2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429

Analysis

max time kernel
103s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe
Size

1.2MB
MD5

e4fb33a654c6dad1321d210b27aa73ea
SHA1

53ac799ecdef5e057ff8ba2d04095a17ee49a320
SHA256

2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429
SHA512

8fb43886abcd1475a28329a32b30a23036dcb7f450c0a83937acb9f0dfa0b9bdcc5817b942b2df829de178dd5c5acd12bcb16931a0bf345f4b0e136068866e65
SSDEEP

6144:27AtRMJCAkOCOu0EajNVBZr6y2WX47R5ZHr9zM8d9CXdPipmMH/gysNkvC8vA+XZ:9HFHCXwpnsKvNA+XTvZHWuEo3oWbvrec

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kijchhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbalopbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmimai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oekiqccc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legjmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lifjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dabhdinj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malpia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mbdiknlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfmcfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eifhdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmmolepp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpmlnjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Emeoooml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gadqlkep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nibbqicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glcaambb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoiqneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hecjke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpkknmgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nibbqicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpeafcfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekefmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjapcii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kfjapcii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdncmghi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oebflhaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmfnpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lclpdncg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijkdmhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ghkeio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idghpmnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doojec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jklinohd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Modgdicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npedmdab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlpeff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aimkjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ejfeng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcifkf32.exe

Executes dropped EXE 64 IoCs

pid	Process
1492	Mmlpoqpg.exe
3604	Meiaib32.exe
2396	Mdjagjco.exe
4632	Miifeq32.exe
3768	Ndaggimg.exe
464	Ndhmhh32.exe
1756	Odkjng32.exe
4328	Ojgbfocc.exe
4800	Ofnckp32.exe
2196	Ofqpqo32.exe
2384	Olkhmi32.exe
1496	Ocdqjceo.exe
1152	Onjegled.exe
4836	Ocgmpccl.exe
1396	Ojaelm32.exe
1932	Pdfjifjo.exe
4028	Pjcbbmif.exe
3276	Pqmjog32.exe
3480	Pjeoglgc.exe
3284	Pgioqq32.exe
2676	Pmfhig32.exe
3828	Pgllfp32.exe
3468	Pqdqof32.exe
1560	Qnhahj32.exe
3452	Qfcfml32.exe
3084	Qmmnjfnl.exe
2572	Qgcbgo32.exe
4336	Anmjcieo.exe
3636	Ageolo32.exe
5044	Ambgef32.exe
2796	Afjlnk32.exe
1868	Aeklkchg.exe
4376	Andqdh32.exe
3116	Ajkaii32.exe
316	Agoabn32.exe
1684	Bmkjkd32.exe
4640	Bganhm32.exe
1248	Bmngqdpj.exe
4120	Bchomn32.exe
768	Bjagjhnc.exe
1464	Balpgb32.exe
3168	Bgehcmmm.exe
5008	Bmbplc32.exe
5052	Bnbmefbg.exe
532	Chjaol32.exe
3336	Cabfga32.exe
2308	Chmndlge.exe
5020	Cnffqf32.exe
1256	Caebma32.exe
4428	Cjmgfgdf.exe
832	Ceckcp32.exe
3632	Cjpckf32.exe
1924	Cajlhqjp.exe
4352	Cffdpghg.exe
4572	Cegdnopg.exe
1388	Djdmffnn.exe
4320	Danecp32.exe
4124	Dfknkg32.exe
2712	Dmefhako.exe
4140	Delnin32.exe
4532	Dodbbdbb.exe
5140	Deokon32.exe
5176	Dkkcge32.exe
5212	Deagdn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Iebngial.exe	Ipeeobbe.exe
File created	C:\Windows\SysWOW64\Cceddf32.exe	Cjmpkqqj.exe
File opened for modification	C:\Windows\SysWOW64\Ihphkl32.exe	Ijogmdqm.exe
File created	C:\Windows\SysWOW64\Klfaapbl.exe	Kflide32.exe
File created	C:\Windows\SysWOW64\Dckajh32.dll	Mjjkaabc.exe
File created	C:\Windows\SysWOW64\Gpaihooo.exe	Gihpkd32.exe
File opened for modification	C:\Windows\SysWOW64\Khbdikip.exe	Kbekqdjh.exe
File created	C:\Windows\SysWOW64\Niipjj32.exe	Mbognp32.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hpcodihc.exe
File opened for modification	C:\Windows\SysWOW64\Jgkdbacp.exe	Jlfpdh32.exe
File opened for modification	C:\Windows\SysWOW64\Mfeeabda.exe	Mokmdh32.exe
File created	C:\Windows\SysWOW64\Kajefoog.dll	Pmhbqbae.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Hlbpmd32.dll	Jqglkmlj.exe
File opened for modification	C:\Windows\SysWOW64\Ljbfpo32.exe	Knkekn32.exe
File opened for modification	C:\Windows\SysWOW64\Gmojkj32.exe	Gfeaopqo.exe
File opened for modification	C:\Windows\SysWOW64\Jepjhg32.exe	Jofalmmp.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Jbiejoaj.exe	Jkomneim.exe
File created	C:\Windows\SysWOW64\Gigaka32.exe	Gdjibj32.exe
File created	C:\Windows\SysWOW64\Chmbeqne.dll	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Bafehe32.dll	Malpia32.exe
File opened for modification	C:\Windows\SysWOW64\Hiipmhmk.exe	Hfjdqmng.exe
File created	C:\Windows\SysWOW64\Eelche32.dll	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Ckfphc32.exe	Cfigpm32.exe
File created	C:\Windows\SysWOW64\Geibhp32.dll	Dcnqpo32.exe
File opened for modification	C:\Windows\SysWOW64\Bkjiao32.exe	Anclbkbp.exe
File created	C:\Windows\SysWOW64\Eklikcef.dll	Gbalopbn.exe
File created	C:\Windows\SysWOW64\Kppici32.exe	Jieagojp.exe
File created	C:\Windows\SysWOW64\Pibdmp32.exe	Polppg32.exe
File created	C:\Windows\SysWOW64\Pgfcalbj.dll	Pdkoch32.exe
File created	C:\Windows\SysWOW64\Imnocf32.exe	Igdgglfl.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Ehiffh32.exe	Eaonjngh.exe
File created	C:\Windows\SysWOW64\Leopnglc.exe	Lbngllob.exe
File created	C:\Windows\SysWOW64\Dmdhcddh.exe	Dbndfl32.exe
File created	C:\Windows\SysWOW64\Jgjhee32.dll	Nclikl32.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Faoiogei.dll	Mjidgkog.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Lhfmdj32.exe	Lehaho32.exe
File created	C:\Windows\SysWOW64\Oeedjegm.dll	Mjokgg32.exe
File created	C:\Windows\SysWOW64\Khoana32.dll	Nhokljge.exe
File created	C:\Windows\SysWOW64\Pnpkdp32.dll	Omgmeigd.exe
File opened for modification	C:\Windows\SysWOW64\Kijjbofj.exe	Kflnfcgg.exe
File created	C:\Windows\SysWOW64\Egacbb32.dll	Ipmbjgpi.exe
File created	C:\Windows\SysWOW64\Gdmmbq32.exe	Gmcdffmq.exe
File opened for modification	C:\Windows\SysWOW64\Mfchlbfd.exe	Mgnlkfal.exe
File opened for modification	C:\Windows\SysWOW64\Kiphjo32.exe	Jbepme32.exe
File opened for modification	C:\Windows\SysWOW64\Qqffjo32.exe	Qfpbmfdf.exe
File created	C:\Windows\SysWOW64\Bpkmil32.dll	Cgjjdf32.exe
File created	C:\Windows\SysWOW64\Npdopj32.dll	Imnocf32.exe
File opened for modification	C:\Windows\SysWOW64\Kfnfjehl.exe	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Lpochfji.exe	Lancko32.exe
File created	C:\Windows\SysWOW64\Idghpmnp.exe	Inmpcc32.exe
File created	C:\Windows\SysWOW64\Egljbmnm.dll	Dooaoj32.exe
File opened for modification	C:\Windows\SysWOW64\Flngfn32.exe	Fpggamqc.exe
File created	C:\Windows\SysWOW64\Fkdjqkoj.dll	Gbkkik32.exe
File created	C:\Windows\SysWOW64\Iimcma32.exe	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Opemca32.exe	Oileggkb.exe
File created	C:\Windows\SysWOW64\Fdmfqg32.dll	Nbgcih32.exe
File created	C:\Windows\SysWOW64\Fdllgpbm.dll	Ljhnlb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	7544	WerFault.exe	842

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ejflhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fkllnbjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkhdqoac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpfjma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jppadk32.dll"	Oondnini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eibfck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kefdbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcbknkol.dll"	Lbnngbbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lokdnjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnnnfkal.dll"	Gicgpelg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mhafeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhnhajba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jgbjbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Egaejeej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eipinkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ikejgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkkple32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jhifomdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcglo32.dll"	Jaajhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djhimica.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emihhjna.dll"	Najmjokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppgif32.dll"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjbdk32.dll"	Dqpfmlce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fnmepn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlpeff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibodeh32.dll"	Ckpbnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jklinohd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fjadje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Glgjlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mioaanec.dll"	Apaadpng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aimkjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dcnqpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fgbmccpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fonahn32.dll"	Fgeihcme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbkdbe32.dll"	Jbiejoaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjeqge32.dll"	Mnpabe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjegoh32.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fhofmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgddkelm.dll"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kefdbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Embccf32.dll"	Epagkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehcfaboo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 1492	3844	2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe	87
PID 3844 wrote to memory of 1492	3844	2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe	87
PID 3844 wrote to memory of 1492	3844	2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe	87
PID 1492 wrote to memory of 3604	1492	Mmlpoqpg.exe	88
PID 1492 wrote to memory of 3604	1492	Mmlpoqpg.exe	88
PID 1492 wrote to memory of 3604	1492	Mmlpoqpg.exe	88
PID 3604 wrote to memory of 2396	3604	Meiaib32.exe	89
PID 3604 wrote to memory of 2396	3604	Meiaib32.exe	89
PID 3604 wrote to memory of 2396	3604	Meiaib32.exe	89
PID 2396 wrote to memory of 4632	2396	Mdjagjco.exe	90
PID 2396 wrote to memory of 4632	2396	Mdjagjco.exe	90
PID 2396 wrote to memory of 4632	2396	Mdjagjco.exe	90
PID 4632 wrote to memory of 3768	4632	Miifeq32.exe	92
PID 4632 wrote to memory of 3768	4632	Miifeq32.exe	92
PID 4632 wrote to memory of 3768	4632	Miifeq32.exe	92
PID 3768 wrote to memory of 464	3768	Ndaggimg.exe	93
PID 3768 wrote to memory of 464	3768	Ndaggimg.exe	93
PID 3768 wrote to memory of 464	3768	Ndaggimg.exe	93
PID 464 wrote to memory of 1756	464	Ndhmhh32.exe	95
PID 464 wrote to memory of 1756	464	Ndhmhh32.exe	95
PID 464 wrote to memory of 1756	464	Ndhmhh32.exe	95
PID 1756 wrote to memory of 4328	1756	Odkjng32.exe	96
PID 1756 wrote to memory of 4328	1756	Odkjng32.exe	96
PID 1756 wrote to memory of 4328	1756	Odkjng32.exe	96
PID 4328 wrote to memory of 4800	4328	Ojgbfocc.exe	97
PID 4328 wrote to memory of 4800	4328	Ojgbfocc.exe	97
PID 4328 wrote to memory of 4800	4328	Ojgbfocc.exe	97
PID 4800 wrote to memory of 2196	4800	Ofnckp32.exe	98
PID 4800 wrote to memory of 2196	4800	Ofnckp32.exe	98
PID 4800 wrote to memory of 2196	4800	Ofnckp32.exe	98
PID 2196 wrote to memory of 2384	2196	Ofqpqo32.exe	99
PID 2196 wrote to memory of 2384	2196	Ofqpqo32.exe	99
PID 2196 wrote to memory of 2384	2196	Ofqpqo32.exe	99
PID 2384 wrote to memory of 1496	2384	Olkhmi32.exe	100
PID 2384 wrote to memory of 1496	2384	Olkhmi32.exe	100
PID 2384 wrote to memory of 1496	2384	Olkhmi32.exe	100
PID 1496 wrote to memory of 1152	1496	Ocdqjceo.exe	101
PID 1496 wrote to memory of 1152	1496	Ocdqjceo.exe	101
PID 1496 wrote to memory of 1152	1496	Ocdqjceo.exe	101
PID 1152 wrote to memory of 4836	1152	Onjegled.exe	102
PID 1152 wrote to memory of 4836	1152	Onjegled.exe	102
PID 1152 wrote to memory of 4836	1152	Onjegled.exe	102
PID 4836 wrote to memory of 1396	4836	Ocgmpccl.exe	103
PID 4836 wrote to memory of 1396	4836	Ocgmpccl.exe	103
PID 4836 wrote to memory of 1396	4836	Ocgmpccl.exe	103
PID 1396 wrote to memory of 1932	1396	Ojaelm32.exe	104
PID 1396 wrote to memory of 1932	1396	Ojaelm32.exe	104
PID 1396 wrote to memory of 1932	1396	Ojaelm32.exe	104
PID 1932 wrote to memory of 4028	1932	Pdfjifjo.exe	105
PID 1932 wrote to memory of 4028	1932	Pdfjifjo.exe	105
PID 1932 wrote to memory of 4028	1932	Pdfjifjo.exe	105
PID 4028 wrote to memory of 3276	4028	Pjcbbmif.exe	106
PID 4028 wrote to memory of 3276	4028	Pjcbbmif.exe	106
PID 4028 wrote to memory of 3276	4028	Pjcbbmif.exe	106
PID 3276 wrote to memory of 3480	3276	Pqmjog32.exe	107
PID 3276 wrote to memory of 3480	3276	Pqmjog32.exe	107
PID 3276 wrote to memory of 3480	3276	Pqmjog32.exe	107
PID 3480 wrote to memory of 3284	3480	Pjeoglgc.exe	108
PID 3480 wrote to memory of 3284	3480	Pjeoglgc.exe	108
PID 3480 wrote to memory of 3284	3480	Pjeoglgc.exe	108
PID 3284 wrote to memory of 2676	3284	Pgioqq32.exe	109
PID 3284 wrote to memory of 2676	3284	Pgioqq32.exe	109
PID 3284 wrote to memory of 2676	3284	Pgioqq32.exe	109
PID 2676 wrote to memory of 3828	2676	Pmfhig32.exe	110

C:\Users\Admin\AppData\Local\Temp\2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe
"C:\Users\Admin\AppData\Local\Temp\2c386acf270a5f141d22c23714b513f97a2a5677b0e79f71ac50d92e1b41f429.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\Mmlpoqpg.exe
  C:\Windows\system32\Mmlpoqpg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\Meiaib32.exe
    C:\Windows\system32\Meiaib32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\Mdjagjco.exe
      C:\Windows\system32\Mdjagjco.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        23⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        24⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        25⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        26⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        27⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2572
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        29⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        30⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        34⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        35⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        36⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        37⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        38⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        39⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        41⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        42⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        43⤵
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        44⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        45⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        46⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3336
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        48⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        49⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        53⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        54⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        55⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        56⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        58⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        59⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        60⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        62⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        66⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        67⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        68⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        69⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        70⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        71⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        73⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        74⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        76⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        77⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        78⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        79⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        80⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        81⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        82⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        83⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        84⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        85⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        86⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        87⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        88⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6108
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        90⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        91⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3160
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        93⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        94⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        96⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        97⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        98⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        99⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        100⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        101⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        102⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        103⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        104⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        105⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        106⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        107⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        108⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        109⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2528
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        111⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        112⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        113⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        115⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        116⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        117⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        118⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        119⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        120⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        121⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        122⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        123⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        124⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        125⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        126⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        128⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        130⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        131⤵
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        132⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        133⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        134⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        135⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        136⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        138⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        139⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        140⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        141⤵
        Drops file in System32 directory
        
        PID:2556
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        142⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        143⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        144⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        146⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        147⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        148⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        149⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        150⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        152⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        153⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        154⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        155⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        156⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        157⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        158⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        159⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        160⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        161⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        163⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        164⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        165⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        166⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        167⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        168⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        169⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        170⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        171⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        172⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        173⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        174⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        175⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        176⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        177⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        178⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        179⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        180⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        181⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        182⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        184⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        185⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        186⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        187⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        188⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        189⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        190⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        192⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        193⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        194⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        195⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        196⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        197⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        198⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        199⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        200⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        201⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        202⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        203⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        204⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        205⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4664
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        208⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        209⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        210⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        211⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        212⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        213⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        214⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        215⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        216⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        217⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        218⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        219⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        220⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        221⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        222⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        223⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        225⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        226⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        227⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        228⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        229⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        230⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        231⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        232⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        233⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        234⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        235⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        237⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        238⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        239⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        240⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        241⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        242⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        243⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        244⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        245⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        246⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        247⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        248⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        249⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        250⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        251⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        252⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        253⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        254⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        255⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        258⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        259⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        260⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        261⤵
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        262⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        263⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        264⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        265⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        266⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        267⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        268⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        270⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        271⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        272⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        273⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        274⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        275⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        277⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        278⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        279⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        280⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8196
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        282⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        283⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        284⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        285⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        286⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        287⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        288⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        289⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        290⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        291⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        292⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        293⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        294⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        295⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        296⤵
        Drops file in System32 directory
        
        PID:8284
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        297⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        298⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        299⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        300⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        302⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        303⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        304⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        305⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        306⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        307⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        308⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        309⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        311⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        312⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        313⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        314⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        315⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        316⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        317⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        318⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        319⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        320⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        321⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        322⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        323⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9832
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        325⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        326⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        327⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        328⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        329⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        330⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        331⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        332⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        333⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        334⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        335⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        336⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        337⤵
        Drops file in System32 directory
        
        PID:9476
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        338⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        339⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        340⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        341⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        342⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        343⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        344⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        345⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        346⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        347⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        348⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        349⤵
        Drops file in System32 directory
        
        PID:9244
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        350⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        351⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        352⤵
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        353⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        354⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        355⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        356⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        357⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        358⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        359⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        360⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        361⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        362⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        363⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        365⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9292
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        367⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10080
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        369⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        370⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        371⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        372⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        373⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        375⤵
        Drops file in System32 directory
        
        PID:10028
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        376⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        377⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        378⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        379⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        380⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        381⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        382⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        383⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        384⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        385⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        386⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        387⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        388⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        389⤵
        Drops file in System32 directory
        
        PID:10764
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        390⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        391⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        392⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        393⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        394⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        395⤵
        Drops file in System32 directory
        
        PID:11016
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        396⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        397⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        398⤵
        Drops file in System32 directory
        
        PID:11140
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        399⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        400⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        401⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        402⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        403⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10476
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        405⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        406⤵
        Modifies registry class
        
        PID:10652
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        407⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        408⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        409⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        410⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        411⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        412⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        413⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        414⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        415⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        416⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        417⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10488
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        419⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        420⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10856
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        422⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        423⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        424⤵
        Modifies registry class
        
        PID:11220
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        425⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        426⤵
        Drops file in System32 directory
        
        PID:10404
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        427⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10836
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        429⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        430⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        432⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        433⤵
        Drops file in System32 directory
        
        PID:10832
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        434⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        435⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        436⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        437⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        438⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        439⤵
        Drops file in System32 directory
        
        PID:10696
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        440⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        441⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        442⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        443⤵
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        444⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        445⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        446⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        447⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        448⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11484
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        450⤵
        Drops file in System32 directory
        
        PID:11544
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        451⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        452⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        453⤵
        Drops file in System32 directory
        
        PID:11680
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        454⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        455⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        456⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        457⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11888
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        459⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        460⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        461⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        462⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        463⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        464⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        465⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        466⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        467⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        468⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        469⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        470⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        471⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        472⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        473⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        474⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        475⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        476⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3448
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        478⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        479⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        480⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        481⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        482⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        483⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        484⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        485⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        486⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        487⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1168
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        489⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        490⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        491⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        492⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        494⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        495⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        496⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        497⤵
        Drops file in System32 directory
        
        PID:12008
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        498⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        499⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        500⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        501⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        502⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12264
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11368
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        506⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        507⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4952
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        509⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        510⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        511⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        512⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        513⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        514⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        515⤵
        
        PID:696
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        516⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        517⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        518⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        519⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        521⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        522⤵
        Drops file in System32 directory
        
        PID:11652
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        523⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        524⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        525⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        526⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        527⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        528⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        529⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        530⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        531⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        532⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        533⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        534⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        535⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        536⤵
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        537⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        538⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        539⤵
        Drops file in System32 directory
        
        PID:12236
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        540⤵
        Modifies registry class
        
        PID:12224
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        541⤵
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        542⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        543⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        544⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        545⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        546⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        547⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        548⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        549⤵
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        550⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        551⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        552⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        553⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        554⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        555⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        556⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        557⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        558⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11756
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        560⤵
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        561⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        562⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        563⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        564⤵
        Drops file in System32 directory
        
        PID:11876
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        566⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3108
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        568⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        569⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        570⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        571⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        572⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        573⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        574⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        575⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        576⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        577⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        578⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        579⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        580⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        581⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        582⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        583⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        584⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        585⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        586⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        587⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        588⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        589⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        590⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        591⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        592⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        593⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        594⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        595⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        596⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        597⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        598⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        599⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        600⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        601⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        602⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        603⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        604⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        605⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        606⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        607⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        608⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        609⤵
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        610⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        611⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1388
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        612⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        613⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        614⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        615⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        617⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        618⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        619⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        620⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        621⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        622⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        623⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        624⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        625⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        626⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        627⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        628⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6312
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        629⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        630⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        631⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        632⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        633⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        634⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        635⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        636⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        637⤵
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        638⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        639⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        640⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        641⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        642⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        643⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        644⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        645⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        646⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        647⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        648⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        649⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        650⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        651⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        652⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        653⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        654⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        655⤵
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        656⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        657⤵
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        658⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        659⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        660⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        661⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        662⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        663⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        664⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        665⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        666⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        668⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        669⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        670⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4360
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        671⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        672⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        673⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        674⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        675⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        676⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        677⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        678⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        679⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        680⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        681⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        682⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        683⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        684⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        685⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        686⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        687⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        688⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        689⤵
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        690⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        691⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        692⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        693⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        694⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        695⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        696⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        697⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        698⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        699⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        700⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        701⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        702⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        703⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        704⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        705⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        706⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        707⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        708⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        709⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        710⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        711⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        712⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        713⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        714⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        715⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        716⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        717⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        718⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        719⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        720⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        721⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        722⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        723⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        724⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        725⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        726⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        727⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        728⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        729⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        730⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        731⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        732⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        733⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        734⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        735⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        736⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        737⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        738⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        739⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        740⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        741⤵
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        742⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        743⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        744⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 420
        745⤵
        Program crash
        
        PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7544 -ip 7544
1⤵
PID:8120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
1.2MB

MD5
ba274752143228ec357260c604f8896a

SHA1
9fa000c4f7836dce57d7ca86b5b453ba5ca4460e

SHA256
57cafcbdd8833d6e0990083c62ad544bbba4af8558b5c0316a23f05dd6ca27a1

SHA512
8743f96fc8d6e1b22e907f8b9b608e606290b50d8579ec9abc015b6bf5f90e134cc0f2ae3549013e292ddd3733d912fc2b0c368bdc4f9a0354a2022e45e5cd3e

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
128KB

MD5
c34a63c63c449da15c9903b2501c851c

SHA1
6c4309153b553d015be548252d573dea70168b04

SHA256
73beaab8dad6c6a9aa2e03bfd1d956567b239a88dfb152c04ab1be044b70a938

SHA512
1980954890297a8745a22075cdbc510870cd13c3b7b68eb630dec8dd63260cd7785cb8850df9497e024440ef517127f02c8a1fc7b8d32d1ea8c77c5963288083

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
1.2MB

MD5
4fd227ef07490390e95070d3e15a6340

SHA1
943b4e2f4b326a4e17c32ac7bf0391681b0040d6

SHA256
ffa9758fa33dd02f691c37e3a4929e288e3d5d407884a0ba2f78b646e5681400

SHA512
29c9c73e41de063a14463ed85c07bae2fab62789b7ddeacc63eb8a04492802c53e77efc4b84af5dab3a18d9adebd63f56c1eaff2b9e428db5c83c2bcb8537d34

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
128KB

MD5
5b23406be8b740e6270024bfbe9ce105

SHA1
47000800c7578e8ba4028f8ce4e784ea8af506fa

SHA256
5143e2f522bd23d975247b8aa28be06fe4160c1a14837bbe39b737c96bbdbac2

SHA512
04bb47a0f100d9cb275ddf3f90aa91c01490404b77d5c92fa32a4be5aad969e8ba5ebfc242e0b2d3ff79e619f93ff13adb19d0ddfc10243bc2b0952a8f2de8f2

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
1.2MB

MD5
84f73a943996463e551f97479a63d264

SHA1
542b290b628ee2d6a1c74ada0a2e4584db48fe49

SHA256
44adf95d84f101067d760ee259fe1d1826bfa8d9b512ac503ee2ea727640d9d3

SHA512
5450208f71dca6b8dddaa90b90c27769e099c91206c6146a6b96cdb2e93e9069cf87e170272c62a9f2365733f5bb63aebc7d67fe8288a74b656e2767d4df1a0f

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
192KB

MD5
0105c58ed3dbcb208ef2462280eb8279

SHA1
6917028f03064e2fe6681aa3c2459d54b90066df

SHA256
2b8661257fe01be95e557cbf3871332551eca5b424a945adcf398b9c1e188c9c

SHA512
a05fccb740b2ce304d74f6b82eae8e97b951f5de4310b59c50e3ccaff7688d7063f8568a19bb96033faa3e1fae9bbdbc1c0333bee4a20220b6e3b4ca3d661eb7

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
1.2MB

MD5
0e243358f63a4d9b0f13c62293b0bff0

SHA1
ad405e4cd8f3eba801cd1f7f6039fde7361c2541

SHA256
24c8cdd7a6a67de4594b3e69786f4ce5646e08fa11873223712494aff88d199f

SHA512
8a0d03273b183a1c31dd17f62a696ab257533d897778d51166b65ab66d217a331abd50d6b97d4782285495a0ac75d8b6bbe8faa6ea4978773c42a3f5760c1b2b

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
1.2MB

MD5
ce0828265c56cf91bd39663caf651b04

SHA1
2dcf873ff8c84523b5dd54f4fe699d5b8e2b079b

SHA256
7bbd0cbde527ba9fea5e18c32e00e46c7cd0b565912a6a4de50937ebdb8c385e

SHA512
ee10e2ee5aa43d1009c5a24ee02c839262d5712a009501528ebc0181439d08807f84f3be92d474e2978c90a30c9a93b372d15f0f82694b220c99bc2cd9193734

Download Submit
C:\Windows\SysWOW64\Aompak32.exe

Filesize
1.2MB

MD5
82cb609611ae95e0d7699f20b10c0929

SHA1
7078df7e49ea9b077edc0328cc0d42d7a42c0b36

SHA256
2045ddf44fe241589400184fff5ce6892848ac59b21d85d3e0cefa6223526a2e

SHA512
7a188879c18a38ed126b8650714421963ae08810ae2d5385393737b18911891f736f8d2eadeacc886a83a4748a5920bcf1f70680e8ea7885d53a0767544f03f6

Download Submit
C:\Windows\SysWOW64\Biadeoce.exe

Filesize
1.2MB

MD5
4a879d0ae17e15524ef421e9e99c78e0

SHA1
40d31994680750ccd07d6d7f1d2872b0831b3a35

SHA256
c46714b51db9904048c9a0bf6d0fd932cfba7de9c9f524b04e8afc19d00c3d5c

SHA512
59a13f24567df188dcb7bd2f984c2a1bc2305feddc4e08c6904236a0d485cecff0cf77ba97ab5d49b382952a20c6cc1bc98315f04e8cf830e4c8e5eb74ff0545

Download Submit
C:\Windows\SysWOW64\Ccqkigkp.exe

Filesize
1.2MB

MD5
aca6dfb2b8874eb1221df6980c5cd90e

SHA1
e114d9de87fd1b1e962a50459d1909c3ed9029d7

SHA256
64a0c04dc92083a5a6bf62fd4616876d743572c9cdde56942f7c9a51bfd4e3e0

SHA512
54d387ffc237cc0b544e0c4fc88210c9a57f6c71cbe30888df61ace7c8b444d6bbe0a287bf0f5f2481ef4558c5de727a9dd4ed1f4650d70b34f8dd2ec662a07a

Download Submit
C:\Windows\SysWOW64\Fhofmq32.exe

Filesize
1.2MB

MD5
2d45b2ed955524752f4bf90a76d763f3

SHA1
c52c49bc0df2d68851b329adcf6bc7897a4aa5aa

SHA256
49f88cab382476712533c5700582c6394867b331f50332f2dda0abb0f3c8b91d

SHA512
6e72eaae0dd8c6e797e2c4ed1cc36dca0fe5bef2d4ed8c4172bc5ab2f2837ee6be6b5c4a7bd48074edb26322edf0efbe0a1dd98edf7e99c3e6a323c318d47064

Download Submit
C:\Windows\SysWOW64\Fpeafcfa.exe

Filesize
1.2MB

MD5
9f387c16f5d730bb25f79572cee3960e

SHA1
1b1e9dbdecd57b13af2331f45d93692426cf73b3

SHA256
44079fb7bad9aa767c51fc0afe76513f58c6ccfc777c11a99ed2cdaf2fe79e9e

SHA512
38448ae59e64eb2eb8bee1a832acb51c1ecbcadba727c3e797fd943a56e21d6a28110081e521be84d30ca3a074957a51edd01a761adb06c26001c6dab3afea1f

Download Submit
C:\Windows\SysWOW64\Hihibbjo.exe

Filesize
1.2MB

MD5
534547534f7015cd92493a6ff612126c

SHA1
50413dd5a3b864d23215b2c948a7a73d24ac9875

SHA256
9f928fdcdd21a9bf2ec1d953dba95fa14826565295a80bc589c06e37be043d3e

SHA512
468d190db9e25859e20a1ad20c2434712c92198660df30e57aa537f1b5738fea50f29270893329ea9d263b0f4f1657a457c6cdd13bb736d17b538f0b7d87432d

Download Submit
C:\Windows\SysWOW64\Hjedffig.exe

Filesize
1.2MB

MD5
7563a8ac6dd259af8fa5bbf4b4dde305

SHA1
5eba1cb5ff9875f3bb351b4b5ee767c1a3f4f9ca

SHA256
7260e03c619bdef9a88f864d692bcd491d94b08169c6b705649424e85a9ed168

SHA512
25b82584995f7c10af0f80d688a2bd2883b96d9d57b4f500afafc18125e3a34339d01d6e0c1d8d592d10bc1dcd29e8483f4eb1304e7e530817a6660cad5b12a1

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
1.2MB

MD5
fab71e126d73a3fc84b13596f1169a49

SHA1
95bfd766047ada68b8416212f0eb2b5449b89e0e

SHA256
bc79e3d5528ca4133fc0a0b48da9671c1d2f68b916ce399b66276ff1264e26f1

SHA512
0886830ad1fa6d4f9581acb8438276a0a077853ef120a8fd0d2830c73511bbca1521862d69681add1b35f262aa021fd73d26ff18d7ea866e607fc5ecdec0ffc8

Download Submit
C:\Windows\SysWOW64\Iqmidndd.exe

Filesize
1.2MB

MD5
18020199f1772495a5f4ca3aabb69b87

SHA1
cb6a3e68a293d7b68a04efb8c5ba24c63f2e6018

SHA256
b24187475ce2b00ee2296ebae58aabb85c89a6e523479d1e613b09af4627cc91

SHA512
e1ac6adcac0bc73f2f1c7fdf6024d98b52341d5094a10a25671f7f92a4fe3554cf0a18b73dd8bf854f0923da6b73c3e9f99271df76bdda457f50be4e1a32d39e

Download Submit
C:\Windows\SysWOW64\Jgakbm32.exe

Filesize
1.2MB

MD5
fc1aac6f640dc739d108c36e522f339c

SHA1
9f0ddd27bbf87aa4054bc0c25ffbc0a5d3166ce8

SHA256
b5fa37439fc70426ba0abf1612d082a03baad958cd93de79e2aac11df30ac1ce

SHA512
cff29cae7acedc904d5d1f968b5fa81e710186db6be948ee611882f4e7783eb521e0a2bd5777ee652797b7e55a8178bc16796894d0f0abb4c002c8f4eef7e113

Download Submit
C:\Windows\SysWOW64\Jglklggl.exe

Filesize
1.2MB

MD5
e99fd529a66a421b64e03ad30804c05a

SHA1
0e3d1f1dcd38c5302f3e29e73f43a9f8f85e6182

SHA256
1c08496b9ee3d01c7fe3b2b488c70da7285df2c0ca0f98747c65153dcb2c7ec6

SHA512
b974b551b211edd6744aed6018a86e6145c323d340d016db70b342f1a062814655abd57c6a83248c439fc07edaf32a72de7058a2907169f5d2269a611e20bc86

Download Submit
C:\Windows\SysWOW64\Kijchhbo.exe

Filesize
1.2MB

MD5
bd84cfce3872d2dc6a655ed5b8e06ad1

SHA1
149e997fdfc603fc05b2855af7c4fbec0181ff2c

SHA256
f111fd03a961da2fe690355d479997a2bbf921432a10f8748736f7058cba9bc4

SHA512
1aeb49a5796ebdc5c5ad5ddb47975ee5b0b4ccf6c1ee5272253111f13210a89abb7169582d45964f5dcae29c90e004ed96c3d21343bf4a432705b51ec8cb89fa

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
1.2MB

MD5
e0a0bcfa683329599e75f0066c3e6a41

SHA1
92286d80577beae516ff52948fc17be2fe0eceb0

SHA256
51c852b50fa96b9f2c3da2cbde3fd5d0cef989aa5ebd75e7303e85352c084935

SHA512
be7f28a91a66412ae2f25085ced419cc6a188208ed539b4555739de0bd41b6e1db1e46e1eaf2aa12d6ac1d61ade1f930403d1a2e15e1461537ad1a25046dde82

Download Submit
C:\Windows\SysWOW64\Lbngllob.exe

Filesize
1.2MB

MD5
436219ca504a5c37dd018fad29c6bca2

SHA1
79d635ffddee53e5b86af6e0916fc6dc4b65f7e6

SHA256
ffb130e06bdbcaae415348dab648d4bb4b459620b8391ee9d6e7b27c3a7c155f

SHA512
4a849f1e59c4ba3620a2cb992246372a8106bb1996aaa6b8fe94588874c9c2ea5f45ed14904389890d9c4876245427b565b784cf4f5fbb7b2938374a31a5a8e1

Download Submit
C:\Windows\SysWOW64\Lgepom32.exe

Filesize
1.2MB

MD5
80312c3ce4458fcaf4844804c1777579

SHA1
611501355e63acd6635a4a41dd495cfcd3b54604

SHA256
99de21a11b5843d492e3517d46bd7c1e4a2723f7139f696d847fc1324a0c5c86

SHA512
09b2ef4f97fb63a60c8058b1ec0185ab578c4741f05677bfe52034ff498866dfa6b78f514f97288e9d63bd135d41ea135566b506951dedbb706d44c80dfb235a

Download Submit
C:\Windows\SysWOW64\Lhcali32.exe

Filesize
1.2MB

MD5
23807d2c1c8d9309719c1aa2aa9e6942

SHA1
b34df403cb3520be57f5f04e492a0a96933fecd7

SHA256
8b91665039deab9ee035d3d961526523281fabe3b66a4a18bda01d6fe47189c8

SHA512
7ed355bb421c9fa51fef52cd81490c48c5a13d7a56ed48e220bff3cf1095b305f35908ba1a936be6d1eb69dab85d531ebca5d2ffdede3a310901252293eb133f

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
1.2MB

MD5
8b7cf4faecc71bfac4b7194de492339d

SHA1
13fb2d879d21c086716fa81d474797b061d348d4

SHA256
b2042a5543abedc523809f0885404322a1aed7fee34c1808d6b34ea4187f40f4

SHA512
7fc1a6048742419ae5413bb2e4dd11bd3a961d9974217258fe4f90ab5bb0e22bb4f98c44d915164a89a89cb9a9c52369110f4b63ab9fed0cd10932426e6834a3

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
1.2MB

MD5
8493f122554399d9d5c20d6f3b6aeeff

SHA1
1645e925b490580f77dc19a64ab3f379725e20ae

SHA256
501fc362141139118d312e65c9b22aabf5cfd0bb2002a651823b0b5322d9552e

SHA512
9314d1b0b334bfb9740ac712739110ef93a6eb555a0027f676d507b77f6b93048cab425db1e032b72a2ac0c9d41ccb22ddcc418d5347d210e4318abb1717e82d

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
448KB

MD5
8f719d2a94399a2c9bcc7b95be633174

SHA1
22fe216861bc4c18cb2a73e887e62f1998f876bc

SHA256
c8d7061964f10d94a857544f4d9d4a6e716607c360916124b8d04e664b31180f

SHA512
7134f9365ade7d6aa57da18b0a26c301092e842ebf7a73289599d7da90a9e69ebb7c4241c9cfa51c2d4ef5758ac403fe845fbe94cdae53a6dc61b137e73f3212

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
1.2MB

MD5
54d4517e3b3409e0eb20ce36cd91f82c

SHA1
b99f7532a71fef88fbdae03e9311dd36f7367321

SHA256
9a3fe2a2aaf0ba0c7147463c76df26c94b2c7ef90f6f4c54d6242d21954a3433

SHA512
c1c4793b4023ea602c119f546f236ebb81bc7500bf901192e9f03d62c67a840d897d0bd64deca030cac027679e03d28a00000c0d7f9654d703ba7d837240c586

Download Submit
C:\Windows\SysWOW64\Lpochfji.exe

Filesize
1.2MB

MD5
7eee00bdddf3629beec339dd7de10aad

SHA1
0e21ab3412246e7c4c85fae764b7192d5b870da0

SHA256
18dabb4e1bb174cdde30dc8ce661c21344b1cdc48b099e6da0d77de6ccba40d9

SHA512
3c5546d683167e2058c4a3a5640512a86dae5795ecd4d7526a170364fdad0ae1633629516c45158ebbc23a4a278e4347449fe31bbc0ef138876e5823b1e09d33

Download Submit
C:\Windows\SysWOW64\Mdjagjco.exe

Filesize
1.2MB

MD5
51914be39a51138b15a7724841739d71

SHA1
2d43d4634366fb1dcaadbd19f9ea6f127757d96c

SHA256
5f764bb421f83400e75c54ddb7fae8331d94a1c6376abae28b7e0fcdce8ad7af

SHA512
89b4bc541628219266a26e625773ba1b2f663806733c72e002ec18f5a21bd3a3cd50f166434df7f81027a70ea8746dafa666eaa802892793d01c5009c8d7df17

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
711KB

MD5
8be4e8ffe5eae4faa5cc987300491257

SHA1
85671cc167de656959708d99e49b2c96c955c54c

SHA256
17bbb730ca5b8fddcddf5f93affff32cbd46f9e209ec1dbcff280eb6f30f6e46

SHA512
4dec70c9025f90e27229ae054f3140e48ac27857a3174fad4d2368edf9f81c87608270cf4e7938835010aa7b18cfb4a316f3f26df0489262d5cffd55646a7216

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
45KB

MD5
c91661305f1e3f62e6061ced2b5a376b

SHA1
608922612b5d97363e89a30265c08923c8c12118

SHA256
092fa4d4dd0e4c1de162bf4517c78faaf549b61f80ef773a978396aa9d4bf729

SHA512
721aa7e97683e7d12702399d9e1e2fce2cd1f6412d1d607fa3b1782e5182d276fd5bae2d10af4ac965da42006cb4c060126fd38acf995485fb4283e3286764a2

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
1.2MB

MD5
33a8921a95064baa4b4c3b05d3a8359e

SHA1
819dbc6bd608db80b3625c2a6c8a3441fb4198ae

SHA256
81bf467dc95528a87b90f86b4eacfa7a5aa847fa65d18556048e328b8dd169e6

SHA512
6b2f6df99e22daa4d56172742f737d92dce74763bcbd8ad498e6d5e96552b5c80ef84537a57cfee14ea59ef14bfcdf7d42a2cf8c4bd657b91cdae29b25e5ea41

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
1.2MB

MD5
988c6ef1f6db19901b084c846517da91

SHA1
5fa95938f188149dad2fbafea55b4f8f1a8aa885

SHA256
9b137a418650b4c10a6fa740139feda10c85f4a6a77ac82214b385b9d555ce53

SHA512
5bba5299a317d3a496e6c3e53783968ac292893b60b2b625606d7f858e7da00fb1ad41094e2dfee2e270e2a4e0a1520fb4087c2b756bf0609a00a127d5bcb6aa

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
1.2MB

MD5
1101717e562bec7dcbd418dff0686d45

SHA1
6580fe7969c79febc025974819cc9ca47e45cfca

SHA256
bc7765d190507132c9aec9e1ca9d4939ce26a00f70e27a851466bf403df671ae

SHA512
ea51c32a21bc3415debd01c153f8fa24a126145c352e535f3ce5d24fbc45e6122c7191b0269938aea3b41311c3a7f07d030689e771122b86944827fc03de8bda

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
1.2MB

MD5
1b8d3470bddf47de0661555ce64d6cef

SHA1
4a3a9ced2fe1bdb3951b70d3d740a0fcb82e787b

SHA256
55115e2bfed40b0b4bc469133c5f91dca50de76c93bc18a3eb373c0f94905c0c

SHA512
c5d9454d0eee02fbc33e416118ac4322a37e622833a138e68b513356cfaa082308bd7dd63cf3fb4e72527f3c3ac23b3b40d1336dab1bdbe87e660b1734a6085d

Download Submit
C:\Windows\SysWOW64\Najmjokc.exe

Filesize
1.2MB

MD5
2731f2df416853ad80577002320d82f0

SHA1
7422d368b2d9629efc9d5c28e46d86e2406185f1

SHA256
18f3304ee44371d400c249532145ba1d28b2da875959f0d7d690d226329376eb

SHA512
18c9fa2aa9c0a091aac2ad73913710a621ffac42eb01514ae27435d30a7171a77bbc921e0aad417b8c7475a24d714c168063c66079d4d6bb8ebdac2b75e5b02e

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
896KB

MD5
794a6877e9e6a48243d46c2371ba07fc

SHA1
529b2d3344d2753497664ece61ffc3c65643345c

SHA256
966018a74840c4af18a6add3f8114f79242a16bdde0923f206c85c94c79c5a72

SHA512
72de85fe2458089d9006a3b1d592e1f1d842e364c01d7e90d5b384be244bffd258ac933685c2711793c3cb89e9fd09c9a8b5b62ac0823c5f5229d0c8f2f23301

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
1.2MB

MD5
4651c2b25636634cd7f0e3f82def1c70

SHA1
dd21383c6c168ea798d6b8256e102928d0eb0349

SHA256
5dafa44a3c1bd2262c5bb3115db251515a9d9017499211721f64243ff6e950e5

SHA512
fc50bdbb3e942599edf7655cfc2af023dd84f4cf46e7fb10180f6e78d94b31aa179fee535e64c45308cee8d2eeb0dea2200e7d3d66ff8caa9357c91ce8c11246

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
1.2MB

MD5
942afe7640ed7f94583f339dd29380a6

SHA1
973ab62b082e272daf2c57bf8a6743f29615ba5a

SHA256
e4014f8d271d8473b861a3fed44e7efb3044960c5d5616ac0d73d7dac2ea6cf4

SHA512
611892c95a292745feee7f6eaa66a33d9f3111fe821bd3b559a1bbabbbf60a1f91de81f4563836285c772ba79a0b61269f547dbeea544a08e8bf4e575df1c206

Download Submit
C:\Windows\SysWOW64\Nenqea32.dll

Filesize
7KB

MD5
6ee22eac7daeec2f0daf8e8a01ec07de

SHA1
1377211c8668ffd96918d11f014bfd434d044c01

SHA256
c3d40deada375cbb9d64a06a3656de11df1447dc337303e4599d3a60213763cb

SHA512
191f4fe980073c73f477cc9387a5f5ef3b24b570d55fc70da1e52c5bfee1b577c1f77b9141fb339480b4d5cba8d3992fb7a6a02414f62d7c394de1faef855c28

Download Submit
C:\Windows\SysWOW64\Nfcabp32.exe

Filesize
1.2MB

MD5
1e29da8890b2c29103d915a671b3b076

SHA1
84dfdcca436692b8ce746acfb20b1591c2b432b4

SHA256
026d107c48a454b743b49e214dfc7a6b3099385c90b7546811d82d79e9ef002d

SHA512
a63768f19c89a20626a7d9ec9be8805b9d36c130cc9eba8ab5579cddee48612c34887adeed350656a0dc67850a14a795e8fa72b0d586ec68099bfb5bacf2ffce

Download Submit
C:\Windows\SysWOW64\Ngjbaj32.exe

Filesize
1.2MB

MD5
e4c79dddc413d5d2be79cfdf7ef5a8da

SHA1
99656acaf5fc640c93a67caf5e922691cf2c2e8c

SHA256
9c85a2616554aad1c5fd378bd6432a9d70fb12ace2eb71bbd2f4c0d14a109652

SHA512
b22b4bb35309d886861f6a4b59394f4ca34a8a5991ca04231d0c87efe7d91c034729b155bdc055f892376a5b4f82f354a11dc4ace8b39e123697b771815f7889

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
1.2MB

MD5
be82cb7c819b0a440ee0526b34b676a6

SHA1
068d621fd0c10b6d17d1f0944d5e33bbcadfcf87

SHA256
a34db6e45608b7fe67c6da6a5be1c8ed32523a6bf11451cc2985c95a30bb5ae1

SHA512
ac834a961e750a23b7ca0c5dc66a76dfbbca6d40fc5c95131f19ca87c0703476c5540f7be8fec1e0060b23a6ada68b645cb5307dacb13cf1b2d80e3e98128074

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
512KB

MD5
fdef482bf68540bf656071ec762236c3

SHA1
4fe4366b4ef37becbd42210ed2f5350615937bfe

SHA256
6af72a0ffc5017e11d1dc8c72df296b704b216e5dc9843926037f5039ff9e56c

SHA512
94aff0b0ab2b4eacca9b7b8d603c9ee04d3b7ea83f44c0c9931dbc0cf8b0213b7c5b784186b089025c6f7f6e3912e2ed07077ae6f6b934a2c0398e34e051c29e

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
1.2MB

MD5
6c5a97a83d42737ddc53aed83938d711

SHA1
e44d23fc6c1a8c652da8cd012d2f588374a2c866

SHA256
1a20a4ea141bb9d510a5155098c5eb793e816527cdb7181bc2680f0f599b586f

SHA512
0219ed43162515a2607014bcc9fe8c8815f40b46195401ce138e463cae9b380113fdd9c3f4932873b4e29882b7ee67fa2ceebb3e47e3b03abad8c082899e3673

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
320KB

MD5
1432ee96ed0a5f432e3417109212aaa9

SHA1
816d58bceefa67daf7fc0b6274c6931a34297156

SHA256
48e0369bdf1e829ac1a8fbe127d674b98764c7cc32e53db20471bbb6c63f0e73

SHA512
55d3e4b2216375b41e0ec392bb840909d54f0c701525cab5a190979cd067c4735784f0fa82b2da824e4a67663431664d88cf8602b2d035034a83360f07e9ff69

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
1.2MB

MD5
50400dee78bfb7d795daed94dae6a8c9

SHA1
fd47f5887f6ff32b035ddc285c4c017b334ffe8c

SHA256
cb8869379ff9f6a38ab6b598edcc439703a6b8573d3713c5a98b7aff48d311bd

SHA512
c3ec7cbf2ff8e197123a15292a2fe333267f83ef235748ce57b41a1c068b3d6f810f5577b389b39fdb67e7afc39e07c56cc4be7f367c387fc51cc2560d46a996

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
1.2MB

MD5
59030852465ccc49c0bc869208bc5d28

SHA1
bec2888bf2dbaeb7e649d75082d7c7bd90d63fe1

SHA256
1fb1e7e9eeb9ca5a50ef1f073b0df390f341648a414c7df72d35b22d4e542c25

SHA512
b30426eb8295ab794371be6084460b66035ff277c35f9bd7e5a2ec4799c4118bd01fb6e4c947572dc96f281dfd20ddd9b92ef99cc6707c43d7a9ecf99f541d1b

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
768KB

MD5
4e3841a7438ce9dcf99f5a9d70890575

SHA1
58bb80fee1c618c3e6269c0e552038a4aedc8a2c

SHA256
0ec1f040543426ba24cdcce2587abbe02eb71089f15e9bd9b360da5964618c98

SHA512
a8c966edc7fba5f47fd72b99ac6ef5a3e1dd752669ee75b106682142d3e299deec0d659cf8eeb6ab86ce25f55145c96025178312ebaae9f43dfbdecbf3dd01ce

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
1.2MB

MD5
f4056f6a6ca97efd31313a56781f12eb

SHA1
93f880ca7452cd7cfbaa61334df4fa420ac6d502

SHA256
89f4539ba73952c5705beeb68a20d67bc9a7fb67a622c8c8ca5348d378848c90

SHA512
65ccc413fd99c9838e3c981253c40e8948a661177ffc63a655b9c9ebc338d3ef7f2929052a6d40de7fb14e7418b59ea7cce3256de9954635d28ca62a89c2ac8c

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
640KB

MD5
03064c9c6c5b1feb9397dcb4bf370486

SHA1
b6df24049486e0ec7636723e0fe3505f45edaa92

SHA256
193b123b928d821c83f70ea6380c3997faccb2e2873a24d8100f6a9614326d1e

SHA512
0107fc7a8384ff68e73089668fc935a314d5f4dadd7e8314cb0970cde85ad3b74f688af9d68253a0309d5aa836394da4a6c45968b5f377d6b865085cf3436e0d

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
1.2MB

MD5
2eee49a673153050ac58fc0c2546631b

SHA1
8ba625660497db6715b036315d7d3a47e96b2e79

SHA256
49fc22cea16de14b0c8f3332e5d122c416897be47fcb419cbf9113bc2160e2b0

SHA512
1162e5df2818a6ca52bebb4a17f4f98e5211e33f38dde78ecd1c589020f4826df5bad7510e9bf45889a263ac8f86537e53b8d55968ad71c9fdea00a4d59830be

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
1.2MB

MD5
37932b963900d260a8c02e78b66a1275

SHA1
adf2ff6b7ea53f5018c2e91f2253486e8f92b8a1

SHA256
1dc34c007bcfefd41e32de17ebb2375a352db2995f32133a0afdcadcfa751f21

SHA512
713bf2ea71047954ed426fa773dc3a0ac974d4d1de3326841dce4de2965012e88a1ef09e3e5aa2813a2cebe0680fe3ceca8da03d9f86d6d310cad926b95daef3

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
832KB

MD5
5312c19db118bd90cdc60ce48cb0bbc4

SHA1
a996e193c2c6e0737fb875fc64e883c7b6885c42

SHA256
6a013f1d7d556f74da8ae4b827da9da98ec8ecd4ddd39563196b5b51da9e1f4a

SHA512
f97e32dade3fe1ccdc82cd1ca722f20e188cf45b915ff941bce5b88236891f0fe35492c4fc86010370514073c983fb681cbc18f95db94a109c2a5d89092d9afd

Download Submit
C:\Windows\SysWOW64\Ojnfihmo.exe

Filesize
1.2MB

MD5
741fbb5486bd636680180c72b4376386

SHA1
0071f5b77b14b31283cd93f29e77e84de4f270fc

SHA256
15ef27726e8fccc11cc366a75d8ca25c0533f88d9dbf1a8845a848d587062bd5

SHA512
631b696625fdffb21fb590ff3fa2c4e307e14b10b1b9510adbc581e5c3c03a87fbb4866322d5980850edd40f47c09c4f2dea48b89988f09f3eb4de404b47cb18

Download Submit
C:\Windows\SysWOW64\Okjnnj32.exe

Filesize
1.2MB

MD5
b4dd5a037a653cb5e21490a4df3a9062

SHA1
d900cb203664741bd64ee3a47dec2c49bea557a2

SHA256
7aa45f6710e2b90e09009432fd5d4e6a9958c05d52cb4380f619eaece80fb7da

SHA512
42004fef9cde645fa38f0e6bc377ac5a42d81bc1c04feb69cb2a17c056b5d87ab54899bd62e96b1486d4e9bfd3a0deb9d01d4b08255485427d257fbc948ee86a

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
1.2MB

MD5
9ee5653f589a244497eb35b3f7477932

SHA1
9a5dce960e16681e85d782bc583517d1b64ffaf7

SHA256
6090ec4c2a10afe0a3337cbef8701a239a03ffb6d230d003396d7baeecd245f5

SHA512
59c75529e56612f6a5f4fe00d109d602afb0cf3024b4175b50cd246c906b23ce62202cad68f99c562fe1d93c471133ac995ee1e07b1138a83e62110c5c0b1778

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
640KB

MD5
0c9a9d41d967f70b3ed2c9a878ef7c85

SHA1
df81697f68b23d684aac74d317af5e851a3baa72

SHA256
6ab762a6d3b7a34dfe4a7c0bf7d0830992c1623218f2e8668c942380e241764d

SHA512
722281978e90ab12fe03d4bf269b93212312b029a0407aa8a8e84b066080360cc00f7ceafc42976bcab5df01dfc19c893a4826eeb4f05ccf64f586660a730ce2

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
1.2MB

MD5
dc8b33c6ce623f662df49020bd465739

SHA1
870a3e10fdc33edcc8801afaa0aa23d7be053ddc

SHA256
62389832e144b10675c366cb81d6a27ae24572b6e4e77df2dd31094375b835c3

SHA512
a04ab54b22da50f67f5be2d3b7ee6ad10e9b0a1458bca6e3e79bfe699887137e942c94ab6183a1faac0a78285d50e6b5261a65364472cc0b58d5f4957c8eb647

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
384KB

MD5
8cec352ff44339b0348330d3f0776de3

SHA1
6f1b94d3ace590070264e34901dbab488dd1383e

SHA256
632a5fecf3ec4e63775045c1022b7724324ba343e52a14242340c061155c3e5e

SHA512
7a20fd80f1f801b434438bf16e377a0f4086c74a3ca3ab22931aa7720dc97321450d1d2845bd80ed9c562c7a4bf898384586c882452bc73cf7c5642572846d86

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
1.2MB

MD5
2b76b79072ce64feaca74e06e22c9c7c

SHA1
a703c1d236a8f85a4b339ab75e7e0a1f50c875e1

SHA256
03b9e9c02093c4caa5b8345bf9259583918bed6c3866d98b4d4230e4cec68623

SHA512
2420b172d3d4c35b5b545e7b5a3c950ede05e730e7d46d7dad10b9a562c5b464294012eaee57a7872709eac61b23e500780d26f59ef827211039f0719e76b3e6

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
1.2MB

MD5
cbb49dd143e5cf8ac066313dec0db396

SHA1
6f01ad493e3109e08f45ba3f248b3ab0f961ae84

SHA256
be8bb49fa60b3061f8dadb73ab99b5e2f77b900a6554fe255c06602cea1cc84b

SHA512
15eecb58c7e4c1c2092f2f60a284350fc7b052f23a11c0ad929cde9d2beb1333e255d878968216bf5df63bf468630571f7fc66895d150e1b26064ee51e812d0a

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
230KB

MD5
2ed716e240fcca8963bbbcc4e73fe7c0

SHA1
aa11c87e571e1021c3efdf00d1ce0b313f001d67

SHA256
ad3b401a53a9151618cb638c213916b76479dab637dd664f3142231e256b03ec

SHA512
ce5b2c960986522a4d4c2e4724efe2c6ca11f4027b223c6005a51ed8b72abce429594bc61feec28812077dc30de8d8d32999960ce6b5e289c9e7e969b7fe35b7

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
1.2MB

MD5
42b529be92acda46584524d57004f847

SHA1
195d316e8ca7a9bb1a0f24cb9553ae3648e97780

SHA256
5c952aba903d083baf17e35bb2e31c83b5c64e0f6e1ccabd53dae2da6b07a5bb

SHA512
717bd3882763d91e6aa8d5faec21ee5a4984591bcecc2bc5e6f7dc8504da3b8b9a6a70b0315637f59b2037d2038209bd6cccdb4ea17733612290e6769305d558

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
1.2MB

MD5
37d228fbe39b21dc2b2780148c06b2b7

SHA1
e053e01cca2e6b94b853313e4fe29b2d4a1a5f83

SHA256
2f7a6bec543a4d941c4757921569a7fe5512e629e8d60cb8474ebdecd0959907

SHA512
5d0977914a7ef2143e8d642e05e9ae09c9cc69c07003608b8bdef732efaa441430e08a85806d2402975f09174f1c27184b0bb84e474f7be3b0fbf26e978b4b8d

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
14KB

MD5
564fcb7050063c89cedd660d77e23b3b

SHA1
4fc1017d86b3f614c3369a3a376c9f0f6e458bbc

SHA256
19f17692552ef05bde7deadcf6d13f27ae12fa257b643c3a4fea5930beee637e

SHA512
4b1934adbd34ae94134f50ee0590ebab80fe615228ac22b95a90a48d8b6b19d7b4690a6fde70b12107000ca82fbb385b6697707566ff64de8339240c95dd0965

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
1.2MB

MD5
5e34bec8935209b4cb9c964b9806afc6

SHA1
a313d046ef877aa9152b2a773a626228424744de

SHA256
4be2914ef5fcebd2442a7b8da1f70eb8e9ba74b3733358e90075df17ea3ba516

SHA512
678ab98a4a30847e9091e478b60ad93cf3bee77d94ff3fbcc7798df5c196fef598829f1448f99e9bd3a8ff5504a707b2170b9230379193a56d30aee1db68f4a2

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
128KB

MD5
e3ef08696859020cfac1602d78d069b4

SHA1
06280e666d233dca2e1f22354b17d1fc46271c67

SHA256
b637396a4be0943ed8a4872ec9bee2ec8fab6e73353c05e53bbfe1bc870675ea

SHA512
8c2a09b3e7da4e27334751ae5bb2ac041656d0ad3d010e07c555aa08ffc30cd9f0e2c762c2bf4e787be000f01bf4c021a12e993ffa5a51f2d2d6e8c03e0c60c5

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
1.2MB

MD5
d4cb1b6151a683f0e7b52e05584d3b6a

SHA1
3e3b3bdb8ec61087b4ca714a1158f7fd02ad6d0a

SHA256
fdee16854d3bdf9377f35411681474e3b622e5ea5abe51a20011fc828a683304

SHA512
e56b83acc727aa573c312d05aa1254134a75702e3c87408a79f9cbbae4949c3b0fe118f2105af090e1b7ff4ec6412796b8489ea3f9629fd7cdf8531c57b79306

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
1.2MB

MD5
cc57be920c2806c3b0decec062bdd3ac

SHA1
1418fc12c9f2649e488517e4cc82c72fdf656266

SHA256
f49f1c8defb7196a38b8d22fd4b3bd58c9d45bd53011b8e1531b0f1c1e45d625

SHA512
2328f7b92685e547597ebe5c2d32bf31edb5da9222413cd1ebf547db7123393a0294b71eca490755f7b083af560c3f620694711c13aea25d89eaa60e9d5b9eba

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
64KB

MD5
a948b3d88f9acbf985ac5fa3d9c6aed7

SHA1
87009928382eb1372429403297efa0c87d502df7

SHA256
3b519820f6e5200fe9377d9af0310f4ca934e35d480b88513bbd6bc2ce0f68f5

SHA512
af42282fc393366c4feafa17bd79af2d7263aefd921427bbf93e7ac6fc23f3c09ad3dccfef453322a7e973b023946e745b56d804a034966a27d0b566d1f7a369

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
1.2MB

MD5
65d3c77bf59f6f89a818a65d8a81ef9d

SHA1
0e8acb6027c849fa658f7dcbb155d3cea0256305

SHA256
181a4156515f7aebdc6910cef0bbdb3550cb727b24855d17499d87b92b3b68a0

SHA512
759fd7a9466c525f829c8cce1baa0673f1f1684d1863cbaf833f644cc5a3ac0920dd90d2ce68e2042a4e40b630364ffbcf29617b2fedda6ab6a8d979a679e9ad

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
1.2MB

MD5
c248cffa68cced48f4ba944500437d69

SHA1
a107f1d38f89f456b61113a9d5b42e338cb05f92

SHA256
5e7129c3abd46b6235ef0e30560e0858df8b04e020a559e4e70c7e28da8538a6

SHA512
a73f64d6898e70af10b9eed00b801c19b5e63a377499e8114179902b99f6b0555d75aa1e8b97c48d4399156f1f48beacb4d87443c8b8c94bb62acfdb6c7c9236

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
1.2MB

MD5
574a94f1e975fba534e18ba5897158de

SHA1
138b834b6f0230de4e68355929baf263c48c5c0b

SHA256
7b091fe9f4dc7e79c30032d95fefa3df2cf6ac71e7a51990ec553fa56c7dec5c

SHA512
4e90e14b456207f2970dede55cc1584b1acb81202101ae07a15233e8ca2632b06aca603959a92668bc01484818f432a867d28820aa435b19cbfc6625969e577b

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
1.2MB

MD5
d3ecf2c9ace5d68dece7d3166e78452f

SHA1
b84590242be91bbd2bc2279c49d382800d6dcf63

SHA256
3877acc928d91726e88f5152d5f826f763fb48e47ec8362728f18f510cccdd0a

SHA512
60061adaebc4c5090fe8b2b9b3cbd5649d71af33fc67b49b7eec7800aa50cd8d19848aa40f578cfeb3f30e6cbf0ca98d32da4a943ed33f3a6007b0f4ec36e0a2

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
1.2MB

MD5
2b1da9ac3e68f83d9af096897d58d400

SHA1
e6465b51d2ca36e69146b912f472dff7209440a5

SHA256
b17e0e2e1395082555c8ccb73436892ecffdf13aeabdcadb17c9a204df175d8c

SHA512
2f18cc277aa13c5dcfdebd2700bf70c577405ccba8a016b69fc9569174b6d869dedef1521cf02183e6d53833d85af8f4d3d136af09c02234ba8b730900f75ee3

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
1.2MB

MD5
35496a757a1f608be3a10f12900adf25

SHA1
ebc20c18ccd8b0581e7d63c9c4efa56708821d5e

SHA256
0571a5c44be1da243ac25ac6a6f14c411db5ba53de532cb1d85aec3931c835b5

SHA512
037dd7a98c94f8a05abbe2420291cd518848c1cc2b7d06606f5f4fa2af2c18fe76f649598e915c2091a189d199df1e4dd5f8e965c72151c40513204b277536bd

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
384KB

MD5
c6eb662e34aea768f89c950262bf404b

SHA1
6a0445d58c7b54818f975b70c6df2bbef3b2b22b

SHA256
55f150a8dbc04ca5117fac69953ca9bfb2e30d7464ceb18abc8eff4264596839

SHA512
9eb41f82ed7944687a4d367dcd59c6759db5df460fe34ba48741a8a22d8f63376059064b93573da2f9549b7f9f60c87ab69baa97197726ac08ca69bd3874a978

Download Submit
memory/316-574-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/464-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/532-604-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/768-589-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/832-615-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1152-542-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1248-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1256-613-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1388-631-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1396-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1464-590-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1492-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1496-541-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1560-553-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1684-580-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1756-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1868-570-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-622-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1932-545-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-539-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2308-610-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2384-540-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2396-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2572-556-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-550-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2712-638-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2796-565-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3084-555-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3116-573-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-591-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3276-547-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3284-549-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3336-605-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-554-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3468-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3480-548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3604-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3632-620-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3768-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3828-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3844-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4028-546-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4120-588-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4124-637-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4140-639-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4320-636-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-68-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-557-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4352-628-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-571-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4428-614-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4532-640-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4572-629-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4632-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4640-581-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-533-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-543-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5008-597-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5020-611-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5044-563-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5052-598-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5140-645-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5176-647-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads