acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe
Size

81KB
MD5

dffd47050de1a942d44b4cd5a004d75d
SHA1

f9d3b711ce09dba77e9869ab4f822e444e915e2b
SHA256

acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd
SHA512

e79fb4ff06d72468588fe8ea8c1b65a55761288d4f508bf0cef92666992d39dcb2f227f1312d0fb63a8467436d1e030946b835e291b8c3bb4761df4184a70066
SSDEEP

1536:Bi/qc56niHWrHhLzCAQJk4Bq7m4LO++/+1m6KadhYxU33HX0L:C6nYWt6ltBq/LrCimBaH8UH30L

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbgkei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llbidimc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfpbmfdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaiimadl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejlnfjbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjlgdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcpmen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnpabe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olgncmim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhpiafnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdffbake.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Legjmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obcceg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggpbjkpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emoadlfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldjcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmnqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lopmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjokd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maodigil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkenjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnnimak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbmohmoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplafeil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emkndc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloidijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jocefm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihdafkdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdodkebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knflpoqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qofcff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjlpjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqdcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nijqcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjficg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gahcmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfokoelp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbqqkkbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Locbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkaicd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nefped32.exe

Executes dropped EXE 64 IoCs

pid	Process
4008	Knbiofhg.exe
3060	Klfjijgq.exe
4468	Kflnfcgg.exe
1636	Klifnj32.exe
4380	Kbbokdlk.exe
5068	Klkcdj32.exe
3200	Kfqgab32.exe
2588	Klmpiiai.exe
2928	Kefdbo32.exe
908	Llpmoiof.exe
3936	Llbidimc.exe
4996	Lejnmncd.exe
1332	Locbfd32.exe
2432	Lhkgoiqe.exe
1732	Loeolc32.exe
4388	Lhncdi32.exe
4544	Lbchba32.exe
2592	Mpghkf32.exe
1676	Mfaqhp32.exe
1856	Mpieqeko.exe
1868	Mplafeil.exe
4936	Mehjol32.exe
3004	Mfhfhong.exe
2076	Mleoafmn.exe
4176	Niipjj32.exe
1712	Ngmpcn32.exe
1620	Nhnlkfpp.exe
4612	Nhpiafnm.exe
4448	Neffpj32.exe
448	Nplkmckj.exe
3088	Ohgoaehe.exe
1340	Oekpkigo.exe
2984	Ocopdn32.exe
3424	Opcqnb32.exe
2804	Oileggkb.exe
2152	Ocdjpmac.exe
4568	Ojnblg32.exe
4820	Ocffempp.exe
4952	Pgdokkfg.exe
5032	Pgflqkdd.exe
2292	Phhhhc32.exe
1580	Pcmlfl32.exe
3580	Phjenbhp.exe
892	Pcpikkge.exe
4908	Pqcjepfo.exe
816	Qfpbmfdf.exe
1616	Qljjjqlc.exe
1980	Qgpogili.exe
1368	Qjnkcekm.exe
2800	Agbkmijg.exe
4728	Aqoiqn32.exe
2256	Agiamhdo.exe
2460	Amfjeobf.exe
1864	Acpbbi32.exe
3648	Amhfkopc.exe
4896	Bjlgdc32.exe
4456	Boipmj32.exe
2916	Boklbi32.exe
640	Bfedoc32.exe
5132	Bqkill32.exe
5172	Bfhadc32.exe
5212	Bmbiamhi.exe
5252	Bggnof32.exe
5292	Bihjfnmm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Knbbep32.exe	Kiejmi32.exe
File created	C:\Windows\SysWOW64\Kkgiimng.exe	Kqbdldnq.exe
File opened for modification	C:\Windows\SysWOW64\Phigif32.exe	Pejkmk32.exe
File opened for modification	C:\Windows\SysWOW64\Ompfej32.exe	Ogcnmc32.exe
File created	C:\Windows\SysWOW64\Jafdcbge.exe	Jikoopij.exe
File opened for modification	C:\Windows\SysWOW64\Llpmoiof.exe	Kefdbo32.exe
File created	C:\Windows\SysWOW64\Qhmqdemc.exe	Qmhlgmmm.exe
File opened for modification	C:\Windows\SysWOW64\Klkcdj32.exe	Kbbokdlk.exe
File opened for modification	C:\Windows\SysWOW64\Milidebi.exe	Lhmmjbkf.exe
File opened for modification	C:\Windows\SysWOW64\Jjjpnlbd.exe	Ijcjmmil.exe
File opened for modification	C:\Windows\SysWOW64\Edoencdm.exe	Dkedonpo.exe
File created	C:\Windows\SysWOW64\Kdohmibo.dll	Lhkgoiqe.exe
File created	C:\Windows\SysWOW64\Lmhqnncg.dll	Cceddf32.exe
File opened for modification	C:\Windows\SysWOW64\Efhcbodf.exe	Empoiimf.exe
File opened for modification	C:\Windows\SysWOW64\Fiodpl32.exe	Fbelcblk.exe
File opened for modification	C:\Windows\SysWOW64\Kiikpnmj.exe	Khiofk32.exe
File created	C:\Windows\SysWOW64\Hncfnebg.dll	Gdoihpbk.exe
File created	C:\Windows\SysWOW64\Jecampmk.dll	Ckpbnb32.exe
File created	C:\Windows\SysWOW64\Aamknj32.exe	Anaomkdb.exe
File created	C:\Windows\SysWOW64\Fqfojblo.exe	Fnffhgon.exe
File created	C:\Windows\SysWOW64\Hbkbod32.dll	Knbiofhg.exe
File created	C:\Windows\SysWOW64\Kmnoab32.dll	Kelkaj32.exe
File opened for modification	C:\Windows\SysWOW64\Klahfp32.exe	Jokkgl32.exe
File opened for modification	C:\Windows\SysWOW64\Jafdcbge.exe	Jikoopij.exe
File created	C:\Windows\SysWOW64\Cinbbnpa.dll	Ibobdqid.exe
File opened for modification	C:\Windows\SysWOW64\Hkdjfb32.exe	Hcmbee32.exe
File opened for modification	C:\Windows\SysWOW64\Cdolgfbp.exe	Caqpkjcl.exe
File created	C:\Windows\SysWOW64\Iicfkknk.dll	Pcmlfl32.exe
File opened for modification	C:\Windows\SysWOW64\Qfpbmfdf.exe	Pqcjepfo.exe
File created	C:\Windows\SysWOW64\Ajmdgelp.dll	Dcpmen32.exe
File created	C:\Windows\SysWOW64\Emjnfn32.dll	Gcjdam32.exe
File opened for modification	C:\Windows\SysWOW64\Imnocf32.exe	Iefgbh32.exe
File opened for modification	C:\Windows\SysWOW64\Mmkdcm32.exe	Mjlhgaqp.exe
File created	C:\Windows\SysWOW64\Kiejmi32.exe	Kqnbkl32.exe
File created	C:\Windows\SysWOW64\Bjmped32.dll	Knbbep32.exe
File opened for modification	C:\Windows\SysWOW64\Glgjlm32.exe	Giinpa32.exe
File created	C:\Windows\SysWOW64\Gbnhoj32.exe	Ganldgib.exe
File created	C:\Windows\SysWOW64\Ddhomdje.exe	Dajbaika.exe
File created	C:\Windows\SysWOW64\Ggpcfd32.dll	Ennqfenp.exe
File opened for modification	C:\Windows\SysWOW64\Mpeiie32.exe	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Abmjqe32.exe	Apnndj32.exe
File created	C:\Windows\SysWOW64\Bdlfjh32.exe	Abmjqe32.exe
File opened for modification	C:\Windows\SysWOW64\Qljjjqlc.exe	Qfpbmfdf.exe
File created	C:\Windows\SysWOW64\Naaqofgj.exe	Mldhfpib.exe
File created	C:\Windows\SysWOW64\Knbiofhg.exe	acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe
File created	C:\Windows\SysWOW64\Hcmbee32.exe	Hkbmqb32.exe
File created	C:\Windows\SysWOW64\Keoaokpd.dll	Hhimhobl.exe
File created	C:\Windows\SysWOW64\Ionqbdem.dll	Qjnkcekm.exe
File created	C:\Windows\SysWOW64\Cmhigf32.exe	Cfnqklgh.exe
File created	C:\Windows\SysWOW64\Gbalopbn.exe	Gpbpbecj.exe
File created	C:\Windows\SysWOW64\Kdohflaf.dll	Llqjbhdc.exe
File created	C:\Windows\SysWOW64\Lepein32.dll	Nefped32.exe
File created	C:\Windows\SysWOW64\Fpejlmcf.exe	Fjhacf32.exe
File created	C:\Windows\SysWOW64\Iloidijb.exe	Icfekc32.exe
File created	C:\Windows\SysWOW64\Lnkapdda.dll	Afgacokc.exe
File created	C:\Windows\SysWOW64\Jdodkebj.exe	Jjjpnlbd.exe
File created	C:\Windows\SysWOW64\Dpifjj32.dll	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Mcecjmkl.exe	Maggnali.exe
File created	C:\Windows\SysWOW64\Mlmadjhb.dll	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Amoppdld.dll	Bkmeha32.exe
File opened for modification	C:\Windows\SysWOW64\Mfaqhp32.exe	Mpghkf32.exe
File created	C:\Windows\SysWOW64\Gbofcghl.exe	Glengm32.exe
File opened for modification	C:\Windows\SysWOW64\Mqdcnl32.exe	Mcpcdg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7448	7316	WerFault.exe	800

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccnncgmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obncjbkf.dll"	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijadbdoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbiamhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdolgfbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kflnfcgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjlgdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhmeapmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljclki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laiipofp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjnifbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Belqaa32.dll"	Fpjcgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdijliok.dll"	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhkacq32.dll"	Edoencdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bokehc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqjbddpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihdafkdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nopfpgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agbkmijg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Milidebi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lepein32.dll"	Nefped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boflmdkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejfeng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnckgmik.dll"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajndioga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqkihfg.dll"	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkjefc32.dll"	Aeaanjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpekmi32.dll"	Iomoenej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnekbm32.dll"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Milidebi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miepkipc.dll"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpieqeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niojoeel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mleoafmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpodlbng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jddnfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjafok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chflphjh.dll"	Iefgbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcpcgc32.dll"	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klfjijgq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aomifecf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqjkhbpd.dll"	Cjaifp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpikki32.dll"	Obnehj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boflmdkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqknkedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caqpkjcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edoencdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kelkaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kndojobi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckdpoji.dll"	Jnjejjgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgmhcaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmkff32.dll"	Jpenfp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4008	1660	acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe	93
PID 1660 wrote to memory of 4008	1660	acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe	93
PID 1660 wrote to memory of 4008	1660	acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe	93
PID 4008 wrote to memory of 3060	4008	Knbiofhg.exe	94
PID 4008 wrote to memory of 3060	4008	Knbiofhg.exe	94
PID 4008 wrote to memory of 3060	4008	Knbiofhg.exe	94
PID 3060 wrote to memory of 4468	3060	Klfjijgq.exe	95
PID 3060 wrote to memory of 4468	3060	Klfjijgq.exe	95
PID 3060 wrote to memory of 4468	3060	Klfjijgq.exe	95
PID 4468 wrote to memory of 1636	4468	Kflnfcgg.exe	96
PID 4468 wrote to memory of 1636	4468	Kflnfcgg.exe	96
PID 4468 wrote to memory of 1636	4468	Kflnfcgg.exe	96
PID 1636 wrote to memory of 4380	1636	Klifnj32.exe	97
PID 1636 wrote to memory of 4380	1636	Klifnj32.exe	97
PID 1636 wrote to memory of 4380	1636	Klifnj32.exe	97
PID 4380 wrote to memory of 5068	4380	Kbbokdlk.exe	98
PID 4380 wrote to memory of 5068	4380	Kbbokdlk.exe	98
PID 4380 wrote to memory of 5068	4380	Kbbokdlk.exe	98
PID 5068 wrote to memory of 3200	5068	Klkcdj32.exe	99
PID 5068 wrote to memory of 3200	5068	Klkcdj32.exe	99
PID 5068 wrote to memory of 3200	5068	Klkcdj32.exe	99
PID 3200 wrote to memory of 2588	3200	Kfqgab32.exe	100
PID 3200 wrote to memory of 2588	3200	Kfqgab32.exe	100
PID 3200 wrote to memory of 2588	3200	Kfqgab32.exe	100
PID 2588 wrote to memory of 2928	2588	Klmpiiai.exe	101
PID 2588 wrote to memory of 2928	2588	Klmpiiai.exe	101
PID 2588 wrote to memory of 2928	2588	Klmpiiai.exe	101
PID 2928 wrote to memory of 908	2928	Kefdbo32.exe	102
PID 2928 wrote to memory of 908	2928	Kefdbo32.exe	102
PID 2928 wrote to memory of 908	2928	Kefdbo32.exe	102
PID 908 wrote to memory of 3936	908	Llpmoiof.exe	103
PID 908 wrote to memory of 3936	908	Llpmoiof.exe	103
PID 908 wrote to memory of 3936	908	Llpmoiof.exe	103
PID 3936 wrote to memory of 4996	3936	Llbidimc.exe	104
PID 3936 wrote to memory of 4996	3936	Llbidimc.exe	104
PID 3936 wrote to memory of 4996	3936	Llbidimc.exe	104
PID 4996 wrote to memory of 1332	4996	Lejnmncd.exe	106
PID 4996 wrote to memory of 1332	4996	Lejnmncd.exe	106
PID 4996 wrote to memory of 1332	4996	Lejnmncd.exe	106
PID 1332 wrote to memory of 2432	1332	Locbfd32.exe	107
PID 1332 wrote to memory of 2432	1332	Locbfd32.exe	107
PID 1332 wrote to memory of 2432	1332	Locbfd32.exe	107
PID 2432 wrote to memory of 1732	2432	Lhkgoiqe.exe	108
PID 2432 wrote to memory of 1732	2432	Lhkgoiqe.exe	108
PID 2432 wrote to memory of 1732	2432	Lhkgoiqe.exe	108
PID 1732 wrote to memory of 4388	1732	Loeolc32.exe	109
PID 1732 wrote to memory of 4388	1732	Loeolc32.exe	109
PID 1732 wrote to memory of 4388	1732	Loeolc32.exe	109
PID 4388 wrote to memory of 4544	4388	Lhncdi32.exe	110
PID 4388 wrote to memory of 4544	4388	Lhncdi32.exe	110
PID 4388 wrote to memory of 4544	4388	Lhncdi32.exe	110
PID 4544 wrote to memory of 2592	4544	Lbchba32.exe	111
PID 4544 wrote to memory of 2592	4544	Lbchba32.exe	111
PID 4544 wrote to memory of 2592	4544	Lbchba32.exe	111
PID 2592 wrote to memory of 1676	2592	Mpghkf32.exe	112
PID 2592 wrote to memory of 1676	2592	Mpghkf32.exe	112
PID 2592 wrote to memory of 1676	2592	Mpghkf32.exe	112
PID 1676 wrote to memory of 1856	1676	Mfaqhp32.exe	113
PID 1676 wrote to memory of 1856	1676	Mfaqhp32.exe	113
PID 1676 wrote to memory of 1856	1676	Mfaqhp32.exe	113
PID 1856 wrote to memory of 1868	1856	Mpieqeko.exe	114
PID 1856 wrote to memory of 1868	1856	Mpieqeko.exe	114
PID 1856 wrote to memory of 1868	1856	Mpieqeko.exe	114
PID 1868 wrote to memory of 4936	1868	Mplafeil.exe	115

C:\Users\Admin\AppData\Local\Temp\acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe
"C:\Users\Admin\AppData\Local\Temp\acebe3b066d810b3925fdb4a6e58bca61cd8012ff918b6e3b2b65c28b2eeaccd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\Knbiofhg.exe
  C:\Windows\system32\Knbiofhg.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\Klfjijgq.exe
    C:\Windows\system32\Klfjijgq.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\Kflnfcgg.exe
      C:\Windows\system32\Kflnfcgg.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        23⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        24⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2076
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        26⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        27⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        28⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        30⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        31⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        32⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        33⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        34⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        35⤵
        Executes dropped EXE
        
        PID:3424
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        36⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        37⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        38⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        39⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        40⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        41⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        42⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        44⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        45⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4908
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:816
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        48⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        49⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        52⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        53⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Amfjeobf.exe
        
        C:\Windows\system32\Amfjeobf.exe
        54⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        55⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        56⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        58⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        59⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        60⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        61⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        62⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        64⤵
        Executes dropped EXE
        
        PID:5252
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        65⤵
        Executes dropped EXE
        
        PID:5292
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        66⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        67⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        68⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        69⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        70⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        71⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        72⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        73⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        74⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        75⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        76⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        77⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        78⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        79⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        80⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        81⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        82⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        83⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        84⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        85⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        86⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        87⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        88⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        89⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        90⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2328
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        92⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        93⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        94⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        95⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        96⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        97⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        98⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        99⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        100⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        101⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        102⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        103⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        104⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1560
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        106⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        107⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        108⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        110⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        111⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        112⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        113⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        114⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        115⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        116⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        117⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        118⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        119⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        120⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        122⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        123⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        124⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        125⤵
        Drops file in System32 directory
        
        PID:2636
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        126⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        127⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        128⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        129⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        130⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        131⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        137⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        138⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        139⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        140⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        142⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        143⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        144⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        145⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        146⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        148⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        149⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        150⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        151⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        152⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        153⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        154⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        155⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        156⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        157⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        158⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        159⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        160⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        161⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        162⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        164⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        165⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        166⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        167⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        168⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        169⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        170⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        171⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        172⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        173⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        174⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        175⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        176⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        178⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        179⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        180⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        182⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        184⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        185⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        187⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        188⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        190⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        191⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        192⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        193⤵
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        194⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7252
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        196⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        197⤵
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        198⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        199⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        200⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        201⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        202⤵
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7596
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        204⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        205⤵
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        206⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        207⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        208⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        209⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        210⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        211⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        212⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        213⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        214⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        215⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        216⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        217⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        218⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        219⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        222⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        223⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        224⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        226⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        227⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        228⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        229⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        230⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        232⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        233⤵
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        234⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        236⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        237⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        238⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        239⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        241⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        242⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        243⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        245⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        246⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        247⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        248⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        251⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        252⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        253⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        254⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        255⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        256⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        259⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        260⤵
        Drops file in System32 directory
        
        PID:8284
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        262⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        263⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        264⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        265⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        266⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        267⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        268⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        269⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        270⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        271⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        272⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        273⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        274⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        275⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        276⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        277⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        278⤵
        Drops file in System32 directory
        
        PID:9080
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        279⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        280⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        281⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        282⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        283⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        284⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        285⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        286⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        287⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        288⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        289⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8848
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        291⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        292⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        293⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        294⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        295⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        296⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        297⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        298⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        299⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        300⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        301⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        302⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        303⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        304⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        305⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        306⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        308⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        309⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        310⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        311⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        312⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        313⤵
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        314⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8216
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        316⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        317⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        318⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        319⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        320⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        322⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        323⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        324⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        325⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        326⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        327⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        328⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        329⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        330⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        331⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        332⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        333⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        334⤵
        Drops file in System32 directory
        
        PID:9776
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        335⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        336⤵
        Modifies registry class
        
        PID:9864
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        337⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        338⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        339⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        340⤵
        Drops file in System32 directory
        
        PID:10032
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        341⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        342⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        343⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        344⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        345⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        346⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        347⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        348⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        349⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        350⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        351⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        352⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        353⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        354⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        355⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        356⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        357⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        358⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        359⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10224
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        361⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        362⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        363⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        364⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        365⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        366⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        367⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        368⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        369⤵
        Drops file in System32 directory
        
        PID:10108
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        371⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        372⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        373⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        374⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        375⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        376⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        377⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9904
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        379⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        380⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        381⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        382⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        383⤵
        Drops file in System32 directory
        
        PID:9448
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        384⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        385⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        386⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        387⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        388⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        389⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        390⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        391⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        392⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        393⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        394⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        396⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        397⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        398⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        399⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        400⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11024
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11068
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        403⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        404⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        405⤵
        Modifies registry class
        
        PID:11200
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        406⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        407⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        408⤵
        Modifies registry class
        
        PID:10312
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        409⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        410⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        411⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10588
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        413⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        414⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        415⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        416⤵
        Modifies registry class
        
        PID:10876
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        417⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        418⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11096
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        420⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        421⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        422⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        423⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10564
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        425⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        426⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10884
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        428⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        429⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        430⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        431⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        432⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        433⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        434⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1660
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        436⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11144
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        438⤵
        Drops file in System32 directory
        
        PID:11224
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4468
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        440⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10504
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        442⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        443⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        444⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        445⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        446⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        447⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        448⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        449⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        450⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        451⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        452⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        453⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        454⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        455⤵
        
        PID:908
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        456⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        457⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        458⤵
        Drops file in System32 directory
        
        PID:4652
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        459⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        460⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        461⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        462⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        463⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        464⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        465⤵
        
        PID:344
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        466⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        467⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        468⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        469⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        470⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        471⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        472⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        473⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        474⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        475⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        476⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        477⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        478⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        479⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        480⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        481⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        482⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        483⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        484⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        485⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        486⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        487⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        488⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        489⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        490⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        491⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        492⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        495⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        496⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        497⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        498⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        499⤵
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        501⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        502⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        503⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        504⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        505⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        507⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        508⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        509⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        510⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11408
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        512⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        513⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        514⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        515⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        516⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        517⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        518⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        519⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        520⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        521⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        522⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        523⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        524⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        525⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        526⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        527⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        528⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        529⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        530⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        531⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        532⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        533⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        534⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        535⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        537⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        538⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        539⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        540⤵
        Modifies registry class
        
        PID:11784
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        541⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        542⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        543⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        544⤵
        Modifies registry class
        
        PID:11968
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        545⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        546⤵
        Drops file in System32 directory
        
        PID:12100
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        547⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        548⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        549⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        550⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        551⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4456
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11440
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        555⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        556⤵
        Drops file in System32 directory
        
        PID:11580
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        557⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        558⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        559⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        560⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        561⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        562⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        563⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        564⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        565⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        566⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        567⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        568⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        569⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        571⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        572⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        573⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        574⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        575⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        576⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        577⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        578⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        579⤵
        Drops file in System32 directory
        
        PID:11488
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        580⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        581⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        582⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        583⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        584⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        585⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        586⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        587⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        588⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        589⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        590⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        591⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        592⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        594⤵
        Modifies registry class
        
        PID:11352
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        595⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        596⤵
        Drops file in System32 directory
        
        PID:11432
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        597⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        598⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        599⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        600⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        601⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        602⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        603⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        604⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        605⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        606⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        607⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        608⤵
        Modifies registry class
        
        PID:12080
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        609⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        610⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        611⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        612⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        613⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        614⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        615⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        616⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        617⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        618⤵
        Modifies registry class
        
        PID:11448
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        619⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        620⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        621⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        622⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        623⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        624⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        625⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        626⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        627⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        628⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        629⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        630⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        631⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        632⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        633⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        634⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        635⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        636⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        637⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        638⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        639⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        640⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        641⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        642⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        643⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        644⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        645⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6304
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        646⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        647⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        648⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        649⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        650⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        651⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        652⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        653⤵
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        654⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        655⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        656⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        657⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        658⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        659⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        660⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        661⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        662⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        663⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        664⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        665⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        666⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        667⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        668⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        669⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        670⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        671⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        672⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        673⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        674⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        675⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        676⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        677⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        678⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        679⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        680⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        681⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        682⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        683⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        684⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        685⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        686⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        687⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2468
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        688⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        689⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        690⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        691⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        692⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        693⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        694⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        695⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        696⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        697⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        698⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        699⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        700⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        701⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8148
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        702⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        703⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        704⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        705⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 404
        706⤵
        Program crash
        
        PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7316 -ip 7316
1⤵
PID:8124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5148 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
1⤵
PID:7940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:9632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acokhc32.exe

Filesize
81KB

MD5
7f5d5d82534b1e7e3ec8586839efdeda

SHA1
7f38a1494a7f9caf702c80402f8934f43049852e

SHA256
f6968ea7dde24815852c59bc4d17fee89514a18b5ed8b1611c81a29b7298c5b8

SHA512
2d29b348a496465fd59f0ebef2056f648b94c839a23254e2cc39cfa0355bf3ddcb880a8dec0a6f83f5a4daf6cbfbeb55260d02e4a830ba7ede831ce05e7a370f

Download Submit
C:\Windows\SysWOW64\Ahgjejhd.exe

Filesize
81KB

MD5
36fe60f025ddf85df8893c1ffc6a4a1f

SHA1
bbfe215ea032c46a6bf55364d00ab2cabd283ad9

SHA256
9bababd56dc17e4eb68b13e62672a57c9623d9082c9b16497d316ed143f0822c

SHA512
5864d378b41a7f1d112af69b01093f3fef31c8634d1e8862cd2f29b9ce6a6864b77e77a25431ea3e5fa7825c55ddaf455a13e1ea311b53325e09dc606740e3d7

Download Submit
C:\Windows\SysWOW64\Amhfkopc.exe

Filesize
81KB

MD5
e2b8dd04706dce46a4bc1902decb1d04

SHA1
01f27d4050aa1a1f78bd253871b34d3f802edaa8

SHA256
8eeb24dbbd5e03a0fc812a0742e86aa1792ce62282c4c06b20c64746edfd92c7

SHA512
ddaebf2b1cef56656f7671a985d65ff6de6f16d5c1885b345fb2e81caefe2b745947ddb8e421f392f47bcf0f1aeb51c525c2551527e9d8dfcc07ad0711fcbd32

Download Submit
C:\Windows\SysWOW64\Bbnkonbd.exe

Filesize
81KB

MD5
9c407fa20fad594ec8f2201214042fcb

SHA1
11a7cfe9b16eb715a290ca1a845aafcbdecee649

SHA256
b1a47715591a14c5d810e2c1a771c9f2a15e4b0f4b1e108dcf99d1754e3a02b8

SHA512
8cb2a82681b410c75a141fc2357f67dd36a1509b5708440c4a903405fb6f6734002998400e6c060da5dab1ae4ee4c2470f5505175b3d4c354215c79c646adb16

Download Submit
C:\Windows\SysWOW64\Bjlgdc32.exe

Filesize
81KB

MD5
8e5cd3b34082df1aab6779666b68c586

SHA1
46a99548a354acd8e2cc1c4066d5ac49f31dee6b

SHA256
b25ca60ee67392d34af7eec10fd0b2a1a329058e4bd251a1587b0143d8a3ab82

SHA512
8a29c9afdec2e9a40b79b960157f0c8381c5d2162fe4fc666ca27603ef64e6e44aa29d41404ac3413b81826aca0420c68874a85a0d648cc169b052b4d70883ee

Download Submit
C:\Windows\SysWOW64\Bohibc32.exe

Filesize
81KB

MD5
e7f66c4bb118dc62154f5fa9741d1e14

SHA1
a900e073cef82b58c807ebcdd7479749988e23c1

SHA256
869a46c71f36afc995e113bb949f560481c1c490367e33f0e95b8ec464c41c35

SHA512
2944a8a591b014565e7ff2dfe025559c512aa91633f6cf97481c9269dbef6eca591906ed5e90d19481a3d58958c5859fd7523c428eea54bdf49a5a919d05d062

Download Submit
C:\Windows\SysWOW64\Bqkill32.exe

Filesize
81KB

MD5
b42640472307364be74d731b608b649b

SHA1
60c1c46b4e5dd187695732ea8cd509817cf748fa

SHA256
ed46ee550443dc114e019b491813a5d6bbff88195e82e35ebc19e6d649e08d6f

SHA512
df91517da430c93863d745ce69f8266a2576bed1d01753ed09cb1e683ea24ed20e506b342e59d16ba764e85dfeea43964e7ab2bebdd946bfbed8d0b45740faf7

Download Submit
C:\Windows\SysWOW64\Cadlbk32.exe

Filesize
81KB

MD5
301d05b570cd834d8271e7cb744f3eff

SHA1
b4ef047f3d9d15ee503645104662e2d7d71c53b8

SHA256
dde57e393f82f0f4a666b5e0542af8cc926250f59b81146e46fd300b3108bd95

SHA512
e1ea3e6a89ee2c0ae12367debc3c2b75e85ff8c3eec3f34b93a0b278865099f6e9e9733398f80fc51ba9485f22054cf7cf6f06f2dfef708751c180c6a8b48848

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
81KB

MD5
889dc88461bea0b63d69fb2accb4df78

SHA1
3285c61e84d74912e615efb2cce7cf221fe43d21

SHA256
15b2ace20c81211a7aa09812c168e1f35ade260837cfe918d2b9a18d2b051508

SHA512
c54deafb5ed1be81fe4f00814fa1acaa036fe5d5d040c76497f54d9410891a744058b02561f89734bc96240db0cada329dc7f36a40e3de9089f86ad9bbb66e4f

Download Submit
C:\Windows\SysWOW64\Cikglnkj.exe

Filesize
81KB

MD5
88f963f47a818d0ea7849fd0c25aaf99

SHA1
e48abe75bda9b321551f4b812cd94d1b69a48289

SHA256
28d8a240f7ebf8410c41a2d353219fc29c5362975384ea74795781891ea86c0e

SHA512
7df0af5e8b0a05ac6734d4fab203db10a4d04e1c8df24c663f5ecd5c6938a4ebe6a6bbf73a822637d088bc863a46a9b540607dc5c13df53bdc2c7a223f3260ac

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
81KB

MD5
015e4c54ad298dbced5922a393e563a6

SHA1
4a3172521b03da249d10a61aefaecc6c94c84b12

SHA256
ac01ff79855921ab41173ae9c4a6c4742d8443c789baaa7fed380e95c4f039a7

SHA512
42c730e54cae28a472ef7aa330de23ae2305afad089aba6dc3f11a5293bfbf633a6ce2e6aa211fd3e4d2a4a83c92a4bb6db4752e343dd92de46bcce36dc0e906

Download Submit
C:\Windows\SysWOW64\Cndeii32.exe

Filesize
81KB

MD5
9aa7b3fc2268b6275f42bb969318c044

SHA1
1eae4bc49b696ed64d615a74dd5e74e321c030ee

SHA256
ace51dd199a83bcf444e9570d7d5886f5bf45e766fc44b50314e7adbc8b21364

SHA512
d3164815f551c2ed2db3d45662910178e2eea630d51a204fac81634085bf591e599496488e6f755d74a714941d892670be9feec5fd4d7e016de2ef24921870b0

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
81KB

MD5
c7736a40225c29d93d957c06f7f64e14

SHA1
a28b453e1baf07ec9810a4e2b36cb92281008a9e

SHA256
b9bad40c8be2f96bba10074e47accdd7efb81c88df20a06d1fd5baa8e0e0d452

SHA512
b1936b806888f475889391c803762d5af65c172ae76d362725aa306aff9ec9e85e411893444e053b4176cbbf50e6cfe17002777014df19ced4ae47a3826be332

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
81KB

MD5
317c28a2a10a1aa26d648926557b3129

SHA1
2ee69a75b94bcd51e384ccb731aabade111e17f0

SHA256
b00f291af415e192c49c45b579fb0568dfa3a5af69b830f0a86bc5bb4c4487cb

SHA512
3a69b45d7f766ad424172de46af4c1d9dc4f47e6e6d7922b059c243c617a3347392ae55e34cc303e30cfcebaa1bd45a9394e1bf10caa94b074feae0b1d4908d7

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
81KB

MD5
60a5c19ca3dbb77aba73db3d6cc2b11f

SHA1
ed647dbf21ef5b5d06041f28e7423f7218fe11b9

SHA256
aafc52434f448794f5e12e82c5eb914f83ed3eb3d636669d05bd5a6664693a92

SHA512
1c12c90948d3179a078f3b7ad7cda3835e9f409369acde67d3d9b52fe1ff713b16faf7fc53a83c5a8e3ae1577fada63e43fd8a3a5fb34b33a4656de3e23c8cb4

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
81KB

MD5
f9a77f0e520912027e3d7f2d20d17b15

SHA1
499c691ea22ffcb4879ec2cbe53436051fa1686f

SHA256
e5319ea81864bc5f2481df95a11ea01c7750789b6d26aa2666a86d0a72d72d74

SHA512
c5e12223186977194faa76b622d50677b57c8db519ba23dc4d681dc16edd442ffd6a360cc30a7f1f2b7df9786f11de603ff9d0a22681b5645e3757504964395f

Download Submit
C:\Windows\SysWOW64\Ebnfbcbc.exe

Filesize
81KB

MD5
18c6ad863f3cc03881878addd14582cd

SHA1
48bec9a915806525435c28ad676bebf22c7889df

SHA256
73b7e185f3de7ac9472212bc185ad9c0942040285d0d4097b2922e81d282196d

SHA512
403921bcfaf3f8c461958871e043d0995b7b3ac03673d0c3f8f8f7f6bf8fba50b37d92959076c40459dfc8a1d2862dc02114eff7f2f6a68a2a59811e13b1bf54

Download Submit
C:\Windows\SysWOW64\Epagkd32.exe

Filesize
81KB

MD5
595cb706979ea8ee0ea36c70572e4eff

SHA1
61eb2035b06b03ba4966cfb9917bc6ecae56ff65

SHA256
239195b1ebcc045c15b8f5b61cdc866c9ffddcb5a73a78d53a435ec43404f65a

SHA512
27d5f54b6c7cb982d6b813e1ae7a45cd4e04b8c2e6a9c1c949b4e9ed4a0eb26ec7180c59c3bb7d4b2c115376a5b9875f6be7ee2c7191cd652c2ba9d1f2bc97da

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
81KB

MD5
5ae0b62e9c22cb7ecefbfa685013d9be

SHA1
a52135349ac5299e23956623ede5fb2d7479aa2d

SHA256
96c4316480be19c72de65a56d745bc7236eaa0b81b3fbceb2b239aeb910e9fda

SHA512
9d266d6dd4a85dcdb733e22360fd8355d72f632423657e9e5cf66208fa89de24d1198bebb0a94487be4f88d64c9030e2f1f07de298c7b4585def7b0872491a59

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
81KB

MD5
12850c100c78fd83d1d900580ea62eed

SHA1
7140aef6e308c08c43bc6542d651bee362479596

SHA256
890e48a0d0182f13c231bc2fbbe7d1fe66f5bce45205d37164a3beb065744493

SHA512
282d211779dad9633b4bf47bef913c03a3f6a6a7709e0b25eb654f77e4f35ef83c012f288769bd20a53a5361803a94030f9049b9fbbbbd1904f12e9256c326ea

Download Submit
C:\Windows\SysWOW64\Ifmqfm32.exe

Filesize
81KB

MD5
eb260f5bd0ecd48ee220710af189a340

SHA1
82937fb5651fc61ca49c7346f757fbb50807886e

SHA256
d6cfc7d11fb15e85cd1742f32c8d56ad361a9ab40e794f54f2ae16748ad266e7

SHA512
2b50fe42abc2489ad9baf8f7d63067a7f3e28aaa7717b65dc8f28eb76577627a068043506bb3809d354068ae136c1f458afdf3cdbef45dead0bcfaa1cef4530e

Download Submit
C:\Windows\SysWOW64\Kbbokdlk.exe

Filesize
81KB

MD5
a223b8868a219f9d6a845d9136313daa

SHA1
01f9b40b434c5c76884a9b252ac9b4bfe2a1afda

SHA256
c0d38785d9019dc5c10e2691778c8642ff3297f20a1d120a6915aa2015deee98

SHA512
afe859cd1324a3147000ae052162433efc6072fb4c2bc79ae69a47d2125db85332a2ed3eb8f334fa65ee8ced817872dd57a2bffeb124064e123e402744540da5

Download Submit
C:\Windows\SysWOW64\Kefdbo32.exe

Filesize
81KB

MD5
aa77c83069f70d2c0b5f361ae4796dd2

SHA1
c41241f8610e8d0f3c7c6a354abe86a796f859da

SHA256
ec1ef51e1955786447efe91dc682a96743c610763ba05a110d819f160db02e45

SHA512
ca641752879a37facf473b7d903941a6bd5129ad5ede137bfaeee6ac3ba9ce73034ad06e03b457f4121818d5976c41c9b39094f6bd790e838938173fc1043c37

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
81KB

MD5
9cb40c36f048bebc0d2a2cb729875417

SHA1
50cd2b0341f05b37270185bd0efb946a02959ce5

SHA256
553fda54cab1a015c6f2c3fcdb5cd58cb5e87599e03b7487ec7ead77e15073d2

SHA512
80a211fb6f2348a88418c50c8f73c7cb0eb8f6a5193770424ad4c96b4e42626dd12a700fdf1b3a6588ac73e781402abd48c7ce595eed59ad3462a65d36c4fddc

Download Submit
C:\Windows\SysWOW64\Kfqgab32.exe

Filesize
81KB

MD5
f76aebdbe47ea258e3b414b3e5ae5c96

SHA1
4143a6f7bc3f9aac626381873389e59b20ebdf0e

SHA256
e71766816946e1a2ba576929fd8c43b7fca00c35d97772b7d7cca3e8fece0f33

SHA512
0f2b87122122ca9ed884d21078ad2220eee221a5606dbd36a012b284fc617b31262b7eab0c5a4b8d4051de4d22a9b906e03c63cb70bbdfa1e0c6770fe9307b19

Download Submit
C:\Windows\SysWOW64\Kfqgab32.exe

Filesize
18KB

MD5
87d0801236b399468dee1edaa79a26d4

SHA1
ca13db4b4590bc5ba4442984c859bc2bffb7a5bd

SHA256
bedab741ce139c2060e32641dced73b28c43e06cd45384243570f77fe1052c78

SHA512
60715e05fa2bbfd5bc60dc44b6eaeb655541dbb66ddb8e16fb97c5130b31e4e6c296b8de5191ad1b69dd02ab89ed4adf2a10b36bfa36895b2f6e19eace19979f

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
81KB

MD5
ddd2b518e7e36bbcc2d859766e40ab69

SHA1
30d59b8373e5cc3b5120f4e8889253f4f1b37f17

SHA256
860357e497f90eb2e53cb6d3760a7c81d0151f8d18bbb0b7234904f88a0045f0

SHA512
7e7d65e3cb0585842d651c11c335b3ac543c0df96f5c0153d453ed1de0939ebfd98228673c5f2ed8a76e8d1283e0c474ea848cfef7487902059d7f5a1a9df50b

Download Submit
C:\Windows\SysWOW64\Klfjijgq.exe

Filesize
81KB

MD5
7a7efd9f8fb7ddc0d08a6f01f4b7f81a

SHA1
f46b63adc89554a2ba24c7bd77b8e2dc6981896c

SHA256
7b0d975375d1a7dcbb29a65768f45c9fc4a092636c72ebcc560d9f7b5a592516

SHA512
a5eac01a659b7be90e4369b9c69d55c03dea81b5165b2593d8c9dc18a29336307d76d6216047fc668b8d4c44ed6fa0da943a881847a8cec9c01dc3797962ea02

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
81KB

MD5
181bcf06cde2798447ed2f67af3a059a

SHA1
ef1e97f064295a17172d7f8b0886ec4c86e39ef0

SHA256
534f74cdc3cdb16c6a0efa50db9c88185d705e4f76f3dcb70c9c3994863b55d1

SHA512
fbcf34a00969d00217aa4914b2a761d4ed506c35d533f3ddbd3d5c70a79e8452d555d82ffdc1599b27d0d8255a0de6d42b2be7dd42bcce7fd474db5809d1f2e3

Download Submit
C:\Windows\SysWOW64\Klkcdj32.exe

Filesize
81KB

MD5
85fe5b1c6cc958a000da350e89cf4fe4

SHA1
437a84830e0541d5f7b74df089c5f30093d3ac75

SHA256
f19fd7281a3be59bffe9a5b5e053c1d40a77f7d801c48aa26ce86ca25460b919

SHA512
541d4158ef8c9bf3463c4333691afb9177ebd1348b40c00f6f192af0fb493c061f6594ddf2a77ff6c2a05b95e3f5909d7eacc9dcc58f3b04639b3167233e160c

Download Submit
C:\Windows\SysWOW64\Klmpiiai.exe

Filesize
81KB

MD5
e29bfd9bf0640434993e456b00b72fd5

SHA1
6c3830aebd7b6836b7badfbcd321b0371ef006f5

SHA256
a671ba46580e86efff071e9acdb4874ff90683974b0d503328916224d5eb58b3

SHA512
1c45f8e8acca88fd45ee0fb459d51b6279ebdaab55285010599714c80e0c0df53fe811d1127dac9fb886bbc83df32151d5d14e0dcb984222195ce0e3b3c89e47

Download Submit
C:\Windows\SysWOW64\Knbiofhg.exe

Filesize
81KB

MD5
8cc2924dec1dd99cda83c21218254523

SHA1
e7b04f54a338f896c41ac9373095f728ed6f043b

SHA256
cf4666cc957a95f5bcb04f3f0758a893608bf87e112440ae45fb34731f42170a

SHA512
810a68bdc7d3fc6181ccd3b6173c49f3e9663ebc46d246bb735ccdd93f354e9243c6b8258f0c3d7b3433e12dfcac2b54cf44e9f7aec359c60b115ac1bb2c2cf6

Download Submit
C:\Windows\SysWOW64\Lbchba32.exe

Filesize
81KB

MD5
ea466b24bde21ee234dafa081a92f9b8

SHA1
25322e0fe0512297ce6524098204d82212f7eeb8

SHA256
74117461e11f3d2a603161ef983298033874bafc19b63933175d31aa4a1f5c77

SHA512
1b86bb1b36fe1cb15a5dc66eb9d8210622032e5028394999ee4d2d04fd4558d498d3784f1ca24dc8e22dcfd4596c1da57fffdc2913d8a779b91b7ca62861fb98

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
81KB

MD5
77898ea804a7170985238abf356a322a

SHA1
eae7b7860149927cedac2fbb68ccccc0162d3581

SHA256
36b726f5feb0927fa56224f94af2a728e34bd6a085cd391ad0ff71cbe48bb2ba

SHA512
53fda2d27f3f021ebfc64762b38eb528d19085c5574347be0d01675576d6e999cf299da66baf8e04d705efd8782ebf6defbb9ec3fcab6caa861e04ed2944ec83

Download Submit
C:\Windows\SysWOW64\Lhkgoiqe.exe

Filesize
81KB

MD5
158ca0abf3c22c651228381e3f531b80

SHA1
98435e0f458751feaaa58e3b66942d028f9687f2

SHA256
35d33c6262e88bdcf2974c5131b2970b8af767aa56f7957859b4122b1d65af01

SHA512
a3545a98228bc2f13c9a7359431426b432669bf245cc002cbad8fdda893e0ce1cfd1eca592f56bb08d3c428ab508384fe3ad6ae272db66d3f9a8c3f8a212f69a

Download Submit
C:\Windows\SysWOW64\Lhncdi32.exe

Filesize
81KB

MD5
30a1188b4582113d96f2b9857e48ef9c

SHA1
fe0281f17e78f51d4ab47e1bd39a6f6f966ebed4

SHA256
4b7aa24cd89656e6271f778aa0a6f6e66af6b65fec5819691f6c33050f322b4f

SHA512
764c855a67f6a2d45fec38387b2aa3005a456b51aee014dc9c92b0afd6ae98bfa99bb44e2957faa801d025be43199f11ba344722b2edef187a3edce63cda25cb

Download Submit
C:\Windows\SysWOW64\Llbidimc.exe

Filesize
81KB

MD5
d8165c2c23991e9715630ba013677057

SHA1
b63ad444037c4b9cef3f818cbff7820b31ec7ce8

SHA256
997200999fb7ca270fd1541877a4ab104143ceaa4dc46ddc8a3ce4e82d0d7295

SHA512
2ed0c99cbe97b9d60e216554d38c0ade69fd6c0d74817e0671ffb5fa9eb888f89170908801a3cb2435e73fabf10f57cf21ad3380b2c5a1a2e09019e0bb2e7364

Download Submit
C:\Windows\SysWOW64\Llpmoiof.exe

Filesize
81KB

MD5
edf6af8c61d0ae1d5b10767d22a939c6

SHA1
3ddbf7248f54de4fe23139ccc4a20850b2e94901

SHA256
7d81b6a5441b6fb3959b719b8b7e31d15ca0f51ff31adb48e91168237e39278d

SHA512
58b7ec0a8fa5359d8b1a213cabc157b9bc2597055d5a2d4474e727b340d65082a9a9acdbf453e019dd586f1ce8c24da31913147861d3c66d32f752d41b70f182

Download Submit
C:\Windows\SysWOW64\Locbfd32.exe

Filesize
81KB

MD5
cd4d99a69eb36efd4531c566d24d948e

SHA1
0174d27aaf6d939c02e84c58d11e3f5a70634392

SHA256
da3c9d7e418c90c9ac4710e2eb847d0c02378dda2661e70330283148d768810d

SHA512
77ac4b2da45dbbd01b161022cfbe37bec164ea34d0a7abd0407a69fd978d0fc7cf01deeeb9750219b5064be05608985cbd033a80faff8442265f5ba4dfc39610

Download Submit
C:\Windows\SysWOW64\Loeolc32.exe

Filesize
81KB

MD5
f8f1afe19e0c2f5807ef66bd0171a7a9

SHA1
2b7e1a33655c0d001f9711c7c9a70dfe37fe818d

SHA256
e56d65a04cb580433e640e711684d0fad2cfd6b788a7d5298f8eaff6ed425663

SHA512
1ea20a8f7cf62189231ef2a037700b62e2df6e9888703a70825a3f7b66e2c8f0fedc224ce2cfda5049c95a89c1d3e0d333850faa7a9992db9c0b4cac1abd53fb

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
81KB

MD5
2e2234812a9090a7b74bb9a5444bbfa6

SHA1
5a5b5a86fe0dc30e25cd7a3de60ee79f1aa14591

SHA256
ee1a93260d8eaeca2f96e853c8ab0826f48afaf4f2c3ff87e97f7da5857bf63d

SHA512
cf4d33793109112ff936b4bc4804370753002c02780a522f1d8885b2ad1940960e3fa8171bda8925ba860bc967ead3b61db6e227e91b1d25b315563e9daa46ba

Download Submit
C:\Windows\SysWOW64\Mfaqhp32.exe

Filesize
81KB

MD5
a01868b2db7f99ec3a86174452c1e987

SHA1
3a41e207c99a0146d1803f25b337c33eb9c961de

SHA256
553a1d7d73402c6f1a7d384a9cb79c05c4b983a5df449a7c400bd8ec513fcecf

SHA512
0370d73362305ae597d2c4f2bb6cfd9726aa57e6e95b667dadd19bc3a511171a6bef99daafa2809304f773ef6cce79f4a2583589016b82c9ba078b6d5b9f2d6c

Download Submit
C:\Windows\SysWOW64\Mfhfhong.exe

Filesize
81KB

MD5
5ba8f18a0dd3c23908785bcb122d9b47

SHA1
e2d0332edc28863fdd4e4aa57884eb00395a38e8

SHA256
cfd062392c3b9cf14c331b42c3ed026b1485b21fddf03a1d540684fe504f1c2e

SHA512
0e89af61c54c3b8d465514a3d8a5b2d5c1f6506cc14f2abd31d49b35d9e994dfb300de3585b70a4497595559fe83d203587860bae386cf268f167cdbcc282ef8

Download Submit
C:\Windows\SysWOW64\Mleoafmn.exe

Filesize
81KB

MD5
f79dd75ace085b78ac38f8339140b73c

SHA1
d2c67cd1ad636cecfa5a94f39b18e9363d68cd94

SHA256
56310521706b05aac256246551f13ff46ee2a103d99975aa59122f412da637e9

SHA512
cd41483e6a07e708b1ddaffb1e78fd41727e94de41ea4e371e7f908db21b69e77db980a0e703724389ade70d258685464da0d081644fb3e1aa899e1d30afa825

Download Submit
C:\Windows\SysWOW64\Mpghkf32.exe

Filesize
81KB

MD5
c96c5d1af85ec0c0cee094076693a2ff

SHA1
2003d433db99efa8b82a8ac169bddb19b4293905

SHA256
fff754828cba1e3093cfec2e25b00753b5824bd8801acdd849724add17955422

SHA512
e8da2583de9368dab556934e438afeee294c6f2d9fd0c5ecc7d1bf283faccc77c30bcf8a98dbda2c906793ae8a135111a1367682c8646c5c20dafa60455889de

Download Submit
C:\Windows\SysWOW64\Mpieqeko.exe

Filesize
81KB

MD5
98d0cb7b8c553ddbc6ef73528c2619dd

SHA1
78cf258338a5946b670c5b208f18c3fa908d03fb

SHA256
8056cb6959d036e2f34cec0212319378f545f153183d61547aba95bc82a8044b

SHA512
c48a5a3c723d204df06bc01062eef9da8ef02b01df5ff7b0a86827b26314b2e44da131f83914f1c51ead87df57abda837b087ca70636e42a93bf66250bde71a3

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
81KB

MD5
3077be335553470fbb98286e582495d8

SHA1
fbb7073ed4a4f49123de9284e8b84a45eb8593c9

SHA256
255ebca8409ca885509d6d3482793ee5efa45542812b25c6226bf312c4dbb501

SHA512
bfc1ec9ed32fa9e6b8649837e65e5713805c4c8e52c065413f85bda06fc9fb07eae50829fa88d80d4c6e567375931ffe5d4c48bdcddc97bcbc11998712488773

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
81KB

MD5
42d76ada414a48994c7c338622cfb195

SHA1
aa8547879e436d784c5a12620af8c2ade4acf522

SHA256
e238cc88b7c862630e1497da438496d0d7a39c0a30c3cb27e8c008188a216ed5

SHA512
8726e89ace3f0d763653024f0753e4a60b36c135bfe5155bc086da2c0d16dcdd69ba3918f46821109d0e581ceb45b16a41b8a203ced25a55fd3824ed7fdb7aff

Download Submit
C:\Windows\SysWOW64\Ngmpcn32.exe

Filesize
81KB

MD5
a331c64e2a8b8bc3f21ad9a9142c8821

SHA1
4c51607699de72fe008afa9c3ee9d633385be460

SHA256
8ccbcebab767802c6fe4f0981da89643c0598b8ac001280eab395553d08d8363

SHA512
68a92581857ea4286019d9c6873ac6fd76fe98f3952fb4f75800dd9ec6b9c89d8287d10aac4a6271954b0f21aaad8b0ef958865012b4c60aa243aeee14b6f771

Download Submit
C:\Windows\SysWOW64\Nhnlkfpp.exe

Filesize
81KB

MD5
51440df5d1d573c6498f0853cb723ccf

SHA1
ae43bb48616bf4ba2c52bf0a742d7612722db5f8

SHA256
c838e2f11492bd03c0463a8cf41932ceae841a35763e86159a35d061d4d00adf

SHA512
ae3badfea4171e64dec20e77956b1223e0f429adfbdcdfda4a1e2bb6ff399cbc9176b12738438feaae39e03b833ab5e60ace621991d960566dcbf300eae143d6

Download Submit
C:\Windows\SysWOW64\Nhpiafnm.exe

Filesize
81KB

MD5
f306898c243493cfce91b615dcb13909

SHA1
cae358de1fd2bf66ec6c61e66b21cc449c9ea218

SHA256
38071d4a123f2b30825b68b69d77eb69138a4c603c86e19852ceb75daba27071

SHA512
48ea23d4f62544774c943cb0eb3c177f3a8714b5e4ab67c39efee0c30a8473b117a2275eee5b6d707f0c0d92fb7fd717870b74f2cdeec7bb8d118d9b21907210

Download Submit
C:\Windows\SysWOW64\Niipjj32.exe

Filesize
81KB

MD5
ca968980eeb76784b22d521d5c542825

SHA1
9802b7e01e3db6d1c18942ee521379209089f582

SHA256
aa01ef831048723128c2429b9540b8b02fdb2ee23ea93564b07e6983929f09a4

SHA512
1ca312fac0c6e47833ab0dcbe46e4359e67fdc21d5e628652d83caf523b3d4ae7c25692eee2473b3cba94abf8ef7fcfa5dfe383d86589af246f5d05436c701ad

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
81KB

MD5
ab6e16b4ffed3dffd55c058d8a1d51db

SHA1
2d4d76559de0e6f037e4daa1600c73a02fecfee7

SHA256
a9a2260febfbce5bf2cd72bb93236496fa8da33534268d8c01a213565c6fbcfd

SHA512
b9baf89996550e18619e343a432ee90c2a6d6b4e6c7750b9b72c4dc0598792436c66655233848480c29c2c5b28059173d68c9a729005624e5a4ca535184fc56f

Download Submit
C:\Windows\SysWOW64\Nplkmckj.exe

Filesize
81KB

MD5
8ebb7c4eed6c363d593635208513604b

SHA1
ec75a382dd31141e82079976d11074a06caa79bd

SHA256
b90e3a08fedfa6fb7f0667d10d99ccdeb20d040eb7d056bf430d4e30091613e8

SHA512
ab858ae380332e5d4f5fa9db54508a764f149889305cf60b9fb7afe1f75775ed7a3e5177046da5a726201b44a3537eb70f023f7206bd17247dc14ea0493abc75

Download Submit
C:\Windows\SysWOW64\Oacoqnci.exe

Filesize
81KB

MD5
f1ac44f8e104a5ac994e9b96e45bd807

SHA1
2b2ed0b62212179b709d7ca9655e10f63edb8c2b

SHA256
561198f70072cbaf14bf426798f2fe4bf3080f55e38564ab04bbe7bd168c758f

SHA512
79fdc7ca1a5d74e7c0f213dd48955bef89befc82025355840d185488cf59a72969807904416df671a96771711d39e0fdaf719cc1c2cec9a38a27950a5b426b0a

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
81KB

MD5
0536f926943ba555833b3c475b28fed8

SHA1
ac32c1aa9cef922b73249287ca037f5fd842fcab

SHA256
0137b1c8c7f3b6356b73d437795f27c9e82eeb8921ffb1175a08a8ce7fc8abfc

SHA512
33cd65408d2adf2790575544a239b16d146a2e57b4cfeceed33c650d01d03cbe8750b19b2acddfb64875617edadaa4e59325d48e7fb1349948d5548ce7dc558d

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
64KB

MD5
b796152a72a2ec4789a2ae06445347e0

SHA1
ca467425fe85cf9b067427b393388f46c8786f7b

SHA256
858db178cc51d6dd78ce3c28c489e0899847a99a9177b7d2b1a3513b9af01a73

SHA512
a2b4facb1beaf44cf970f24825af4f4936c4be6154b340f91abc1d5a6c5f00d3087ad775ac143fb522d66c2b9700bb9e862a1096e9c5d361d6e828320f5a2c9f

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
81KB

MD5
0fb4073eb779df8d528808e32baf2699

SHA1
ec86c37c61994b74cfb628e58aed8edf6dd1ffd3

SHA256
2a768d214875e5f46d25b1b64164fed24b900941c49f9fab9398673ea22d92f4

SHA512
13aee8e9f49297280c9c12358b5d101d94731eefe0b1aff594798e59a4a11fb724680401dc662ab9022c87d31857531a9a07ebb14161a2f7acd56ed19207e400

Download Submit
C:\Windows\SysWOW64\Oiknlagg.exe

Filesize
81KB

MD5
511475aa9ff5be30f26db3bb46545db0

SHA1
3d53c1ff82df4825628186144a87d9acb3eca72c

SHA256
8d0a5881780410e2755edca9e84efd80669ca8775ddb5cf2b597fe8aa4a92a69

SHA512
526c1b1e9276f1e6ec6390a9fd0b93658aa8a4135db37782d54a5021725b38482f875481c8eac5869704e1ae8b10419f0175e1bb1271ad17c9688782f42c6517

Download Submit
C:\Windows\SysWOW64\Pahpfc32.exe

Filesize
81KB

MD5
e46702591d9ab5d0fd44a0f2cb2af9bd

SHA1
a8cf26996a852101a7feddeee8e6fd12251a5999

SHA256
c1aed2940d24d77b817286571e0180f9df3f44a41c5079f35a478d24fd917a42

SHA512
b8afc053ed881258712837b821931511865ca61f0f5f744f4d633eb2b4d3452fb06b1d70a3c1ca5901a840c83ae0bb8728976bd5c6c1c4bf9c5a4765e7daaf7e

Download Submit
C:\Windows\SysWOW64\Pefabkej.exe

Filesize
81KB

MD5
19c77e92a103711c99ca30673bce5af4

SHA1
e186e3eb13181669178240d3e2a6422536e9d80b

SHA256
9380fb15b6dec9f0c653a02ad2d6db0d366e51b8e884317dd6cf9819c00418de

SHA512
afe2218362cc61ff7aab82f7e5fddd8f327ba8547164cf08da4cb00334af2cf2ee540b377ee38096e683b437973c88539eae2317c883eed0c2aa96c87c3dc811

Download Submit
C:\Windows\SysWOW64\Plejdkmm.exe

Filesize
81KB

MD5
41856199e853ae425d79e8ffbf0abb70

SHA1
66c2a1238bcfd1f46835a952a6b4e4d014d10ab2

SHA256
8dc0400d3f59e183de15f824998f131dcbc34ffff0618d3e84bc742750c9592c

SHA512
0f3e7d2afded828dbcfa80ce22587a1a11aa73b8b3a22284ad462179a30f4190451a2806d2fcef18fe4fe73bf9df7dab9d32cea742e489123f4f0c87cf60dafd

Download Submit
C:\Windows\SysWOW64\Popbpqjh.exe

Filesize
64KB

MD5
0a6515dea1750c10ec519a9f372c98fc

SHA1
ae7600b3ec686a72132cbc0ba0b0981046e28347

SHA256
1c9d171e4e2290e64cb2b049f2c94d03fc4628d38d53795d58b7a28e3e539e39

SHA512
996ca1f919da455a586fc16650346cfaeacda5621fe2836b011e950eba6e9a7043af76bf1ae5e68bda5aff179299e04459eb54ffdd5c06fe3cd85a3147280ca2

Download Submit
memory/448-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/816-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/892-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/908-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1340-257-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-360-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1616-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1620-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1636-37-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1732-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1856-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1864-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1868-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1980-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2076-194-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2292-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2592-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2800-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2804-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2928-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3004-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3060-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3200-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3424-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3580-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3936-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4008-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4176-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4456-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4468-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4612-225-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4728-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4820-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5032-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-52-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5132-426-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5172-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads