2dd0d2bc31ed00391ea1

SHA1
b7a4f703fbdca09d0f425cf289c120c5521b8c00

SHA256
74502b3afcd5bdc0ec7eaa7fe8f265d9e483faf951a1500b83320ade694461da

SHA512
c60139f2c043dae8d4c77a1ea0eb64d6f1bb1d1894ebfad9b930eab7bfb76490b488e3b8a362a0f7aaa31f5918558f28a84524fc66a7066005b936c5906373dd

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
400KB

MD5
a808b01e2c16b27811d61da1b0b181bf

SHA1
f689a55e850aa55c146ef3da5ea4a5786e19d64a

SHA256
214e0c4dc7f2c4cbd11963f83d0be8db3c8a843680a11e43d073c38a22cf4ed2

SHA512
d52cacc3f99cf78c1321f4bd2035334c71932aa45961423e3092cb3f12b51f818d6c208150fa90cd6018675d2ccd9b99e8fa20cc41c63ab4456c9586d37a2d89

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
400KB

MD5
a808b01e2c16b27811d61da1b0b181bf

SHA1
f689a55e850aa55c146ef3da5ea4a5786e19d64a

SHA256
214e0c4dc7f2c4cbd11963f83d0be8db3c8a843680a11e43d073c38a22cf4ed2

SHA512
d52cacc3f99cf78c1321f4bd2035334c71932aa45961423e3092cb3f12b51f818d6c208150fa90cd6018675d2ccd9b99e8fa20cc41c63ab4456c9586d37a2d89

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
400KB

MD5
a0428b5b327140b9f44d7dc3e35c5353

SHA1
9788352075bba1b60697974017710918d5bff316

SHA256
cc9fc395c51de8d877d22b3d7e175ebe83e181a5abaacaac647452dd5442c922

SHA512
da07a4c2ca1bf7d61e25d62926a0c5016b85e55be9a1833be22c0efb96fc4ff6fa7d72357c8ac18bbabf37090c32173ddae5555c5223bf279d55760abbb9ed57

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
400KB

MD5
a0428b5b327140b9f44d7dc3e35c5353

SHA1
9788352075bba1b60697974017710918d5bff316

SHA256
cc9fc395c51de8d877d22b3d7e175ebe83e181a5abaacaac647452dd5442c922

SHA512
da07a4c2ca1bf7d61e25d62926a0c5016b85e55be9a1833be22c0efb96fc4ff6fa7d72357c8ac18bbabf37090c32173ddae5555c5223bf279d55760abbb9ed57

Download Submit
C:\Windows\SysWOW64\Oenlqi32.exe

Filesize
400KB

MD5
dcd6f8fc71a2d53e2524e0d4b28da46f

SHA1
71c4ea03517a438ec733777a9c9480d30837b45a

SHA256
2cde99b06f8d0b7ac4046fe6e666ba623ca84abf526cfc573d6c5d9e74032bc8

SHA512
4e037e0e1d8e09e93f5eab2d05925b1f0ef15ef178cee5fa58be32df578c5d15726ee1cc40f0b594a5bcd2adda17449b9dd3adfda232a5ebd21735a845ea92fb

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
400KB

MD5
e38d084cfbd3fa02a8096516c103c107

SHA1
aa045a91ad26fa59713bda820361da8e1a538ce1

SHA256
9c873d628b6fd5daff3f1048134feb4c92d4a726f7aa90b5a164e4291a38fff7

SHA512
b31d1ec8ded9836ed66ed7cae24104b9c36ad7bd8fb3008c3a6537f81551cca932578db8bd017ef6771757a1e1c3522d27ec6262da92a4955df9f1d964981981

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
400KB

MD5
e38d084cfbd3fa02a8096516c103c107

SHA1
aa045a91ad26fa59713bda820361da8e1a538ce1

SHA256
9c873d628b6fd5daff3f1048134feb4c92d4a726f7aa90b5a164e4291a38fff7

SHA512
b31d1ec8ded9836ed66ed7cae24104b9c36ad7bd8fb3008c3a6537f81551cca932578db8bd017ef6771757a1e1c3522d27ec6262da92a4955df9f1d964981981

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
400KB

MD5
fee69003cf38b0a2814004495d881557

SHA1
5208e1841c99ef02592d3165bacc0cfcb74c0670

SHA256
48784c4d8396b250e02024eeec8dab5015e50b64154600c0e8105edebd5c373a

SHA512
fa2bb74bb423bdd2fdc7552e3c124971ce22185e8775f9aee0832222e7ab0e068f641f93363028d0548993785c9bea25864b45f04361ec29167c33834da172d9

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
400KB

MD5
fee69003cf38b0a2814004495d881557

SHA1
5208e1841c99ef02592d3165bacc0cfcb74c0670

SHA256
48784c4d8396b250e02024eeec8dab5015e50b64154600c0e8105edebd5c373a

SHA512
fa2bb74bb423bdd2fdc7552e3c124971ce22185e8775f9aee0832222e7ab0e068f641f93363028d0548993785c9bea25864b45f04361ec29167c33834da172d9

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
400KB

MD5
f02bcebc3c2d038cfb4464b8f1518ff6

SHA1
f22975e3b340a25113712aea120cb31b30ce14ae

SHA256
6baacd9bb5f50d26a7684a7a82aabf0466aeebb34d8ae762b2b405fe31ec7bf7

SHA512
04e518e50a52de2f184db7a6ad82371e123ece76e6f00d2e5391d3cf6b912a3027ee63e5e8c6f34cfca3fb6237adab55847ee40092fd70b45b871ba77f71e864

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
400KB

MD5
f02bcebc3c2d038cfb4464b8f1518ff6

SHA1
f22975e3b340a25113712aea120cb31b30ce14ae

SHA256
6baacd9bb5f50d26a7684a7a82aabf0466aeebb34d8ae762b2b405fe31ec7bf7

SHA512
04e518e50a52de2f184db7a6ad82371e123ece76e6f00d2e5391d3cf6b912a3027ee63e5e8c6f34cfca3fb6237adab55847ee40092fd70b45b871ba77f71e864

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
400KB

MD5
0439c0ca5add8177a3ca61d8985ec732

SHA1
ac145082e469d3d3e1c24ba041544d4f37ab8d28

SHA256
3f664aa20fe177ebd0ca9e3fdd4441d42fc5c9a48fa181e9ea26c7f5f06cfeaa

SHA512
636a0f7ba78dd1b1811f2be782abf37072ac0de6e856332ce320e87f832f865512e2dbdc260d78cde0270b5eb5c9e6a4b7f9adc4d77f38ca046d03bc470a7587

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
400KB

MD5
0439c0ca5add8177a3ca61d8985ec732

SHA1
ac145082e469d3d3e1c24ba041544d4f37ab8d28

SHA256
3f664aa20fe177ebd0ca9e3fdd4441d42fc5c9a48fa181e9ea26c7f5f06cfeaa

SHA512
636a0f7ba78dd1b1811f2be782abf37072ac0de6e856332ce320e87f832f865512e2dbdc260d78cde0270b5eb5c9e6a4b7f9adc4d77f38ca046d03bc470a7587

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
400KB

MD5
325519e7de06536034e97eb14a15943f

SHA1
cac12ee8bf7f956994abdbb5f31e223fd8dec775

SHA256
18f7bc82bd050e994eed9af94a973bc1daf2b72e8787dc3f98dbd006040d6820

SHA512
810cdbe728d390cf6b63e7ea59a3e0c0641e1f547788f1253d133a8f69d9c6cc564468fa62cdfe95b19dcb75389ef96dcf8e8165687e36fffd507e43aed02905

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
400KB

MD5
325519e7de06536034e97eb14a15943f

SHA1
cac12ee8bf7f956994abdbb5f31e223fd8dec775

SHA256
18f7bc82bd050e994eed9af94a973bc1daf2b72e8787dc3f98dbd006040d6820

SHA512
810cdbe728d390cf6b63e7ea59a3e0c0641e1f547788f1253d133a8f69d9c6cc564468fa62cdfe95b19dcb75389ef96dcf8e8165687e36fffd507e43aed02905

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
400KB

MD5
325519e7de06536034e97eb14a15943f

SHA1
cac12ee8bf7f956994abdbb5f31e223fd8dec775

SHA256
18f7bc82bd050e994eed9af94a973bc1daf2b72e8787dc3f98dbd006040d6820

SHA512
810cdbe728d390cf6b63e7ea59a3e0c0641e1f547788f1253d133a8f69d9c6cc564468fa62cdfe95b19dcb75389ef96dcf8e8165687e36fffd507e43aed02905

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
400KB

MD5
ee4c0fb818322fa21063ca490da87631

SHA1
ecfb3068cc21cc55bd983924ee7ea37ce66dd80a

SHA256
d2fbd6abd41adf1b5622b3665f337ab65de550f812795d5338767a186a2eae60

SHA512
0b49703bd2fc07e38c161ef2cc8348d4088f47c8dc6823fda96078d5c06adf9e977a77d1c320a700440d8379519016085c45db594b5d800d95081ecb59735a36

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
400KB

MD5
ee4c0fb818322fa21063ca490da87631

SHA1
ecfb3068cc21cc55bd983924ee7ea37ce66dd80a

SHA256
d2fbd6abd41adf1b5622b3665f337ab65de550f812795d5338767a186a2eae60

SHA512
0b49703bd2fc07e38c161ef2cc8348d4088f47c8dc6823fda96078d5c06adf9e977a77d1c320a700440d8379519016085c45db594b5d800d95081ecb59735a36

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
400KB

MD5
085739cd289d6bbaa9123c95108904ee

SHA1
689c5bbefafd41965949917fc2e4555c50023cd9

SHA256
1f22763bccbae63677ea1c2e9345d7b86412df778a46556ad54f785f9af5b671

SHA512
4f838dd126534f90a50ab5460472ca62f45ab734b130978f3727c6ce1f639117362f20547195d1d0a6cf5b69f04125dd39a64e4a94508ca79717ac91dd25c474

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
400KB

MD5
085739cd289d6bbaa9123c95108904ee

SHA1
689c5bbefafd41965949917fc2e4555c50023cd9

SHA256
1f22763bccbae63677ea1c2e9345d7b86412df778a46556ad54f785f9af5b671

SHA512
4f838dd126534f90a50ab5460472ca62f45ab734b130978f3727c6ce1f639117362f20547195d1d0a6cf5b69f04125dd39a64e4a94508ca79717ac91dd25c474

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
400KB

MD5
82943992d3a3fc1c023959573940aee6

SHA1
dc900527d5c8f625e3844cdad8aa6f9564eb0285

SHA256
e957ce3d3f1baa161be3f06f0c89a3835a21fb634b9ca2ed5dd6d22e35941388

SHA512
aa60f35647457e64df04b334ee7d2926869ff50e755f58cc8e193d2a3c5c26bbe48c6ecf0c0dc1a12624ad8420ba406060ef224586b4c6c48f629032f6dc6475

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
400KB

MD5
82943992d3a3fc1c023959573940aee6

SHA1
dc900527d5c8f625e3844cdad8aa6f9564eb0285

SHA256
e957ce3d3f1baa161be3f06f0c89a3835a21fb634b9ca2ed5dd6d22e35941388

SHA512
aa60f35647457e64df04b334ee7d2926869ff50e755f58cc8e193d2a3c5c26bbe48c6ecf0c0dc1a12624ad8420ba406060ef224586b4c6c48f629032f6dc6475

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
400KB

MD5
187517b991b5623045956080bcb52aa0

SHA1
56dfa9b86e0d72d57dc7b67883d5b6feeff5899f

SHA256
852dde51722c76525eaa9da12c20e0eae8de36aedd49c088d0d5d2b22561d50c

SHA512
1c4387ba6d11dc4d231f14bea35f4e5cddb5f9b9e82c8dad9682e47a8a9040267f856a966c9cc417b22cb0dd6e75aec169f1f50f09c7d47a8c9c2d1cff8b60ef

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
400KB

MD5
187517b991b5623045956080bcb52aa0

SHA1
56dfa9b86e0d72d57dc7b67883d5b6feeff5899f

SHA256
852dde51722c76525eaa9da12c20e0eae8de36aedd49c088d0d5d2b22561d50c

SHA512
1c4387ba6d11dc4d231f14bea35f4e5cddb5f9b9e82c8dad9682e47a8a9040267f856a966c9cc417b22cb0dd6e75aec169f1f50f09c7d47a8c9c2d1cff8b60ef

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
400KB

MD5
d32b0ff1c766371be77ae7bc5a578fe5

SHA1
fb0651a475e654e42322448f83e48875b20779f7

SHA256
4649ca1d7a45b3e9698024872396541ce6f264dde3ed9c9e61935e902da6bb2e

SHA512
42e684d170473a198ee9cb85036176f9c347d28059e1ea1d0e6d371cbf923d9c66465bde934771b747f73a7a92384f351a6a88da4b163ae7a7073ecac11baf37

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
400KB

MD5
d32b0ff1c766371be77ae7bc5a578fe5

SHA1
fb0651a475e654e42322448f83e48875b20779f7

SHA256
4649ca1d7a45b3e9698024872396541ce6f264dde3ed9c9e61935e902da6bb2e

SHA512
42e684d170473a198ee9cb85036176f9c347d28059e1ea1d0e6d371cbf923d9c66465bde934771b747f73a7a92384f351a6a88da4b163ae7a7073ecac11baf37

Download Submit
memory/228-320-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-207-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/884-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/956-321-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-391-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1116-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1168-297-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1224-53-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1268-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1340-80-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1340-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1340-5-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1364-373-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1488-403-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1612-439-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1620-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1868-223-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1964-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1988-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2096-451-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2100-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2120-411-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-168-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2332-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2468-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2544-262-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2560-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2912-192-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3000-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3092-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3172-338-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3180-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3188-415-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3248-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3320-309-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3356-284-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3376-433-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3424-268-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3428-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3440-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3588-151-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3616-350-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3916-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4024-303-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4068-457-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4108-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4140-361-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4192-132-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4196-349-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4280-427-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4328-367-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4508-88-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4540-274-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4544-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4572-286-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4708-143-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4772-247-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4872-385-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4880-421-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4924-255-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4948-245-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4980-176-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4988-327-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads