78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe
Size

1000KB
MD5

3708db294bbc89052837b4a5c32c9f1e
SHA1

d06ebf4dc60d3cc0b2e073457a285050a35cf191
SHA256

78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545
SHA512

c51ac13dec66ffcd2e39c6399e2e49748a5aa5c83e9299a010e7f844e64d63f621fae915d0e2ac01c8d56dc41ca808be8431f8b5623a2357645d44593b857179
SSDEEP

12288:ZsSjOtHBFLPj3TmLnWrOxNuxC97hFq9o7:Z0tHBFLPj368MoC9Dq9o7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblijebc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkhgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bciehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgdbnmji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igchfiof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbdhiojo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqhoeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmflbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfealaol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkenjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhnlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhbfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjlgdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbphdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mockmala.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Falcae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahgad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nimmifgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlnbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocjoadei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiopca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phhhhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfcjfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hakgmjoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohlimd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajbmdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amodep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhiajmod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihgnkkbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqglkmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qaflgago.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanokhdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amnlme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbgoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeekkafl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pleaoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofckhj32.exe

Executes dropped EXE 64 IoCs

pid	Process
220	Kbaipkbi.exe
3260	Klimip32.exe
1948	Kdcbom32.exe
4556	Kmkfhc32.exe
224	Lmbmibhb.exe
2812	Lmdina32.exe
1584	Medgncoe.exe
4280	Mlcifmbl.exe
1364	Mgimcebb.exe
1756	Mdmnlj32.exe
2216	Mnebeogl.exe
2204	Ncbknfed.exe
1212	Npfkgjdn.exe
808	Nebdoa32.exe
1356	Nphhmj32.exe
2228	Njqmepik.exe
3372	Ndfqbhia.exe
4100	Nlaegk32.exe
3596	Nckndeni.exe
3332	Nnqbanmo.exe
4884	Ocnjidkf.exe
4296	Ojgbfocc.exe
4588	Opakbi32.exe
4396	Ogkcpbam.exe
3684	Oneklm32.exe
3576	Odocigqg.exe
660	Ofqpqo32.exe
944	Ogpmjb32.exe
4968	Oddmdf32.exe
2736	Ofeilobp.exe
2944	Pmoahijl.exe
1412	Pdfjifjo.exe
1724	Pnonbk32.exe
2888	Pdifoehl.exe
3288	Pjeoglgc.exe
4356	Pmdkch32.exe
4464	Pgioqq32.exe
924	Pjhlml32.exe
3212	Pqbdjfln.exe
4804	Pgllfp32.exe
1228	Pnfdcjkg.exe
4652	Pgnilpah.exe
1840	Qnhahj32.exe
3812	Qdbiedpa.exe
4056	Qfcfml32.exe
4132	Qqijje32.exe
4792	Qffbbldm.exe
3668	Ampkof32.exe
4744	Adgbpc32.exe
1336	Afhohlbj.exe
4436	Ambgef32.exe
1540	Aeiofcji.exe
4052	Afjlnk32.exe
1296	Amddjegd.exe
3916	Acnlgp32.exe
3388	Andqdh32.exe
1712	Aeniabfd.exe
5024	Aglemn32.exe
4932	Aminee32.exe
1560	Accfbokl.exe
1488	Bjmnoi32.exe
2064	Bagflcje.exe
1568	Bcebhoii.exe
2460	Bjokdipf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kbaipkbi.exe	78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe
File created	C:\Windows\SysWOW64\Hakgmjoh.exe	Ghbbcd32.exe
File opened for modification	C:\Windows\SysWOW64\Ljkifn32.exe	Leopnglc.exe
File created	C:\Windows\SysWOW64\Qimkic32.dll	Nopfpgip.exe
File created	C:\Windows\SysWOW64\Hiebgmkm.dll	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Bgkiaj32.exe	Apaadpng.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bgkiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Ihpcinld.exe	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Klimip32.exe	Kbaipkbi.exe
File created	C:\Windows\SysWOW64\Ejldilhc.dll	Jblijebc.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jgmjmjnb.exe
File opened for modification	C:\Windows\SysWOW64\Eangpgcl.exe	Ejdocm32.exe
File created	C:\Windows\SysWOW64\Lgepdkpo.dll	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Aaccdk32.dll	Jgakbm32.exe
File opened for modification	C:\Windows\SysWOW64\Olckbd32.exe	Oidofh32.exe
File created	C:\Windows\SysWOW64\Hgghjjid.exe	Hjchaf32.exe
File opened for modification	C:\Windows\SysWOW64\Miaboe32.exe	Mnlnbl32.exe
File created	C:\Windows\SysWOW64\Jlobem32.dll	Bajqda32.exe
File opened for modification	C:\Windows\SysWOW64\Kdinljnk.exe	Jjdjoane.exe
File created	C:\Windows\SysWOW64\Ikdcmpnl.exe	Hmpjmn32.exe
File created	C:\Windows\SysWOW64\Mjaabq32.exe	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Ggnlobej.exe	Gaadfkgc.exe
File created	C:\Windows\SysWOW64\Bpkmil32.dll	Cmfclm32.exe
File opened for modification	C:\Windows\SysWOW64\Fhflnpoi.exe	Falcae32.exe
File created	C:\Windows\SysWOW64\Pomgjn32.exe	Pjpobg32.exe
File opened for modification	C:\Windows\SysWOW64\Pkhjph32.exe	Phincl32.exe
File opened for modification	C:\Windows\SysWOW64\Mfnoqc32.exe	Mcpcdg32.exe
File created	C:\Windows\SysWOW64\Nqomdf32.dll	Mpieqeko.exe
File created	C:\Windows\SysWOW64\Knegmo32.dll	Ohlimd32.exe
File opened for modification	C:\Windows\SysWOW64\Knefeffd.exe	Kgknhl32.exe
File opened for modification	C:\Windows\SysWOW64\Cbfgkffn.exe	Cohkokgj.exe
File created	C:\Windows\SysWOW64\Aaldccip.exe	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Obimmnpq.dll	Plpqil32.exe
File opened for modification	C:\Windows\SysWOW64\Aamknj32.exe	Pejkmk32.exe
File created	C:\Windows\SysWOW64\Gpkchqdj.exe	Gknkpjfb.exe
File created	C:\Windows\SysWOW64\Pjdhbppo.dll	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Akdbqm32.dll	Hdpiid32.exe
File created	C:\Windows\SysWOW64\Eklpgqkc.dll	Cjhfpa32.exe
File created	C:\Windows\SysWOW64\Jdockf32.dll	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Mbbiec32.dll	Pejkmk32.exe
File opened for modification	C:\Windows\SysWOW64\Kiikpnmj.exe	Kabcopmg.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Nomncpcg.exe	Nhbfff32.exe
File opened for modification	C:\Windows\SysWOW64\Pleaoa32.exe	Pflibgil.exe
File opened for modification	C:\Windows\SysWOW64\Lnoaaaad.exe	Lcdciiec.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Oifppdpd.exe	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Kkfkkmmp.dll	Fgdbnmji.exe
File created	C:\Windows\SysWOW64\Klkkgm32.dll	Ikcmbfcj.exe
File opened for modification	C:\Windows\SysWOW64\Bbdhiojo.exe	Bkkple32.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Cikjab32.dll	Oidofh32.exe
File created	C:\Windows\SysWOW64\Efkphnbd.exe	Eangpgcl.exe
File created	C:\Windows\SysWOW64\Cpiijfll.dll	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Hgdlndji.dll	Amodep32.exe
File opened for modification	C:\Windows\SysWOW64\Hjchaf32.exe	Gpkchqdj.exe
File created	C:\Windows\SysWOW64\Baegibae.exe	Bklomh32.exe
File created	C:\Windows\SysWOW64\Fnihkq32.dll	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Bpdnjple.exe	Bobabg32.exe
File opened for modification	C:\Windows\SysWOW64\Nfqnbjfi.exe	Nofefp32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Ikfabm32.exe	Ifihif32.exe
File opened for modification	C:\Windows\SysWOW64\Nlaegk32.exe	Ndfqbhia.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8100	7832	WerFault.exe	668

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jgonlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngaionfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knegmo32.dll"	Ohlimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckdpj32.dll"	Ejoomhmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chlcgfff.dll"	Ohfami32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noeocqni.dll"	Mibijk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccchof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckmcadl.dll"	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hakgmjoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffmfadl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jkjcbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nebdoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mblcnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knhebpni.dll"	Pcepkfld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmdgikhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbpphi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blcnqjjo.dll"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ohlimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbphdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bppfmigl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkeaqi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gigmlgok.dll"	Igchfiof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhnncno.dll"	Kgknhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjcmebie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffmfadl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ponfhp32.dll"	Oaompd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhhmleng.dll"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nolgijpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eclmamod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nibbqicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocedmfn.dll"	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkoafbld.dll"	Lnoaaaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lljdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hgghjjid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Indfca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lhijijbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjieo32.dll"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgpjggdi.dll"	Gdncmghi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opclldhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djmibn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkadoiip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhlkilba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpikki32.dll"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbplbf32.dll"	Mffjcopi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijeeipc.dll"	Kinmcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hokomfqg.dll"	Ipdndloi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 220	5008	78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe	87
PID 5008 wrote to memory of 220	5008	78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe	87
PID 5008 wrote to memory of 220	5008	78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe	87
PID 220 wrote to memory of 3260	220	Kbaipkbi.exe	88
PID 220 wrote to memory of 3260	220	Kbaipkbi.exe	88
PID 220 wrote to memory of 3260	220	Kbaipkbi.exe	88
PID 3260 wrote to memory of 1948	3260	Klimip32.exe	89
PID 3260 wrote to memory of 1948	3260	Klimip32.exe	89
PID 3260 wrote to memory of 1948	3260	Klimip32.exe	89
PID 1948 wrote to memory of 4556	1948	Kdcbom32.exe	91
PID 1948 wrote to memory of 4556	1948	Kdcbom32.exe	91
PID 1948 wrote to memory of 4556	1948	Kdcbom32.exe	91
PID 4556 wrote to memory of 224	4556	Kmkfhc32.exe	92
PID 4556 wrote to memory of 224	4556	Kmkfhc32.exe	92
PID 4556 wrote to memory of 224	4556	Kmkfhc32.exe	92
PID 224 wrote to memory of 2812	224	Lmbmibhb.exe	94
PID 224 wrote to memory of 2812	224	Lmbmibhb.exe	94
PID 224 wrote to memory of 2812	224	Lmbmibhb.exe	94
PID 2812 wrote to memory of 1584	2812	Lmdina32.exe	95
PID 2812 wrote to memory of 1584	2812	Lmdina32.exe	95
PID 2812 wrote to memory of 1584	2812	Lmdina32.exe	95
PID 1584 wrote to memory of 4280	1584	Medgncoe.exe	96
PID 1584 wrote to memory of 4280	1584	Medgncoe.exe	96
PID 1584 wrote to memory of 4280	1584	Medgncoe.exe	96
PID 4280 wrote to memory of 1364	4280	Mlcifmbl.exe	98
PID 4280 wrote to memory of 1364	4280	Mlcifmbl.exe	98
PID 4280 wrote to memory of 1364	4280	Mlcifmbl.exe	98
PID 1364 wrote to memory of 1756	1364	Mgimcebb.exe	99
PID 1364 wrote to memory of 1756	1364	Mgimcebb.exe	99
PID 1364 wrote to memory of 1756	1364	Mgimcebb.exe	99
PID 1756 wrote to memory of 2216	1756	Mdmnlj32.exe	100
PID 1756 wrote to memory of 2216	1756	Mdmnlj32.exe	100
PID 1756 wrote to memory of 2216	1756	Mdmnlj32.exe	100
PID 2216 wrote to memory of 2204	2216	Mnebeogl.exe	101
PID 2216 wrote to memory of 2204	2216	Mnebeogl.exe	101
PID 2216 wrote to memory of 2204	2216	Mnebeogl.exe	101
PID 2204 wrote to memory of 1212	2204	Ncbknfed.exe	102
PID 2204 wrote to memory of 1212	2204	Ncbknfed.exe	102
PID 2204 wrote to memory of 1212	2204	Ncbknfed.exe	102
PID 1212 wrote to memory of 808	1212	Npfkgjdn.exe	103
PID 1212 wrote to memory of 808	1212	Npfkgjdn.exe	103
PID 1212 wrote to memory of 808	1212	Npfkgjdn.exe	103
PID 808 wrote to memory of 1356	808	Nebdoa32.exe	104
PID 808 wrote to memory of 1356	808	Nebdoa32.exe	104
PID 808 wrote to memory of 1356	808	Nebdoa32.exe	104
PID 1356 wrote to memory of 2228	1356	Nphhmj32.exe	105
PID 1356 wrote to memory of 2228	1356	Nphhmj32.exe	105
PID 1356 wrote to memory of 2228	1356	Nphhmj32.exe	105
PID 2228 wrote to memory of 3372	2228	Njqmepik.exe	106
PID 2228 wrote to memory of 3372	2228	Njqmepik.exe	106
PID 2228 wrote to memory of 3372	2228	Njqmepik.exe	106
PID 3372 wrote to memory of 4100	3372	Ndfqbhia.exe	107
PID 3372 wrote to memory of 4100	3372	Ndfqbhia.exe	107
PID 3372 wrote to memory of 4100	3372	Ndfqbhia.exe	107
PID 4100 wrote to memory of 3596	4100	Nlaegk32.exe	108
PID 4100 wrote to memory of 3596	4100	Nlaegk32.exe	108
PID 4100 wrote to memory of 3596	4100	Nlaegk32.exe	108
PID 3596 wrote to memory of 3332	3596	Nckndeni.exe	109
PID 3596 wrote to memory of 3332	3596	Nckndeni.exe	109
PID 3596 wrote to memory of 3332	3596	Nckndeni.exe	109
PID 3332 wrote to memory of 4884	3332	Nnqbanmo.exe	110
PID 3332 wrote to memory of 4884	3332	Nnqbanmo.exe	110
PID 3332 wrote to memory of 4884	3332	Nnqbanmo.exe	110
PID 4884 wrote to memory of 4296	4884	Ocnjidkf.exe	111

C:\Users\Admin\AppData\Local\Temp\78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe
"C:\Users\Admin\AppData\Local\Temp\78b8a29f370a5bb1ef305c350a485edd625e4c917f87aa2cee3c607493433545.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\Kbaipkbi.exe
  C:\Windows\system32\Kbaipkbi.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\Klimip32.exe
    C:\Windows\system32\Klimip32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\SysWOW64\Kdcbom32.exe
      C:\Windows\system32\Kdcbom32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4556
      - C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        24⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        25⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        27⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        28⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        29⤵
        Executes dropped EXE
        
        PID:944
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        30⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        31⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2736
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        33⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        34⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        35⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        36⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        37⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        38⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        39⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        40⤵
        Executes dropped EXE
        
        PID:924
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        41⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        42⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        43⤵
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        44⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        45⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        46⤵
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        49⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        50⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        53⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        54⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        55⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        57⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        58⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        59⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        60⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        61⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        62⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        63⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        65⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        66⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        67⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        68⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2496
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        70⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        71⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3060
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        73⤵
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2132
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        75⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        77⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        78⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        79⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        80⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        81⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        82⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        83⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        84⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        85⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        86⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        87⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        89⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        90⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        91⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        92⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        93⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        94⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        96⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        97⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        98⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        99⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        100⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        101⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        102⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        103⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        105⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        106⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        107⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        108⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        109⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        113⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        114⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        115⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        117⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        118⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1868
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        120⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        121⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        122⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        123⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        124⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        125⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        126⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4032
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        128⤵
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        129⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        130⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        131⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        132⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        133⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        134⤵
        Drops file in System32 directory
        
        PID:1472
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        135⤵
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        136⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        137⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        138⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        139⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        140⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3428
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        142⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        143⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        144⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        145⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        146⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        147⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        148⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        150⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        151⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        152⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        153⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        155⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        156⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        157⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        158⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        159⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        161⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        162⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        163⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        164⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        165⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        166⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        167⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        168⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        169⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        170⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        171⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        172⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        174⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        175⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        177⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        178⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        179⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        180⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        181⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        182⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        183⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        184⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        185⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        187⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        188⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        189⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        190⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        191⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        192⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        193⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        194⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        195⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        196⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        197⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        199⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        200⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        201⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        202⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        204⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        205⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        206⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        209⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        210⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        211⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        212⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        213⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        214⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        215⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        216⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        217⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        218⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        219⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        220⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        221⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        222⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        223⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        224⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        225⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        226⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        227⤵
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        228⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        229⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        231⤵
        Drops file in System32 directory
        
        PID:7804
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        232⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        233⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        234⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        235⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        236⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        237⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        238⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        239⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        240⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        242⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        243⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        244⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        246⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        247⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        248⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        249⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        250⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        251⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        252⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        253⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        254⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        255⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        256⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        257⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        259⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        260⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        261⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        262⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8400
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        264⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        265⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        266⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        267⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        268⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        269⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        271⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        272⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        273⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        274⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        275⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        276⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        278⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        279⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        281⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        282⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        283⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        285⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        286⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        287⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        288⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8864
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        290⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        291⤵
        Drops file in System32 directory
        
        PID:9104
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        292⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        293⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        294⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        295⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        296⤵
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        297⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        298⤵
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        299⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        300⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        301⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        302⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        303⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        304⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        305⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        306⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        307⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        308⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        309⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        311⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        312⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        313⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        314⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        315⤵
        Modifies registry class
        
        PID:9508
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        316⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        317⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        318⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        319⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        320⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        321⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        322⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        323⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        324⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        325⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        326⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        327⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        328⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10116
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        330⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        331⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        332⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        333⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        334⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        335⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        336⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        337⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        338⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        339⤵
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        340⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        341⤵
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        342⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        343⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        344⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        345⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10144
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        347⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        348⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        349⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        350⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        351⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        352⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        353⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        354⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9804
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        356⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        357⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        358⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        360⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        361⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        362⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        363⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        364⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        365⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        366⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        367⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        369⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        370⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        371⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        372⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        373⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        374⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9644
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        377⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        378⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10332
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        380⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        381⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        382⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        383⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        384⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        385⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        386⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        387⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10804
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        389⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        390⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        391⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        392⤵
        Drops file in System32 directory
        
        PID:10996
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        393⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11092
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        395⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        396⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        397⤵
        Drops file in System32 directory
        
        PID:11216
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        398⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10296
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        400⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        401⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        402⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        403⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        404⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10548
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        406⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        407⤵
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        408⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        409⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        410⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        411⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        412⤵
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        413⤵
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        414⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        415⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        416⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        417⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4044
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        419⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        420⤵
        Drops file in System32 directory
        
        PID:4884
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        421⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        422⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        423⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4844
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        425⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        426⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        427⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        428⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10976
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        430⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        431⤵
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        432⤵
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        433⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4292
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        435⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        436⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        437⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        438⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        439⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        440⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        441⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        442⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        443⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        444⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        445⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        446⤵
        Modifies registry class
        
        PID:10444
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        448⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10464
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        450⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        451⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        452⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        453⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        454⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        455⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        456⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        457⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        458⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        459⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        460⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        461⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        462⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        463⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        464⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        465⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        466⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        468⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        469⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        470⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        471⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        472⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        473⤵
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        474⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        475⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        476⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        477⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        478⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4372
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        480⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        481⤵
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        482⤵
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        483⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        484⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:972
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        485⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        486⤵
        Drops file in System32 directory
        
        PID:3636
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        487⤵
        Drops file in System32 directory
        
        PID:348
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        488⤵
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        489⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        490⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        491⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        492⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        493⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        494⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        495⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        496⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        497⤵
        Drops file in System32 directory
        
        PID:1488
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        498⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        499⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        500⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        501⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        502⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        503⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        504⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        505⤵
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        506⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        507⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        508⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5532
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        511⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        512⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        513⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        514⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        515⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        516⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        517⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        518⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        519⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        520⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        521⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        522⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        523⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        524⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        525⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2836
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        527⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        528⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        529⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        530⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        531⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        532⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        533⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        534⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        535⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        536⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        537⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        538⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        539⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3904
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        541⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        543⤵
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        544⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        545⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        546⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        548⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2668
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        550⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        551⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        552⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        553⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        554⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        555⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        556⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        557⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        558⤵
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11140
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        560⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        561⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        562⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        563⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        564⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        565⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        566⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        567⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        568⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        569⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        570⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        571⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 420
        572⤵
        Program crash
        
        PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7832 -ip 7832
1⤵
PID:7212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
64KB

MD5
d6728fa0c68c78e0938db001f601e28b

SHA1
47097da1997a656ba5a4c583bb476e431422123f

SHA256
9a0a24170b62589b3a2ac3b75bc9676793e766a97f9b49f96ac04abab84d1693

SHA512
9142fea4416d9e2c44a219e238c5035207c6f83f02067a0ddac26c9847bb809b62e05275dbef45a6848a7fcdc2fd6d0e5a57eb93889cf523e125a0ff284289bb

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
1000KB

MD5
eb8db246ef48af4ab0cdcb7606da5c40

SHA1
3ac7e26efa1ec6184447a554c39a048bdfcaa60d

SHA256
2f08c26b03316fdd8e2da7472797e6708c873ef2ac529c1efbe6570628b93670

SHA512
cabfcc22fb38948405fb029a0d9332a28765affd005af63c473743f799ded517187431888339258ca4c3bc847fbda5fb47dfe5826d5ad0a22037a9c58dd3dca7

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
1000KB

MD5
f379e7d70b3cc420c1e75480795173c6

SHA1
51f7225c8fc7528a94a65a8004879391acec7de5

SHA256
8e030e64a0da054a5ce72146c9e1b835aa286650d0930def150f5a8f3763680c

SHA512
62a5807195f70115a6cbc9e7127694b3b5dda76debc6f7544f061d377a2503f98c5deb13ac7594a38c63493924bd07a815c9e54fd30f18a70d4b096fb4006f60

Download Submit
C:\Windows\SysWOW64\Allebf32.dll

Filesize
7KB

MD5
ba6079879e5472f74ea29a96c98db0fc

SHA1
1c609e328379e7b19ae46f964800fc0287943ce4

SHA256
3df56f8c42f726aac409daed76a643cef5f951581f95d02cc0c5a7a0274bd352

SHA512
c3e4e3f802c32a1e55992199330cb7beeff0bf4f0730d92040291acd31a0adb868709ce61cc63dcbca3ebf4fe15b80954067f3f8d16506deaacba264ab2ade6e

Download Submit
C:\Windows\SysWOW64\Bcfahbpo.exe

Filesize
1000KB

MD5
3433e4a15fbf71fe2438c42df95ff581

SHA1
f9d46c9cb7a542b66352e08c7bfd08bb5af6e937

SHA256
98bb58070eeea26922f902db6aa5a39df51f6dd243205bebe142419505ea1848

SHA512
cbbb2ae71539eb211a78a1ad3ff606160581affedaa2b1b7f913040496de465fb0dfa127955cff0f41b8d3fa08feb5621b3d50b75b30cd8586e8a62e57b41dff

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
320KB

MD5
efb953663f83debe5483dbf225a02cd2

SHA1
2b7f2df81c786bd81eb21476c29572f72d4ebcfd

SHA256
4bec755c2f7e4b8c9dcf04f2ca2e54ec81f8a98539399228dbedd128c8cd56c6

SHA512
a61f772193ef257428a04771b96bd1dea43d584653797a9eaa25365a72837775ee9eda7b01005e3d21f3b4f235c6c8ceb206f10ad0cbad7f624bda9fed9cdb21

Download Submit
C:\Windows\SysWOW64\Cmflbf32.exe

Filesize
1000KB

MD5
7a78c32b8efdf990adafbac4236dabda

SHA1
b4fc32a42df50ad6540d1c271f0424fe8a59e6e7

SHA256
3fc19f0f6f3b2d443ccba4b1f514d8c271852a6b4bbd5f79ae4400bfd04e412a

SHA512
fc45a341d93108980d0eb625affa7065f97f9c7e4945c1b6559f050db2774ac39415e63640038e2a0f3ac9066f1cf6bd4b500621d0fb9c0576e2b772b1e8823d

Download Submit
C:\Windows\SysWOW64\Dgejpd32.exe

Filesize
1000KB

MD5
ea2128b4b69f34a26d8cf7734e8507d4

SHA1
88eb81108b06f7317f20d20c96b62f75f1761a44

SHA256
76a1c1b45ff4c76bed7e5d27e592a8b17977b912767ff34fe87dd2914eadd525

SHA512
daa0141d80471453e9374351b0fe33ecdc268238ad8509078c7aaf23c7dca3aa27df7a9be0377b7b61cc8883b150575f1bcf9bca0182a09a10042841e772b119

Download Submit
C:\Windows\SysWOW64\Djmibn32.exe

Filesize
1000KB

MD5
24e6a8a82b5c95d8f4457c8e80c2b6a6

SHA1
9b6b5c0e153b07b66dd2b1a905c03711d08c892a

SHA256
e51c2f1f2861934d13d69ece934c32eaa57eff8970bce54f51c815c35e9d238b

SHA512
53789a3c5c6b267f2c5fc9be8edc04892ceb7a8c94666603d2198528d4b7479560373e70105c8248eeba0c72d17fab7b1d1fb721c1aa0f9f3f19b0aeaaad3b3b

Download Submit
C:\Windows\SysWOW64\Faenpf32.exe

Filesize
1000KB

MD5
f506dec5788716637eb1f8d9e9fcd3a1

SHA1
116eb1c58534040fb568f6c46626a59e45cfe1bb

SHA256
0332d33f5150c1c2f3e7984377b87d783eeef6a66410aff40c325f6d64be6052

SHA512
6aff34af9441c1f95d85a828d7c38be5cf495972603bcf435c3b3ecdc2b96b969fbe1fe620c1dcb2ba9d0a59079517d76eeb19b4c7e0c66b52f1e915c34dc6d0

Download Submit
C:\Windows\SysWOW64\Hdpiid32.exe

Filesize
1000KB

MD5
807b27eb355523a400b33615f2da03ea

SHA1
42f69541f3b8ffba9a8fe273379d365cb2761fe8

SHA256
1bb92cfadf591bebf6be0fc88d668e2a19a486e9dec8c823f76a6273adbcb37a

SHA512
0ba47d3a6641b7f5dc0ef6ea20bfb5a473e4f35efc41d052f2357dbef45bf5cc2f536fffbe5e6a65f47cacf09ad63464d3eb33fea12bb1f76c3092aeb12f6eef

Download Submit
C:\Windows\SysWOW64\Hjchaf32.exe

Filesize
1000KB

MD5
07189de28e4fe9b018090a62a129f7f3

SHA1
1e029e71ca0b1d497dc66f6d06c9d901d18e667f

SHA256
37d3798ef815832a7a2684c70dca2a5b1aed5057d45cea7ab2fa924724229fea

SHA512
fa9cc66b70308c8b33212e376582192542215d8f6690891e349132dca71664c6a557fed556231581f2802e5061b9f6cf84fbf9632ba3fc39c2823ca66232d5b9

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
1000KB

MD5
f6c0d55300e756c88ccf3a5325c8842c

SHA1
e095ec1351fba687b246c74b8088bea4d369a645

SHA256
a7cf6f46b2a8353ac59ba2c1efe3e380a4dd7437e88284d4cc34a42318252bf8

SHA512
8509968beb8123421613abb541f2db926ed40165366c1704dff6b8b647620ead3b752dc1e615ebc63fc8c665434d5d038ea46c64ad4333cde5272dc07b9983f3

Download Submit
C:\Windows\SysWOW64\Hmpjmn32.exe

Filesize
1000KB

MD5
6fb5f6605541598b647caffae1cb3a33

SHA1
2fc4b6b42162e6d181aa90e4aafb13e3d6385a49

SHA256
8ca70e300d6e51e34f72caf56516d897fb61eee2ace9767944a1c035638085d5

SHA512
70bc5bdae98eb64f26de70202b21c9e82dc08bb166806e5a54dbe2e4228c1908570fa3903a46ee114731ac34f93abc084abedacc15ee4e601df28d9cc1fa1ea3

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
1000KB

MD5
121aeacbaf472e4e9c02ecd137884136

SHA1
ebaa71975987fe9ffcfdf5dda06b889482d27c1f

SHA256
31f46b67a8f338c99e04c565fafcbd8499596b0e788e1cad83569e5bb29d015b

SHA512
b15004c9cab97ef6a3e7af15249fc25dfb025e34165070bf58b07e4fe7c93a378c7fd93850fd451baafc34b2528e35eea3a88e1a962eb019225aa9f6405de961

Download Submit
C:\Windows\SysWOW64\Jblijebc.exe

Filesize
1000KB

MD5
2538dd5a84698ea62bb80afb67b4fcfe

SHA1
467a324507511f71155c7e7448bb8fe9c91564d8

SHA256
c2687b0ecb059b0ff402e56ff404ea488b5f8043a88b594086b8870eb16fe581

SHA512
9f4ada31f8f59f502af5583021628c7bb54b9bfc5a897a767cb48c77ef829ac07979ddcef1ddc8472389c6cc3c6d959781ca49ccf5ad8617904df329a3b58c41

Download Submit
C:\Windows\SysWOW64\Jodjhkkj.exe

Filesize
1000KB

MD5
34134eab336c7a5de3a031033e8e04c4

SHA1
d92490a2b953a56b1029b215d2bfb674ca8c9382

SHA256
b0e264d9a00ba925ee00f2467959f8aaa4189256e111dc311f36b343c563e5b2

SHA512
bdcda728cf3438cfbf03228c271c14e6ff2e6749811a2dfdecbc7999f5aa5b652219e56378582dde74585ccfc36cd32f525c29f3132b8a994682c8b6845b3b80

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
1000KB

MD5
b31d3b6d3adeab263e45058e6054aea1

SHA1
de3df766e28f4353f6d196c1937a05408d8bcf0d

SHA256
48e13fee33586f855e17713e36f667080a8bd7d7baa39671e1e94ff69938f15c

SHA512
e09e1059fc41a1b0a176f2f8225fba88370096189d432195e6c26aec0dd1f9617650773624890e0519cb0ef83e2e16b9717aae66db0e3424eb8c268a6982934e

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
1000KB

MD5
19d43aed24287a8098a3cf908c573268

SHA1
44824da773b4fdf336a886a1df747ff05d5c113a

SHA256
ac075bc705bec308f218473362c2e0b37239134d35165eb799c5d0e3ea1c214b

SHA512
3f8831b42043754af36efcb4962cb191724441ed3ea0ad21c1cd698b4c54b4099b1d493e3848536edcfe04c9d04f3b048a9f3ed9756ac69e9d1e85b439ca5cad

Download Submit
C:\Windows\SysWOW64\Kimghn32.exe

Filesize
1000KB

MD5
ffe9a9a9c47f3f4f9a82e2f91c2b1b9b

SHA1
86ac10110e6753629cd81a0e18861b0d532de9a4

SHA256
2bdb613165e7ba47dc0cc545022acdc3ab37dc54bf7262d569a2b83988f19e8c

SHA512
9c428c66971e815fed76a79616453fce3db775975a79b4bac4c1bf312a9092d94bfb34ec720b64de088a8bba57a19fde7d462ce4a7ad0084627f2c593e7d00dd

Download Submit
C:\Windows\SysWOW64\Kkpbin32.exe

Filesize
1000KB

MD5
355cd41d7c811981dd6aa61445a43b15

SHA1
8986d5dfc1100b764e3ecb0d7c6aa702a1fd672d

SHA256
6c13629427026ff0c0fbe95232a4679b1b0064bd7f855b022d1bce918dd76004

SHA512
9f6d0b341b43a6a7e3656af797b0c7e74b8a04b3c83167f3aeb416cf45e6aadde90dc91f1305f688a55e974d7d01e0bda883c9133df3bb83ca1955554eb7dd11

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
1000KB

MD5
0d6a1d15d8046676bc61e2eb95f3928b

SHA1
c53d0a2fb4aa5cf645e1d808938f769387212dd4

SHA256
7a57cf50911f9eb25db2c16340059388a7fef2c192da6681229734f5767326a6

SHA512
e411da205255458c3c9ed5407bc6cac511c893d92db5555038229618d64b7a233c5ced79c354ecfcf18399972d1f852030b494c57c98be642dbfad382d45e1ad

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
1000KB

MD5
bb41eb8f73745ae1d563571b90d0dcf1

SHA1
a23206c0831eef6ab7b04a69d58012d00ac95ac8

SHA256
ca73984d53341e16658e80cd2e58a39c3aad3fb716dc6ceafb31780954052262

SHA512
272a27f4e41677be5cae521be7a871ee562f01822ab2fd7f73a8c339543daeb137f16d49162cd262fc3c08feb110dbc55510950468c0b1d1ce595bb8937629d9

Download Submit
C:\Windows\SysWOW64\Leenhhdn.exe

Filesize
1000KB

MD5
eb6d5537a6c9761403ee9f93e70f42c2

SHA1
5a40c5f08262a286d004cf871df09f629be161d9

SHA256
9951c506113ddba74a2b71b8afd280ebd7b441b3fa66c3f81ca52df6d974cfa6

SHA512
77b3c7187b86043844a9350cc12e39b0aaa06494ff7822d18ae05c414057bdaebaa8b45f0358855f0f6fe91fe812ec4622028a902606e9b5bacfc5fade16c5a4

Download Submit
C:\Windows\SysWOW64\Lelchgne.exe

Filesize
1000KB

MD5
f26daee6e3b4c2ba9c1b48f9f1495cd3

SHA1
63a06c21539ca2eeba11274369ac7bf7b0d3323e

SHA256
2ff6af234cc989d8b4e3ab1ce6a3738455966e90809b2b79c5235ce96c7aa956

SHA512
148a2d4484b0d3d73d60eeb22cb5f88247ebb8ebf896c3f05f21ab75d1815d05e4eb14dfd02780f040e2c15e66e0cbdad5ae61dd0c9abee3383f00fed51858e0

Download Submit
C:\Windows\SysWOW64\Lhijijbg.exe

Filesize
1000KB

MD5
645d2651b7bd567729c52e45b7c3b9ed

SHA1
982fdc4ff7b207a1ff36a5d284871d6ef86b45fc

SHA256
9e7cfc1a29545746707482cd9fdb1feac138ac0c3f4b17dd3c6f24ac080dfb60

SHA512
5af3b3953ea1ccee6f7bebe8089627a82ef56266dccef61adf6a9f91edc0277dc3307b90485cac8d68a5d0d810a5191243e437e6f43361320f95a3c144b46f7a

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
1000KB

MD5
a8f20dd8e7101bea01d4878eab2606c4

SHA1
56d9c0d884bfdf7b39b546b5b8dac6a014d270e8

SHA256
154d67fa71d8fce8e9177c17d179bdb85b0ee88de0786718bfe6a18547149fa1

SHA512
e46c37c6d32137d200a680908690b68342b9fe129238fb3bb5235853b389c8fc51f0f214d59b11c6a7935e84a2ae08a0e43a08e9329f2c90c3cfdec0dca9b653

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
1000KB

MD5
2ecea97c0d01939025747ffd901261fe

SHA1
3e78458e11f5727354ec865ba0d33a0029d6b8a7

SHA256
99c25ec4df29d897134f4360486727edbce18f950c29b052097c8a48fa2673dc

SHA512
49c55f43f2dd879fe0b8233adb480e0e55f21cc9e1a03d5f68c9dd192585bf4d07528546452259426c4622af388f7b749e23ec829f0acfa30b98e5532ca4fd2e

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
1000KB

MD5
1818359e3ca9b8ef644db47e93d67adc

SHA1
b1a87cd1214b3674abdc8277781410929cbb8512

SHA256
5faafe29c09258a8156830eecdf4d9dd2c0662c8892e305de67d74e83a8eba91

SHA512
55f2619ff9c414ca086321a0c68e38af4cedd8cea1136c0816cde39ec0575e5cf31e0eb24f1522b062089816bd455f2de2bd2d3bbe8e690d0ad4aa812ca71375

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
704KB

MD5
9382bbd60ab6a513d3d8c238af92a20f

SHA1
9155563d0e4928e535291f50cf27909595b177b3

SHA256
fe07dea121defa52312585d1f3b458a98e08744a08c0e40de5b58a0532646abc

SHA512
cec003a19af0d5d24d8a137b9bdb3979a6172807fc761bcc8cd5fe230de1a479bfa46b4a522542dbecd8a1e43d3b3bf236e2b70b9e005af3cccb8082b9fa66fe

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
1000KB

MD5
ad09f3642420a0b065905b5e6c734ac6

SHA1
9c7ad30bd8c6b0b1893ae45d278b39ab8e87dffc

SHA256
f7779ac7915fed6238bd061c59fa99898a276595c7f8c68a5b3d04f581762ad9

SHA512
5a6324703c18606b4eeed8fe50cdc6566bb43c7959e32c4a5e0184e3767e5ae2f31826e4acaf488ea8717c37380fdef175919d18c370e67e6f778d8e6f4ff625

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
1000KB

MD5
7f0e658289d9177e4ee2a476c7806a75

SHA1
c4c8f16d8c7b1cc9432784a85e18eca8eac87434

SHA256
9a6ee272512ca80fc29ac444e18fd61efd8a35957b29efa0033939ffd63f6ec4

SHA512
f8a8c8dad1973016305625317efd5e447c6bdcf65eeba74764f8a8d4f11573473694456e3e8de2e9eff4d82ca0249ff428dea95c901dad1953c2cd1e40d24906

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
896KB

MD5
498e60378b3b335beeb957855d369bad

SHA1
a2d142a347d151cd60807de6279f4235ea7a1b41

SHA256
0f83f29016e56c42c5f7493f3e44c9c6d4a91e25decd921b7e27380398963e26

SHA512
0a82e4b2a3f6f91a11b496563f46541e2d4455fe181aade07c7cbd9166057384c3d6310383113a3c896a40630fc18a4d24b32283cafd40ffe9b3b21a0d28e138

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
1000KB

MD5
c9286afdf40097b3b00d46ef3107d0da

SHA1
f283bb108e052ad63de70f09a20f0ce277028dce

SHA256
f1af9ee78458538037b477eac05eae4aa1249c9bc76039035bc6fffa749b8eaa

SHA512
814ba4d59b55597c4644d315c69bdb27f917fdd52c88ef17c6f0df306b1ede4068c61c33ce688d458cb6558576020bff7249a5bb2e9118c0a5b0207cca35e21d

Download Submit
C:\Windows\SysWOW64\Mlklkgei.exe

Filesize
1000KB

MD5
67ad69208a9d2bee8f4423b3bc469230

SHA1
f127f62f929fac727c25d713d78ec6f548cb0b65

SHA256
37db7c2279aa2681f931627666bad3837a6b5f8c60aea9b0dd87e6309cf3a5f1

SHA512
e4b15873ca19fbd82c183e300ccc876265ccceaff2be3a78f0e1ade7c62e53c2723a26c8bfb8f49f12fa5ad25fd8e02b4164c572260d96029bf45987eb52dcc0

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
1000KB

MD5
4e5b6a42dd5fa267177b05798cb13deb

SHA1
528604862aaecdc4aab48d6a373c38f894ccdb7e

SHA256
6a259d9bf016ded69e05ee943dce50534b3787b8271d53bec52ae1ca21afb03f

SHA512
2ca661abe36c1cd9af680a6f2084ff6b693e41f4385d4fc048e2e69d4d9cdb816b74a12fa6461ff5814e52b971f5ce177ca8540a0f0c202aeb04a2730809156f

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
1000KB

MD5
6c36d54c06366720e5bdfcdc858b4f4e

SHA1
a34d6857f597d1a62480b5389629e40e65576b88

SHA256
3deb48b394a11ef65abe01722b46c19029c9ee8bcd16a5f2f021644cfcb3c63c

SHA512
17bc159e8041f1037fb6f97b9c888688664855ee0233aaff53ef15a7112d0d555ea304decbdde79da5502bcf502c0b95dfd1c66622441a2013b34fc60c85c376

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
320KB

MD5
e010af6124160f486ca5326c57e56058

SHA1
1e56be661ef95384f5d83efb06f8b5b7fe72c67d

SHA256
0ea3f18debbe1bb1ed45bd926747aa38ce9cf78822828304a6610475be3f3ed5

SHA512
9377370c29111b81a374f932a5f70178a601cb8e953024d80c5d575d917842e843a4cdf1df735595983df76af75808b3b3d6eab78dadacedb9600f44e0ce8242

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
1000KB

MD5
e865937a778f183434ced18ad88d4685

SHA1
0adb61adab73be71adc7057291ebdcf80ff1cbdf

SHA256
18ae0bbbc8a32134dfee487e1bc0d724e046e931037635d81910dba2ca47abfc

SHA512
476977ebc02890b9dcd1985e53c494f65513147145de57d0ad7a3dc038f0938854146918ffd8dae2791e47f3c0c869f6b3eb853cb1f734e656ad9d6559b08139

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
320KB

MD5
59f45229f4f4be83c10f2757548dba57

SHA1
b4954f006c3ebdf60e708b6fde8c6b585b418651

SHA256
c6a9dd02a794fc1dc1e48bed7352aa2f903e2537412b5807023c3d64becea5dd

SHA512
9bef334a631ffd1689da6153fcb8f426be82df502de6a31eb7c23a5e2535e841f462e740eaa35ea4ecd25e75aaaa4e3803246b62b2a37544ac79c632b53b4a97

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
768KB

MD5
2e8f0b5d3f3cb3a3bf2bcae3ff5c197e

SHA1
5817daa8e944fc5497d28d1d2acb63bd032f4ff8

SHA256
85dfedad601f9c20ba522eb7377606250ec69ee00e44a6fb669038100286ab93

SHA512
df8ec00e0b2d4722b47db5b58cd874e6d787e9b51c8a35bd712db6f2d2a8f40182317c0e0f4e636dda2351a1c5265f58afbf58b4942f4d9cc71a6e1bef6fa619

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
1000KB

MD5
be03531f1ed1448a90503ee8e1796e2d

SHA1
f13ebfb331631f805a8d93321278244f64e81de5

SHA256
7b0d788a48deb8ecbfe6c63f5941cee18e0cfa1191efa6cb65928799f9e74334

SHA512
ac4af105c2f18789085ba9ab10da36bfb13c845fe0cce8893125313222b5b04061c99680dc950b2bc0b95583b16047e69eeaa28c55d229a31803277019198f46

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
896KB

MD5
a709a198f24c519d46506e1eadcc9491

SHA1
1e7d59d3dfe1adb3f8d8b8d1a471e10dc5920d73

SHA256
4e2c9d4801fe6cad9a63af171de7ba02089a423326200c043632bf9fcb49e305

SHA512
3f1145f92376f45b52e969995d043842fed719c2c9e90ec4cb8dd09144512916c98756601ef87b16b929857d0f79b0bc42ffc152bbaa5ad3066599db3acb4fec

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
1000KB

MD5
7b1f25780f19b351d07f8e72da1b6e4f

SHA1
8da6f1bbe867891a845dfa7575243d787b9aedf0

SHA256
be9475b54b39ba15e3d62ede096f481fddc16a9d2443013d3648d337c2e7ddae

SHA512
425e719a3422493d56b2be23e987bc63125ffa66cb14c3483ad1c0480d57d7837f76eebb275d8cbc1c53a840277894bf27989fef4aef2fd8bc4734a844333112

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
1000KB

MD5
9a1f6dbb41c1a269ce41c52d4563d710

SHA1
47aebcd7320d864585f27ffb797a5c5e72cd0b49

SHA256
f2fc865bad2117d5af8d2dadd5cb348db6949993e9449ea7bc0a9b915c9c9ff7

SHA512
57e9f451886aaf6fd8dfa152e188ed5f0aa08df3c304428d73d21f11798a5736548b989f4afafd54ed050b8d9007b9a371f5934d2cad8059ca7be202ccba8e9f

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
64KB

MD5
f7a134d401c30e0243874ef21d379aa4

SHA1
1898891b36bcd8cb0315ff48b3457a7bccbfd701

SHA256
9dab4974c97030f5b71502e20d8617db338434816014439a7e32edff340acde0

SHA512
6aace1fdcaccb5bd94d98c2c25548c312b5f016f1b3d1475fe5350a8340c3abd5934cddd9ff2bfaad5b2ae198abbe6f99e814020be62c8e64b4db97cb5aecf0b

Download Submit
C:\Windows\SysWOW64\Nemmoe32.exe

Filesize
1000KB

MD5
52f4b9aa40fe5e02fd38332f434aeab9

SHA1
1a1a5e858de4891e6f38d6447eb608778ffbc73b

SHA256
098cb77ec7653fec42870c1a6c11eb3eb18be9a2e3b71aace76c9f4aece6d042

SHA512
ae2f4bdf32e01f23c3da507ccd9461c7e8df1cd0d6f2999335e5559c1e30bf4cdb1afb7bb2fdaaedb9caefb0ae25ff1116f85ec9333546c957fbda1c79531540

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
1000KB

MD5
797006a8234fcf43cc945d46d8c4afa8

SHA1
4c0fe713316a892e41219153fd830048c060573c

SHA256
8875bc3ae3c26ce3417be0c85e4e90869a8ec5aff6ecda091785d078f8cb432c

SHA512
6c5440f08ddb0e144d0ad659df7583dd6ba1b810d27670a6a7579c61dc42212d9a8adf501b07e7569c15e833fffb1160dfde7cae45b0ba6c3fd5e914d474fe20

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
960KB

MD5
2b19514ea3e1dfba70917006d23d8ebf

SHA1
3569fa9d981d4405df05a98cd6937c429fecc579

SHA256
21eeeb04b8e856c4ac22e9e7cb4d2bece232891ffc61773b7508432639c8c570

SHA512
9144009c1ee914e025e5f8aca5abda2bf1c6a90d2a8bf4f75c6778ca9fd7d57952494a8f765188a7a752060792807df69c134ae500ef00c222ba52f60a4c5a21

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
1000KB

MD5
4d4b92bd98065838738d20d281565b30

SHA1
11282c7de4eb96b1ddbb7ab3b3d105b383369b5c

SHA256
835dfb0bfa1a4f1d4efc5a5c48c9ec15d5fb36f5a524ac24d6637388bf274c23

SHA512
8ee5d0eb1520e71256b0d01c18218d238435a8c1d644697d020b9eb0f963f51ab8aa50101d0150ed9af2643e3ec5423d5edf941146741f9722ddcc0012eadd87

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
832KB

MD5
f01acd9e321c70cc00c83bbe4657f74d

SHA1
7d7a6aa15d69c209aecc8b809062d43622ef2632

SHA256
8e16bfe13cf4bc9414f2831e6629d43294fabace53b84886522211b196cd768d

SHA512
01c6b846ca7eac3ba603121e14b7839abd4f379d26d18a67eade1b6f3c1734b8f567836c6addeb75ee5c010edd6acdbd625c826d70671de2b737e46b511560d4

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
1000KB

MD5
6c1db95c54cddb336f839a704d7f5e05

SHA1
e07cb6849c31880c3562cf374e43f9413027324b

SHA256
9f72181b49c26864eb08a8563ba67ee9f895014aa3f0c7b443b8aa1c1019b792

SHA512
4a24524597a442bf6fd9fe0516066da528801866364c96eb7bde871869becc37230a273b4f0f5b35d6fabd27b01ed711ff79de1f47753261972fbac54f0f4bdc

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
1000KB

MD5
308889b0251ddf76e5da2811c8eb164a

SHA1
6aa0447787fb06f03ff88d3c65c66d207b8240a1

SHA256
bc65c5dedf6a34b5cab72935271dbfaadf4a6e820c077e74bba80c548efda5da

SHA512
88c758cf8607d05b5af9d972a50dceac042a833898278c3b5d9ec4df5e3221ca6836a9ff9861f0769755316b522c903f35c27b09265a7acfbc77befec5ca8641

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
1000KB

MD5
3405f1e41ab1770dd78e6962f676d9b1

SHA1
68305a2062bb45e86c8df5b51225acc535bb513a

SHA256
0a95a0e07b73a711a4e94d1ff8f2ba29ce06fd24f773c1253111a84b024a966c

SHA512
f8425718ad06f22cf281207914a352306d06b210997b9aba993059a901bc87d170269b81d2794334fc18c87ac3b49d96ad163bdda224e55fe476e5cf716f20a5

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
42KB

MD5
446b9f1b13ca640b6ebd30f155e11893

SHA1
73b20171b2a18f7c339d66ae54adc0c1d72bc827

SHA256
7a7b4db9127be906be429dbd71c99fb26adc46e9cb635741b7dee3000417e06a

SHA512
bc8e30be1d9c1b8d7e17d016e13d12e1dd6b6aaf63f3ddb4b35691caecadce7e21f26ccc56b4a213f5097759d61496e666c425f4756a2de0f3b60b30521b517c

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
1000KB

MD5
e146e0cc11047bf1b801f8fa03a151ac

SHA1
cf19e4b49d8fbc714fb18834e288756333309d21

SHA256
f19f64643019ea6572a351985c345ee4f7c4ff5f249f0001b158bfdba17d1630

SHA512
1ee747d7bebb42ebb243d8322658a12fb83fef739cc73a11af08b169ef0b8cc036980c2075a2f212d306e3798613156f8a8c74626038e29d384c10aaf1625d01

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
640KB

MD5
bb1842db466d01bf513b378d54141688

SHA1
00448fb372e9a7edf8ea6e79895b2638c7a092e1

SHA256
a02d3d57a1ecf6c97e6f3a15886175b6c7e5cb8d6ea172d8f61855c68ab770e2

SHA512
446455bf6e668bc1dd39fe997d35f3a6f34a5730bec3338c00e0f56660ba32c259a2971241d95c12f05f12aa025ff01cb598748885fd7dbb86634778e9ce66df

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
1000KB

MD5
e62177b5d73a7a1f0a7a2e47344a57a4

SHA1
b6aa8e8e4fc6e87e8c90a9229e04fcb3ebd4b39c

SHA256
52e1a3da9e1f92a01de0d081c785e8cf6c88b324ac46d5c195bc2093def535fb

SHA512
f5b96a9cdab5e038951621fb5ac6d46c4b5279911ce9517c1db988e58b72da6476704fe4452fe0b2d420633050f93b19de221e1094aba7b49ce5caeaae51b817

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
1000KB

MD5
26fc4d217b4b5aea0e5a1794b7e11a05

SHA1
4ce149e2fe1b42697732044581624577da45c30a

SHA256
0a5bbe17b41adab008a7535ae2e1baa213a901d23277d5cb4c66019993d04b2b

SHA512
73cfaa1018f3d0dbc1f85bd14dba8abdb466f14b1cebf39cb077e7f0b9c0dcfd0931a2127bc4ae3f393f09f4dab63643ffc492bf1c04775a1b82c91f5993b0f7

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
320KB

MD5
e6678b27828ba7f6a2c6cf56eae96c79

SHA1
27781f2028958fc6a09fe74ebcc88b2df94d1877

SHA256
c30c0362e1bd916f055c32d5490f579a37eab26c4e7b08b1d81b040b7a2e347a

SHA512
6a3f7e7fa9d130f3b858121f2e7b036bd56d0e2a0fe35c1c95a41ec4c738a723e0af6a5e16f25ecaeb33756dba2bd9be99c42638d439e593f1680657cd569563

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
1000KB

MD5
615f196e799b2bf4e14a59c7ff2eed87

SHA1
512272d960a60c689666264462e6da3f870caebe

SHA256
80fd84b395b82682e8a47350c8042613e7cbbfe1214402e03422cf03ba09d2c1

SHA512
101145fc3b540119ce920d5461d67ad73c5fef7350c7a8b763629fbffe44fc8c2957e86bea49b6f4a08db6cae220be3ce11db27becd84949462bb81492362302

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
1000KB

MD5
e0104f9a1d0f3fb5be1103bc1e936eef

SHA1
2123bdee30cc746aff7c30280b3d8b739222abaa

SHA256
a70b4a18f0564f4fb3a3be62c02becd05a8a71f6e388de2e5197e9f0bac4a498

SHA512
ba7ca4aa4eb04e1319b8bd970b42fe51d82c477094016cec03738c26b05d83fa7942e77f76a91bc3107c87e37afd1b83625b9e0d5242caa668df263c7563a30e

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
1000KB

MD5
5488ad90d50e433a95c6c1a308520ca6

SHA1
f1c84f7adb7e2c0769f0ac2151b661ea0cdfb189

SHA256
171b9d519aab0406f71d3936166071abab7750aca8cb581f1f4ea034d5690555

SHA512
89a1843374b4b6aeb2740cc2707340ebe12d3c48a3e4084e51950d15fbfd88534be4dd48889bf4507abfcfaed3b01cb2ff65ef90f98094cc67cab6d053943898

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
448KB

MD5
6663f1208675a9259e63471a01480978

SHA1
c37a2cb8052678d07ffacebafe02d4189e622f1a

SHA256
c35c34fbf7340ca7337df2206082d6de54d438a8c4baba3764cb1b4c17b502c2

SHA512
f3dae975004258764d3175660d0ac2e559987b648b605f78a0aa396e1be92a4b867fa092ed8d7fb898bc28a5d3b1d46b18b7dd40d7d5c68a4af9a4f65dca90d5

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
1000KB

MD5
492ea62ae564fb50e1409e29ea3e0a1b

SHA1
6ca1b26ca2927f61f50f77d554eb418c03802537

SHA256
ccebe72fc9ef81c0478966d5ed14bdc1cc905cba0b17d909b4b1675e1d61fa35

SHA512
3968ec620dcc1dd49909e071cafcdd3b844a3314654fe0efa74c8436e55399c4187817851ce2e2435310074ead31b588d158d1eed8199c6a19952018f4384755

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
1000KB

MD5
52118cce42a6adf530d1e431eb4bc5e2

SHA1
a6244b95b2b62c16fdfb17daab8f3e090ccd8842

SHA256
cb3b0571d984bfddca87c89ad07dd5829a7fa5fc545c5846588128a6edb3e755

SHA512
53a193a5d314507258ff4c7ec692c45e52ad25492df96adbffebf66d8501a8b76120e914eedd01297c226e57c9d1c53eb6a71c7081c9e9e00dc5a7b9ed411f0a

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
1000KB

MD5
210d77ca9878c4dc34bedcdff0b32f98

SHA1
73bd5f8bd6c377ebefdbb0f29776d645cc51c43f

SHA256
a5601c82c1ed28117dcfe28921b91c3da8cc895e63d2cb29e42b1619838b5ffa

SHA512
1de14f5617a2e9f8d184f096a39f24ac2eb2978190c5b16c4dcd610e30db7572b7c69db41ed698cf234491af85b61b1b69ccad7e397d8e4fc60bc14b0b69900a

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
1000KB

MD5
11745bd73a6474455014cc6dcc2c8711

SHA1
6966332ad261665c435b69f8564216e3177861b9

SHA256
cbfc0046302dc657d30dddf6b5907305a88cd1c19b5f0c7907ebb070b082059f

SHA512
1c5b13ed55d857b4611245bd9355dfde8d69c00fb721bf11baadf483cf978b219776587ee798ce01d93d1d85a95ba9eee1bb031b326f4029e1b0ede0fac2a608

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
1000KB

MD5
0af0b1539abba525e55fa5db862de7fe

SHA1
aa0839886ca509195c3be55a51178c2978585640

SHA256
bd819a769825d52c41a570ec3df6f8467e93aad96af9501efa7c30911270ef92

SHA512
e5c94752d876571787f6e21ad3e7546929282f0f37872c6d363b1d0829f5cdf2a37005638cde5e856304613c31602e191a384dfe9e4b510f11933dd33a69508e

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
1000KB

MD5
0ce830239decb2c21d5d9599e2a9b566

SHA1
aecf5779810bd5ee8b8307c36581e1b0961a0c08

SHA256
13b59994748efbbf88cd6fa2d81beaca8848148ce8f144e251160004e3a7508f

SHA512
e8c6904dcb8c689256d6e4995510625845504d109118157624c548b7d4e02b90f508f6209b5b35c50cfa8a899cdb9d7e8dedc608a8ee53d660dff4c04d773c59

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
64KB

MD5
123d76dd1ad595f3808200af0b3a44e4

SHA1
847da929c8fc2fb06f479f3a4dd11592fe7df214

SHA256
81027113add8aaed9535f5201ec57543c29ac55205e70e6f34ad98686b7b3add

SHA512
4e5a23bd5553a518980547c3a854a3ec6b3edc5ef31d397a48f33e328cd5b6100fde7a75b62d7452c2472c5267b3cc495afd0bbd0eb0fad1e40b9e1155205f62

Download Submit
memory/220-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/224-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/660-454-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/924-466-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/944-455-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1040-456-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-104-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1228-469-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1296-482-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1336-478-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1356-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1364-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1412-460-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1488-489-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1540-480-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1560-488-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1568-491-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1584-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1712-485-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1724-461-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1756-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1840-471-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1948-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2064-490-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2216-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2228-443-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2460-492-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2736-458-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2812-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2888-462-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2944-459-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3212-467-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3260-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3288-463-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3332-447-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3372-444-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3388-484-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3576-453-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3596-446-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3668-476-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3684-452-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3812-472-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3916-483-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4052-481-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4056-473-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4100-445-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4132-474-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4280-68-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4296-449-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4356-464-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4396-451-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4436-479-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4464-465-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4556-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4588-450-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4652-470-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4744-477-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4792-475-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4804-468-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4884-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4932-487-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4968-457-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5008-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5024-486-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/8220-3093-0x0000000075C30000-0x0000000075C48000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads