955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe
Size 976KB
Sample240404-237vssda2s
SHA256 955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395
MD5 0dd9b2158110123049397bba6864eb98
SHA1 44c4aa4abaaefae454060af20152ec78bf27b693
SHA512 f5a51203dd8020293a44f8819aead23ef6eb55d2d08677ff64cf614b5ed1c15dd9ce939f806daefee890e7f343a1264ce93b6c73a321a7f8e7c1933adaf056ac
SSDEEP 12288:h79491NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:n47NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnhdkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmdonkgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gphgbafl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjdjoane.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfqnbjfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbbfdfkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjffdalb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Papfgbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lejgch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjokgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkconn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fajbjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghniielm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pedbahod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehhpla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bedgjgkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qemhbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Micoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naaqofgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljdceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edeeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnqeqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhbmphjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljkifn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cobkhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnbcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhoahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohgoaehe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnodaecc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjkblhfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Badanigc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnhdkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbekqdjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclang32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efffmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgghjjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejgch32.exe

Executes dropped EXE 64 IoCs

pid	Process
3148	Kebbafoj.exe
3516	Kbhoqj32.exe
1476	Kmncnb32.exe
3920	Lffhfh32.exe
1328	Lmdina32.exe
4732	Lbdolh32.exe
1792	Mlampmdo.exe
5100	Mmpijp32.exe
4512	Migjoaaf.exe
4900	Nljofl32.exe
4328	Nnjlpo32.exe
3328	Njqmepik.exe
4628	Ngdmod32.exe
4728	Njciko32.exe
2964	Npmagine.exe
3196	Nckndeni.exe
1492	Njefqo32.exe
4472	Olcbmj32.exe
4228	Ocnjidkf.exe
3880	Ojgbfocc.exe
3940	Olfobjbg.exe
2996	Ogkcpbam.exe
1840	Oneklm32.exe
3596	Ocbddc32.exe
2740	Onhhamgg.exe
4508	Oqfdnhfk.exe
1664	Ogpmjb32.exe
3532	Onjegled.exe
1764	Oqhacgdh.exe
4088	Ogbipa32.exe
1892	Pmoahijl.exe
4464	Pcijeb32.exe
4372	Pfhfan32.exe
1932	Pqmjog32.exe
2328	Pggbkagp.exe
4532	Pnakhkol.exe
3816	Pdkcde32.exe
904	Pjhlml32.exe
1376	Pmfhig32.exe
4744	Pgllfp32.exe
2392	Pjjhbl32.exe
4896	Pqdqof32.exe
792	Qnhahj32.exe
3848	Qdbiedpa.exe
4000	Qfcfml32.exe
4988	Qmmnjfnl.exe
2244	Qddfkd32.exe
4904	Qffbbldm.exe
1884	Aqkgpedc.exe
5084	Afhohlbj.exe
3240	Ambgef32.exe
3116	Aclpap32.exe
1428	Afjlnk32.exe
4844	Anadoi32.exe
4616	Aqppkd32.exe
4444	Acnlgp32.exe
4216	Afmhck32.exe
1240	Aabmqd32.exe
932	Aglemn32.exe
1628	Ajkaii32.exe
2572	Aminee32.exe
4060	Aepefb32.exe
1516	Agoabn32.exe
2388	Bnhjohkb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ekaacddn.dll	Omgmeigd.exe
File created	C:\Windows\SysWOW64\Dblamanm.dll	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Cmncbodd.dll	Olgncmim.exe
File created	C:\Windows\SysWOW64\Eiohdo32.dll	Hmnmgnoh.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpla32.exe	Eangpgcl.exe
File opened for modification	C:\Windows\SysWOW64\Fibhpbea.exe	Fpggamqc.exe
File opened for modification	C:\Windows\SysWOW64\Hdokdg32.exe	Hkfglb32.exe
File created	C:\Windows\SysWOW64\Bdmlme32.dll	Mqimikfj.exe
File opened for modification	C:\Windows\SysWOW64\Mfcmmp32.exe	Mpieqeko.exe
File created	C:\Windows\SysWOW64\Eqdgdn32.dll	Nhlpfgbb.exe
File opened for modification	C:\Windows\SysWOW64\Idkbkl32.exe	Igedlh32.exe
File created	C:\Windows\SysWOW64\Jqknkedi.exe	Jcgnbaeo.exe
File created	C:\Windows\SysWOW64\Jebfng32.exe	Jngbjd32.exe
File created	C:\Windows\SysWOW64\Lokdnjkg.exe	Llmhaold.exe
File created	C:\Windows\SysWOW64\Gqckln32.dll	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Hdicienl.exe	Gahjgj32.exe
File created	C:\Windows\SysWOW64\Ilcdofmo.dll	Igcoqocb.exe
File opened for modification	C:\Windows\SysWOW64\Eangpgcl.exe	Efhcbodf.exe
File created	C:\Windows\SysWOW64\Milcqamo.dll	Kcpahpmd.exe
File created	C:\Windows\SysWOW64\Jpecpo32.dll	Keifdpif.exe
File created	C:\Windows\SysWOW64\Lgepdkpo.dll	Npmagine.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Eehmok32.dll	Pfiddm32.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Fhgebmil.dll	Cobkhb32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Glipgf32.exe	Gikdkj32.exe
File opened for modification	C:\Windows\SysWOW64\Ojcpdg32.exe	Oqklkbbi.exe
File created	C:\Windows\SysWOW64\Cabomkll.exe	Bclang32.exe
File created	C:\Windows\SysWOW64\Kejocggj.dll	Lejgch32.exe
File created	C:\Windows\SysWOW64\Bdkohe32.dll	Lkeekk32.exe
File created	C:\Windows\SysWOW64\Oodlnfco.dll	Nccokk32.exe
File opened for modification	C:\Windows\SysWOW64\Eofgpikj.exe	Eiloco32.exe
File created	C:\Windows\SysWOW64\Demnop32.dll	Ghniielm.exe
File created	C:\Windows\SysWOW64\Nlphbnoe.exe	Nbgcih32.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Bkfmmb32.dll	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Cocopa32.dll	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Lpcncmnn.dll	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Fnkfmm32.exe	Fkmjaa32.exe
File created	C:\Windows\SysWOW64\Jfbkpd32.exe	Joiccj32.exe
File created	C:\Windows\SysWOW64\Jnjejjgh.exe	Jdaaaeqg.exe
File opened for modification	C:\Windows\SysWOW64\Olicnfco.exe	Oodcdb32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Kkconn32.exe	Kdigadjo.exe
File opened for modification	C:\Windows\SysWOW64\Oekpkigo.exe	Ocmconhk.exe
File opened for modification	C:\Windows\SysWOW64\Jkomneim.exe	Jqiipljg.exe
File opened for modification	C:\Windows\SysWOW64\Hmnmgnoh.exe	Gkmdecbg.exe
File opened for modification	C:\Windows\SysWOW64\Qfcfml32.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Afkicf32.dll	Mfcmmp32.exe
File created	C:\Windows\SysWOW64\Gelfeh32.dll	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Fdijbg32.exe	Fnobem32.exe
File created	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jnjejjgh.exe
File opened for modification	C:\Windows\SysWOW64\Hgghjjid.exe	Hdilnojp.exe
File created	C:\Windows\SysWOW64\Glcaambb.exe	Fibhpbea.exe
File created	C:\Windows\SysWOW64\Mdpmoppk.dll	Phdnngdn.exe
File created	C:\Windows\SysWOW64\Ombnni32.dll	Llmhaold.exe
File opened for modification	C:\Windows\SysWOW64\Hemmac32.exe	Hhimhobl.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Fpebke32.dll	Jfehed32.exe
File created	C:\Windows\SysWOW64\Ocgkan32.exe	Ommceclc.exe
File opened for modification	C:\Windows\SysWOW64\Pfepdg32.exe	Pcgdhkem.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8680	4536	WerFault.exe	872

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elpkep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occgpjdk.dll"	Hdmoohbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkiaej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgegjnih.dll"	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhqndghj.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mecjif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiebgmkm.dll"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiloco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbcikkp.dll"	Mapppn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihice32.dll"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Feocelll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkleeplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqdgdn32.dll"	Nhlpfgbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcmfp32.dll"	Mnnkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dabhdinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhgbhfbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gofdmmgd.dll"	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lllagh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lddkje32.dll"	Pjehmfch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgnboabc.dll"	Fhofmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Milidebi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcodim32.dll"	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coknoaic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbeojmh.dll"	Mnjqmpgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nggnadib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kppici32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeocld32.dll"	Bgbdcgld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdokdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcleml32.dll"	Jqknkedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obnbpa32.dll"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmqmbmdf.dll"	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lancko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlphicca.dll"	Fknicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gahjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hildmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iphioh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3148	2280	955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe	87
PID 2280 wrote to memory of 3148	2280	955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe	87
PID 2280 wrote to memory of 3148	2280	955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe	87
PID 3148 wrote to memory of 3516	3148	Kebbafoj.exe	89
PID 3148 wrote to memory of 3516	3148	Kebbafoj.exe	89
PID 3148 wrote to memory of 3516	3148	Kebbafoj.exe	89
PID 3516 wrote to memory of 1476	3516	Kbhoqj32.exe	90
PID 3516 wrote to memory of 1476	3516	Kbhoqj32.exe	90
PID 3516 wrote to memory of 1476	3516	Kbhoqj32.exe	90
PID 1476 wrote to memory of 3920	1476	Kmncnb32.exe	91
PID 1476 wrote to memory of 3920	1476	Kmncnb32.exe	91
PID 1476 wrote to memory of 3920	1476	Kmncnb32.exe	91
PID 3920 wrote to memory of 1328	3920	Lffhfh32.exe	92
PID 3920 wrote to memory of 1328	3920	Lffhfh32.exe	92
PID 3920 wrote to memory of 1328	3920	Lffhfh32.exe	92
PID 1328 wrote to memory of 4732	1328	Lmdina32.exe	93
PID 1328 wrote to memory of 4732	1328	Lmdina32.exe	93
PID 1328 wrote to memory of 4732	1328	Lmdina32.exe	93
PID 4732 wrote to memory of 1792	4732	Lbdolh32.exe	94
PID 4732 wrote to memory of 1792	4732	Lbdolh32.exe	94
PID 4732 wrote to memory of 1792	4732	Lbdolh32.exe	94
PID 1792 wrote to memory of 5100	1792	Mlampmdo.exe	95
PID 1792 wrote to memory of 5100	1792	Mlampmdo.exe	95
PID 1792 wrote to memory of 5100	1792	Mlampmdo.exe	95
PID 5100 wrote to memory of 4512	5100	Mmpijp32.exe	96
PID 5100 wrote to memory of 4512	5100	Mmpijp32.exe	96
PID 5100 wrote to memory of 4512	5100	Mmpijp32.exe	96
PID 4512 wrote to memory of 4900	4512	Migjoaaf.exe	97
PID 4512 wrote to memory of 4900	4512	Migjoaaf.exe	97
PID 4512 wrote to memory of 4900	4512	Migjoaaf.exe	97
PID 4900 wrote to memory of 4328	4900	Nljofl32.exe	98
PID 4900 wrote to memory of 4328	4900	Nljofl32.exe	98
PID 4900 wrote to memory of 4328	4900	Nljofl32.exe	98
PID 4328 wrote to memory of 3328	4328	Nnjlpo32.exe	99
PID 4328 wrote to memory of 3328	4328	Nnjlpo32.exe	99
PID 4328 wrote to memory of 3328	4328	Nnjlpo32.exe	99
PID 3328 wrote to memory of 4628	3328	Njqmepik.exe	100
PID 3328 wrote to memory of 4628	3328	Njqmepik.exe	100
PID 3328 wrote to memory of 4628	3328	Njqmepik.exe	100
PID 4628 wrote to memory of 4728	4628	Ngdmod32.exe	101
PID 4628 wrote to memory of 4728	4628	Ngdmod32.exe	101
PID 4628 wrote to memory of 4728	4628	Ngdmod32.exe	101
PID 4728 wrote to memory of 2964	4728	Njciko32.exe	102
PID 4728 wrote to memory of 2964	4728	Njciko32.exe	102
PID 4728 wrote to memory of 2964	4728	Njciko32.exe	102
PID 2964 wrote to memory of 3196	2964	Npmagine.exe	103
PID 2964 wrote to memory of 3196	2964	Npmagine.exe	103
PID 2964 wrote to memory of 3196	2964	Npmagine.exe	103
PID 3196 wrote to memory of 1492	3196	Nckndeni.exe	104
PID 3196 wrote to memory of 1492	3196	Nckndeni.exe	104
PID 3196 wrote to memory of 1492	3196	Nckndeni.exe	104
PID 1492 wrote to memory of 4472	1492	Njefqo32.exe	105
PID 1492 wrote to memory of 4472	1492	Njefqo32.exe	105
PID 1492 wrote to memory of 4472	1492	Njefqo32.exe	105
PID 4472 wrote to memory of 4228	4472	Olcbmj32.exe	106
PID 4472 wrote to memory of 4228	4472	Olcbmj32.exe	106
PID 4472 wrote to memory of 4228	4472	Olcbmj32.exe	106
PID 4228 wrote to memory of 3880	4228	Ocnjidkf.exe	107
PID 4228 wrote to memory of 3880	4228	Ocnjidkf.exe	107
PID 4228 wrote to memory of 3880	4228	Ocnjidkf.exe	107
PID 3880 wrote to memory of 3940	3880	Ojgbfocc.exe	108
PID 3880 wrote to memory of 3940	3880	Ojgbfocc.exe	108
PID 3880 wrote to memory of 3940	3880	Ojgbfocc.exe	108
PID 3940 wrote to memory of 2996	3940	Olfobjbg.exe	109

C:\Users\Admin\AppData\Local\Temp\955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe
"C:\Users\Admin\AppData\Local\Temp\955fee8968899810f6eb4ddfc7403468ce04ab34ac7b2774304f3ccb7d02d395.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\Kebbafoj.exe
  C:\Windows\system32\Kebbafoj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\Kbhoqj32.exe
    C:\Windows\system32\Kbhoqj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\SysWOW64\Kmncnb32.exe
      C:\Windows\system32\Kmncnb32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
      - C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        23⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        24⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        25⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        26⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        27⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        28⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        29⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1764
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        32⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        34⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        35⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        36⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3816
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        39⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        40⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4744
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        42⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        43⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        44⤵
        Executes dropped EXE
        
        PID:792
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3848
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        46⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        47⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        48⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        49⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        51⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        52⤵
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        53⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        54⤵
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        56⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        57⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        58⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        59⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        61⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        62⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        65⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        66⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2576
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        68⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        69⤵
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        70⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        71⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        72⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        73⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        74⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        75⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        76⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        77⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        78⤵
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        79⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        80⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        81⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        82⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        83⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        84⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        85⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        86⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        87⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        89⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        90⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        91⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        92⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        93⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        94⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        95⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        96⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        97⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        98⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        99⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        100⤵
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        101⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        102⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        103⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        104⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        107⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        108⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        109⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        111⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        112⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        113⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        114⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        115⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        116⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        117⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        118⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        119⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        120⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        121⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        122⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        123⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        124⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        125⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        126⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        127⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        128⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        130⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        131⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        132⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        134⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        135⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        136⤵
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        137⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        138⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        139⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        140⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        141⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        142⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        143⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        144⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        145⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        147⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        148⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5248
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        150⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1196
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        152⤵
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        153⤵
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        154⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        155⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        156⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        157⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        158⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        159⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        161⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        162⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        163⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        164⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        165⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        166⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        167⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        168⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        169⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        170⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        172⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        173⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        174⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        175⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        176⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        177⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        178⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        179⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        180⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        181⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        182⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        183⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        184⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        186⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        187⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        188⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        189⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        190⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        191⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        192⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        193⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        194⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        195⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        196⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        197⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        198⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        199⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        200⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        201⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        202⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        203⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2552
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        205⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        206⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        207⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        208⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        209⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        210⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        211⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        212⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        213⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        215⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        216⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        217⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        218⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        219⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        220⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        221⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        223⤵
        Drops file in System32 directory
        
        PID:7512
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        224⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        226⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        227⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        228⤵
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        229⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        230⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        231⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        232⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        233⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        234⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        235⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        236⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        237⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        238⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        240⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        241⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        242⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        244⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        246⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        247⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        248⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        249⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        250⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        251⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        252⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        253⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        254⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        255⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        257⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        258⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        259⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        260⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        261⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        262⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        263⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        264⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        265⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        266⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        267⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        268⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        270⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        271⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        273⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        274⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        275⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        276⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        277⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        278⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        279⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        280⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        281⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        282⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8780
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        285⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        286⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        287⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9004
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        289⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        290⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        291⤵
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        292⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        293⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        294⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        295⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8380
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        297⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        298⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        299⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        300⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8788
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        302⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        303⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        304⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        305⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        306⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        307⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        308⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        310⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        311⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        312⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        313⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        314⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        315⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        316⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        317⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        318⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        319⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        320⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        321⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        322⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        323⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        324⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        325⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        326⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8916
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        328⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        330⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        331⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        332⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        333⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        334⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        335⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        336⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        337⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        338⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        339⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        340⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        341⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        342⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        343⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        344⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        345⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        346⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        347⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        348⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        349⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        350⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        351⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        353⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        354⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        355⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        356⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        357⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        358⤵
        Modifies registry class
        
        PID:9324
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        359⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        360⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        361⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        362⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        363⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        364⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        365⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        366⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        367⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        368⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        369⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        370⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        371⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        372⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        373⤵
        Drops file in System32 directory
        
        PID:10232
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        374⤵
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        375⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        376⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        377⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        378⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        379⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        380⤵
        Drops file in System32 directory
        
        PID:9792
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        381⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        382⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        383⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        384⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        385⤵
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        386⤵
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        387⤵
        Modifies registry class
        
        PID:9576
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        388⤵
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        389⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        390⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        391⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        392⤵
        Modifies registry class
        
        PID:9420
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9728
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        394⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        395⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        396⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        397⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        398⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        399⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        400⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        401⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        402⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        403⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        404⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        405⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        406⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        407⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10528
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        408⤵
        Drops file in System32 directory
        
        PID:10572
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        409⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        410⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        411⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        412⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        413⤵
        Drops file in System32 directory
        
        PID:10792
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10832
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        415⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        416⤵
        Drops file in System32 directory
        
        PID:10920
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        417⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        418⤵
        Modifies registry class
        
        PID:11020
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        419⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        420⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        421⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        422⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        423⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        424⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        425⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        426⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        427⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10608
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10692
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        430⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        431⤵
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        432⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        433⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11060
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        435⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        436⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        437⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        438⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        439⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        440⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        441⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        442⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        443⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        444⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        445⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        446⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        447⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        448⤵
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        449⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        450⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        451⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        452⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        453⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        454⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        455⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        456⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        457⤵
        Drops file in System32 directory
        
        PID:11240
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        458⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        459⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        460⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        461⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        462⤵
        Drops file in System32 directory
        
        PID:4396
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        463⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        464⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        465⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4832
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3196
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        468⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        469⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        470⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        471⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        472⤵
        Modifies registry class
        
        PID:10864
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:524
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        474⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3328
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        476⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        477⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        478⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        479⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        480⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        481⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        482⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        483⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        484⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        485⤵
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        486⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        487⤵
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        488⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        489⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        490⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        491⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        493⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        494⤵
        Modifies registry class
        
        PID:11076
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        495⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        496⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        497⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        498⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        499⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        500⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        501⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        502⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        503⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        504⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        505⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        506⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        507⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        508⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        509⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        510⤵
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        511⤵
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        512⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        513⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        514⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        515⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        516⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        517⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        518⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        519⤵
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        520⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        521⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        522⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        523⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        524⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        525⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        526⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        527⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3732
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        529⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        530⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        531⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        532⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        533⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        534⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        535⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        536⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        537⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        538⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        539⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        540⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        541⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        542⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        543⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        544⤵
        Drops file in System32 directory
        
        PID:4564
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        545⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        546⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        547⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        548⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        549⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        550⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        551⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        552⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        553⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        554⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        555⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        556⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4912
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        558⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        559⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        560⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        561⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        562⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        563⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        564⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4640
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        565⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        566⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        567⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        568⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        569⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        570⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        571⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        572⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        573⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        574⤵
        
        PID:336
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        575⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        576⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        577⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        578⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        579⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        580⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        581⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        582⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        583⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        584⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        585⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        586⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        587⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        588⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        589⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        590⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        591⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        592⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        593⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        594⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        595⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        596⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        597⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        598⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        599⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        600⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        601⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        602⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        603⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        604⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        605⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        606⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        607⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        608⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        609⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        610⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        611⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        612⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        614⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        615⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        616⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        617⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        618⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        619⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        620⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        621⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        622⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        623⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        624⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        625⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        626⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        627⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        628⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        629⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        630⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        631⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        632⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        633⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        634⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        635⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        636⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        637⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        638⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        639⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        640⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        641⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        642⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        643⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        644⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        645⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        646⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        647⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        648⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        649⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        650⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        651⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        652⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        653⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        654⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        655⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        656⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        657⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        658⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        659⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        660⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        661⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        662⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        663⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        664⤵
        
        PID:908
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        665⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        666⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        667⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        668⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        669⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        670⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        671⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        672⤵
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        673⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        674⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        675⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        676⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        677⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        678⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        679⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        680⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        681⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        682⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        683⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        684⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        685⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        686⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        687⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        688⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        689⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        690⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        691⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        692⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        693⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        694⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        695⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        696⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        697⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        698⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        699⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        700⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        701⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        702⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        703⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        704⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        705⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        706⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        707⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        708⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        709⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        710⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        711⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        712⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        713⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        714⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        715⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:912
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        716⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        717⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        718⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7908
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        719⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        720⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        721⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        722⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        723⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        724⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        725⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        726⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        727⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        728⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        729⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        730⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        731⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        732⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        733⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        734⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        735⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        736⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        737⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        738⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        739⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        740⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        741⤵
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        742⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        743⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        744⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        745⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        746⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        747⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        748⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        749⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        750⤵
        Drops file in System32 directory
        
        PID:8628
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        751⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        752⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        753⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        754⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        755⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        756⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        757⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        758⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        759⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8584
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        760⤵
        Drops file in System32 directory
        
        PID:8336
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        761⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        762⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        763⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        764⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        765⤵
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        766⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        767⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        768⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        769⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        770⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        771⤵
        Drops file in System32 directory
        
        PID:9020
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        772⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        773⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        774⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        775⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        776⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        777⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        778⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 400
        779⤵
        Program crash
        
        PID:8680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4536 -ip 4536
1⤵
PID:8204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aakebqbj.exe

Path C:\Windows\SysWOW64\Aakebqbj.exe
Size 976KB
SHA256 661505ebeb293bf3b5c25f2920a58562f7108921c4766fb91c84ef19bd18016f
MD5 f1044a250290e8a29d370d042db9b5f1
SHA1 a81d2e3e2766e470121c5d1d0a89ec1416c5e381
SHA512 2832e661d49bf791f99133811a9c405366f7b1814f5241b2eb0b783f5ad9ee9d0146eb9f39e999ef6a829b2fb893b2962dbf4e39482bdf44a260e35d06e0bd8d
SSDEEP 12288:kn1ALNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:Q1ALNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ahqddk32.exe

Path C:\Windows\SysWOW64\Ahqddk32.exe
Size 976KB
SHA256 b944d48b6674e661f55c004cd233d5f07c8d9c969a1caf67fc1748dcba78c2fc
MD5 bfb9a7a0ebdecd14c91a72a3e42b7fa9
SHA1 cdde54dc970603c707b64ed23b8792b1021664be
SHA512 1f4e33b449a9c5898fb13d8378ded081e67b921d75d61c68de4b98b8d1356b37cbcc5712a47bc8c9e714c6caf440f9129521ad0f6ba7a8a2c33842be0f97cf8c
SSDEEP 12288:uUKggaNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:A4NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aopmfk32.exe

Path C:\Windows\SysWOW64\Aopmfk32.exe
Size 976KB
SHA256 4195b027b86eda992042192337adfdeadc2df0d78e963e3fee7578f1c6014a75
MD5 3e0e29f3986715ffb02ccec666d321df
SHA1 02d0449d94a5cbee0e571b14f52523d0088e0cd5
SHA512 56addef43f1d4ae7f49c08ef568c63ff558b8d2a1fdb93c831c63825340669647d1cbe98fb589bb557340f265e346f7f19bc8fcc70deadf86d095935a0548d21
SSDEEP 12288:VdNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:VdNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cgcmjd32.exe

Path C:\Windows\SysWOW64\Cgcmjd32.exe
Size 976KB
SHA256 9e80067267dc38d9c58ac5fa6dc03c75c6158dc8ebbe7e78b05b0508734bbeaa
MD5 1a55c5f1305548bbbc3c6eb8b1028f3c
SHA1 92325cfeab8546b27460ac8b1738a19db1a35835
SHA512 526cd310cf304b4a6e38275c668034c6495e43a260a4967ea396872d03f9d5f35fcdd96c9f0ca5fe377242379bba7884bed91a3701d8bb59dc2007e73e2e186e
SSDEEP 12288:CNQNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:EQNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjgpfk32.exe

Path C:\Windows\SysWOW64\Cjgpfk32.exe
Size 976KB
SHA256 5fa09e25c5d03f8f909605f89baaaa810341136f17986ebc03cc8ff218d8bf12
MD5 bb7137aae332c388d09069f1e3d292f7
SHA1 387a7a91c4c19fbd0f5ac0392268a40e469c0c0a
SHA512 2103e5ef285c2f3caa5ee831053ee47bf3363c41ae90ba09cea39e0a2cb3689d14843cffecb9e089af9cbb321e795cb05bf8c21afc0dc1335df737589a872672
SSDEEP 12288:5C5brNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:obrNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cofecami.exe

Path C:\Windows\SysWOW64\Cofecami.exe
Size 976KB
SHA256 e7c16a6e29f2c6fc20275894cd0416c3e824ed7b9b58c3129c973a503c0f3117
MD5 2d272ddd5645ed0189208e43b34f1e06
SHA1 0f750d3837d933ef66d6b86e5ef67108838bed19
SHA512 6b550b808daf86168a47c3e1b3803ddf167d7d813e9622ecaaa07fe8dbd7673ba0ea5a2274cac1b62b1912a2d5aa8ae58cdfeb8fa7be0ccda51ba1a6f9baa765
SSDEEP 12288:AdfNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:AJNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coiaiakf.exe

Path C:\Windows\SysWOW64\Coiaiakf.exe
Size 976KB
SHA256 db743bb1e6bb079515bf2e33211a746c082d0a36a659de331d6c2ceb972e2291
MD5 6a41794892d8486563097aed5a1b46b2
SHA1 18c3d8590538f413744222ca306b0abd8b9e27bd
SHA512 15ab532153bdd5474ffd75d9a8194f5a3eaf1c552cf07ad38783cfdb27943746e482f6cd9f2dd205b84d993dfa87c0b9063f0adf9b79e7025a47d28e04209bb3
SSDEEP 12288:gnF4NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:3NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dlghoa32.exe

Path C:\Windows\SysWOW64\Dlghoa32.exe
Size 976KB
SHA256 accfd17cba3975ca0a88a6499c193e1de534ad22114e17c75105e8771fbc012a
MD5 225950f2d9502d9fbb13b9d2dba4b1cb
SHA1 750a1107089a37c35e169f05428c3b7da2d3da3c
SHA512 451fdffc2fcdda376255c81fb7d48f392ac938f207bb156f435b85e8c0e90c9a301d231c32fefd1a49d651eb72878bbf23f7f52daf2cf84f919b11f32b8cff99
SSDEEP 12288:U36jNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:U2NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Efhlhh32.exe

Path C:\Windows\SysWOW64\Efhlhh32.exe
Size 976KB
SHA256 031e945ab6836ab05bf65fde1f21a8292134a9f4089c1c3a538b9abfd6cb9b53
MD5 681566f60825424cc214d38d39573d19
SHA1 9b8068f8d83ced622cbcd48306d6f219aa222b32
SHA512 fa1f362cf9f3d5d603caa7e8903b6fefb8141c6d836898881452d2f092d85df3af6d1199dfff372c702021bd12bdf5e1fdd42858ced153299b7d57d0f3d1ec84
SSDEEP 12288:upENIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:upENIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elpkep32.exe

Path C:\Windows\SysWOW64\Elpkep32.exe
Size 976KB
SHA256 054c826c09c44ce87518527f1ed6514a35bfcdceaf69b920f4c9023d74e5fe20
MD5 524217e5a16cb9c66d23c43f9bc6ce63
SHA1 e93583d7c45726d67666be74c7bb273d21f75506
SHA512 46808b399c05fd2443cf64eebcbe03e537971d0cfbe2f8fa8031f26d07ab657d54d0c415abd550addc7bf2ec970f374553cfe7d00b3c9ef77bf6c7457ee5d3f4
SSDEEP 12288:1UNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:1UNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emehdh32.exe

Path C:\Windows\SysWOW64\Emehdh32.exe
Size 976KB
SHA256 42cc050fa04048643f44e60de94dabda241b32f80d44bd1babbc192c68170d12
MD5 e5b8512f476095b116850354e0bab836
SHA1 92ec96b86366f03d81c3b57115f7e2cf3da2766e
SHA512 8d3477774a1631672818d1509ac742f1a2b5d25f50ff94c438a1083443dfdb1492b3f7120db7b9f8047b144db160952922ee42b91c2d73c98f57a91036688117
SSDEEP 12288:spNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:spNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gaadfkgc.exe

Path C:\Windows\SysWOW64\Gaadfkgc.exe
Size 976KB
SHA256 a693af86cc0a1b49685ed470f07783ffaf6516ca5bd2db92ee5ebda145dcfff9
MD5 58227775001dee9ec8c56de7f4afcd83
SHA1 ab5f8808115bb133ff77592a7ddc61e2af23ddf3
SHA512 c6eec3bb56509382ce737e4ee756bfe1c88b67422a099c2e621474b980333796efcfe40a6215701968eda2266b273dec7f40fca7ad919b0f30747ef123cc55f9
SSDEEP 12288:iGaNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:NaNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gahjgj32.exe

Path C:\Windows\SysWOW64\Gahjgj32.exe
Size 976KB
SHA256 73cd37ecf22db530510200a206118d127f0fa5edc2f3fc16b96b1700803fba71
MD5 94022173c26b0b2863584ebb90a5cd2d
SHA1 496e436130910699bed6c40e7bdc4574a797ac12
SHA512 56f8d773840fd627582af738bed188be25cbac16114947dceb84f6e1f09d528f205b5b6cb67df313193a7fa94e766f468f7c790d1b1402a50c0b473176993de5
SSDEEP 12288:KHvRxtNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:KHFNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gkmdecbg.exe

Path C:\Windows\SysWOW64\Gkmdecbg.exe
Size 976KB
SHA256 28e63c7c837f3d5beb97c52d7b26cf6c53ed4f3138a8f3496ff5d0fdbfa5218c
MD5 4a58ce36ebe04489a5db950895605e49
SHA1 efec8b3e09c8854317df8dde32799242a145d375
SHA512 850c8bd326cee10fa9368d4476d590aa6b68c671ce9bc003b297213d7cd32e56e5a6f5474a258b54ffde307cd7198a0a4c9ab302393ef7eb9c5f771d0b1beb5e
SSDEEP 12288:eUFmNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:eAmNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Glcaambb.exe

Path C:\Windows\SysWOW64\Glcaambb.exe
Size 976KB
SHA256 f9b82fed5b56a923789cc86208e37bc1ac49fe549bd91e2c3c56f87122079764
MD5 f18d09af463aabfba5a837cd448222ed
SHA1 94576fe46852fd3f3367fc891a73ab9ee3c6b615
SHA512 3401673749b253396fe97b78f2334edcbce5232bec8a55128852c59effa19f744bd066aad7f198f626b597f20f1e3cd240faee3cebf72349ddadeb27b861b9af
SSDEEP 12288:XeBrfNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:X4NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hofmfmhj.exe

Path C:\Windows\SysWOW64\Hofmfmhj.exe
Size 976KB
SHA256 091a3713b0124858229a76ac1460c5be375ee20c38b7f1785b8d8750f61fd8d7
MD5 d1b152458c5faa53e926c6248e6701f9
SHA1 2e646863513551de08017957e9521b749bc5c4a5
SHA512 fb7d9646fe549a286e1345cee9b9c7c103f05167446633de085fbe465f9fbe0120ebc96d6646ab6626a2aa9615a6405cbecae2e05aabcfce78cdc9c53833ec7d
SSDEEP 12288:qMA+4HsNNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:qMA+4KNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Igedlh32.exe

Path C:\Windows\SysWOW64\Igedlh32.exe
Size 976KB
SHA256 93f72a429baad8c5f2e315624b163df39d724160ee612aa685467c1f416a5cf4
MD5 8c73b3c890766f86a43c195fee672f7a
SHA1 de857e307717fa3c42701f75f9c828d4622ff67e
SHA512 27df9c6907e37b6771465cbc0ffdb89b6ee35d5fad9db08e63cae1154d57ee032e00aceccff1276e7c8a9c358b0412f37ee470d31992cfa4aec77118c2d082a4
SSDEEP 12288:IPaV7NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:eadNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jgdhgmep.exe

Path C:\Windows\SysWOW64\Jgdhgmep.exe
Size 976KB
SHA256 d5fc794d52566c2d85399717765a26c76c8f02f8cef5100e85022628be34a2d9
MD5 e57c91284ca8c3a61127f191f0dcf690
SHA1 f6670d068144ff0f68be49f3afb6096a3be1c177
SHA512 ee64f1461e37664f8d225a08270e59675e23aaf5b7cd8663cd00cf338e4eb09c61d1fbae669a99e0214fedd302cb95069d199ea7e8b752559ea204a16dc8c07f
SSDEEP 12288:dALzc1ukMNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:dyz5kMNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbhoqj32.exe

Path C:\Windows\SysWOW64\Kbhoqj32.exe
Size 976KB
SHA256 a353d47c8a3e41ce1ccf30ad81a4283cd6cc33096492f7def9906e31c4c678c5
MD5 52ae38c5beb2abeb128a86bca1ec025d
SHA1 1d679816b8181cb02ec626fb75a93d431883fc38
SHA512 6eb044a2215f20696497994f87bbf08b06f2b4c4fa5682ac64f4ab70f7755ad507882f7ac38f4cfa6fc6080a9d822f6a1a1f1b6a405b374da2b0c37a2b5a1ae0
SSDEEP 12288:PgVx1IRPNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:PMx1IBNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kebbafoj.exe

Path C:\Windows\SysWOW64\Kebbafoj.exe
Size 976KB
SHA256 b2e54b51696216d1c051ce85ca41b51141d39fe68ae5fce57118409f4790ca3d
MD5 8280f009eb5469c78f7aa89bc3ac640f
SHA1 b5c6d2a48aadb9b436d1ccc3e9e69f3c34765f68
SHA512 12b0b78d0cabb1e8a8e14462c51464b93725d1ed191f2e92696a52b85655b413c6d4f4ff2261630e94d63df9b764dc14334609c51bd416956dd5e91287b788a2
SSDEEP 12288:nV0ENIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:GENIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmncnb32.exe

Path C:\Windows\SysWOW64\Kmncnb32.exe
Size 976KB
SHA256 eb2729f0fa7e939df536efaeecdbafc4612846bfbf51f634c3ed5af8df95d1de
MD5 557a00480b0171eac5174ea297cd145e
SHA1 c294ef1a988236cbdbbd89dea4c85bfd177bd84d
SHA512 72f2c00ff67977da0c52b5815a3c9daec23bdfdc18e0fb6f66a8e1273514dba583506132cb7385744adc55131adc63ec372d31807c14935e4fd68136d418a252
SSDEEP 12288:sKgONIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:sKgONIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kniieo32.exe

Path C:\Windows\SysWOW64\Kniieo32.exe
Size 976KB
SHA256 0d9b436ccd82197e0e9e3ca70bc3df5f4d8e0fc75921e7e66e065ac11b6032a7
MD5 ec2c01d25ac281719cdcf91923232dd7
SHA1 fad40d4ccf174c1d800caa682fd51b0931284421
SHA512 39e2f33569cabcffb6c82e731aabdade0410a19c0d631f08afc73663cef9acd5803824ff10ae89dc9d4f0dde31b32e5e6300f9f7399b7359b65eb3c036603a9a
SSDEEP 12288:lNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:lNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kqphfe32.exe

Path C:\Windows\SysWOW64\Kqphfe32.exe
Size 976KB
SHA256 89a0961018214b4c2f21626860d2247fd10bb1ef77939f10671b1c1c0c613238
MD5 7d36db877c5becaa085894c55a80e998
SHA1 9de191bd78bed1e15eae497b76860b17917490d3
SHA512 a0a330c8df1e3648b1f249e26d83eac0c102055764e920368d0052f69648315786f07221f22324473915a9510e35f33616e2c730b2424a0f6fbae0bb5776b7cd
SSDEEP 12288:kg7MNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:9YNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lbdolh32.exe

Path C:\Windows\SysWOW64\Lbdolh32.exe
Size 976KB
SHA256 67f96041abe2b496acb6836b159e45099189e73702c24593b7c387cab67200b3
MD5 e682c96dadaf0ec987bfcf0b234a03da
SHA1 b02965ae20dc021df832e8fdf75eadea4d3bb8a4
SHA512 6289e8efa17263cc3ac76aea7b0a923c42ed9db12ccbefd7248eb6f4ab61686eb9bea4e63e582d6361d51c9e4138afc22b32b78bfc6c7c9f33c8870eda8a60d5
SSDEEP 12288:MgdVBNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:5nBNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lejgch32.exe

Path C:\Windows\SysWOW64\Lejgch32.exe
Size 976KB
SHA256 9d799952d1c9c43d5284155b527d644f9b0ca39feea86541ed15b796467de47c
MD5 90beb1cdeb440bc53e812fe4c4768c43
SHA1 a3488b174550f9e6dd416e6c10643312ba2acfa9
SHA512 f64af063dd254c3bc9db70f126d835e8ead999c19c90218e43edcbd317e7df4456c32d543d51d46e37f944c6153481c68db5db37723075451ac755f238a03fff
SSDEEP 12288:Lmzo3NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:6iNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lffhfh32.exe

Path C:\Windows\SysWOW64\Lffhfh32.exe
Size 976KB
SHA256 fadfd3b83b73de3284b0bd6a1ed407a12c1f039021e49b2cf0fcd60b5473ee2c
MD5 c878dee6989df4d7b4cb3e716cc94306
SHA1 868de34d5db34ae574f9306f6cfad7fff58ee01d
SHA512 ce72cbf6f2b2246eec62bf6a58c912541452075304e3840993f87f0098a028f71befd31a919b9a08c6dd3857d4ecb679fa0456a8ced7e5d16409bfc665f7ab65
SSDEEP 12288:LqxNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:LiNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmdina32.exe

Path C:\Windows\SysWOW64\Lmdina32.exe
Size 976KB
SHA256 e8efb995f08d2b5f09036634d92e1bd16c1545b26462f978cc3550947aacefd2
MD5 077ebd93bd4e3b276928a5bd93031fe6
SHA1 1b2e1b88c33e396bc92862e6895fdf3aa49927ec
SHA512 ee95abdd57251b505d5ae553969119c79f4fa222f9178f3d4a4c869405df1bbdb40b76cbec8740cb83d0f2283cfa5b54778e219583794121e5c4d3aaa397d091
SSDEEP 12288:OpNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:8NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpkiph32.exe

Path C:\Windows\SysWOW64\Lpkiph32.exe
Size 976KB
SHA256 5fa6bfbbcfc1bbe065c660e6c81e50438ac17d6565a11c3a693d76a1260180fd
MD5 47261479e535b5b568d442716c500fe9
SHA1 05c7a301739497d0802540446acb899228abe949
SHA512 5c6eccfeaf3426910b962fabc2b0cae6e73756cf01ae8aaa64a4faa5b7195063fc292752364316f0fe86e7587dd1a12a3017f40cc4fc42a9bcb4d00b1518f196
SSDEEP 12288:en0NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:zNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Migjoaaf.exe

Path C:\Windows\SysWOW64\Migjoaaf.exe
Size 976KB
SHA256 615530f93ab9328e1fc6d33faba9e6aa23797b63691e2ed3ae1b08d0a400701e
MD5 1f904bef83ec9d181457c6abde1ae356
SHA1 8164db840a18fe4f98d2ab87410f506bbc44badc
SHA512 dc36748e63348b26b061088ef9f01fc53e88981b5d00798ee3cc6b65cdd7fa5df34210859cc0731b519d9e54da81601fbf0efaf6e55620ca018d837d38b33692
SSDEEP 12288:eNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:eNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlampmdo.exe

Path C:\Windows\SysWOW64\Mlampmdo.exe
Size 976KB
SHA256 7320387896d9ba5c46f8b32c0449aa001d321682f749631a3999e8753e730f4f
MD5 2aa97c6ffcc16718c7586175eaaee4c0
SHA1 8d410d52202ab8e334f3fdd8e96afb394b7c4f24
SHA512 07b52125d2f25aaad2ea53ad06662725655b3808bc7bb6294f60e2aa6f09d2e7c0db2bc1ebbb5383b8ba73e9689d806108e0f64bf43d304c53c86fdf13f1440c
SSDEEP 12288:nQVNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:nMNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmpijp32.exe

Path C:\Windows\SysWOW64\Mmpijp32.exe
Size 976KB
SHA256 e35ba6e745023769f1c26fe3ffab64e4cf718842708a412dc1c7c1f8bc06e9e4
MD5 9c471df1aba478941846b73f5cda0aa0
SHA1 44ab1419748d3885356237429d2af18de3284cbf
SHA512 4b9d69b6aad2a502c451aa8e4b0bb62c05486d6d6be0a3578fde4b1094bd749c43f86ea4a1b2c7bcaa5bde8ccca5b66c6680dcb047ab0d853dcd43e35d93138c
SSDEEP 12288:5y7NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:Q7NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nacmdf32.exe

Path C:\Windows\SysWOW64\Nacmdf32.exe
Size 976KB
SHA256 7294c1d76b271128151776ce60d9ea8b321c9afe251ffde67288dbb9b237d3d1
MD5 64c4b84f971429f160e1cd6909e00db1
SHA1 b8988c89c6395f15f6e8943982bbe5eaac3b73ce
SHA512 a1405839dfaad3453107bd651772e694177e8fc38a1efc02c4361fc45f034c1cc632ae4f64132fb43947e120f571624359d918ff5434bc7de22784817391b504
SSDEEP 12288:Pa+gU0NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:srNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckndeni.exe

Path C:\Windows\SysWOW64\Nckndeni.exe
Size 976KB
SHA256 63ed9594aa2cc89050960f73b3fe70f1c7e743edc4565157b118ae7e9cc26128
MD5 07dbc89bf7eac7960c0715ebd3509511
SHA1 44d25b1373ffb14b5b21b3e3a56ae29b2e8a59eb
SHA512 3bad71f69d8dd0cc5c16f9a04d469be623dc3f406f165b5ca636423c1895f61fa2ed0e5507f8f832d6c53f9fe23229f16fe712e8fc178facc7a1d562045296a7
SSDEEP 12288:WNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:WNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngdmod32.exe

Path C:\Windows\SysWOW64\Ngdmod32.exe
Size 976KB
SHA256 aee3dc59efa7330331f61703252e3c97c4db0b4d5ee9bbbb686ea14aa147bcc8
MD5 3d849bf6e2ebab34138ca27a4cae1b28
SHA1 3f5066b7092660ee2233ab650ea44ecbdc656e00
SHA512 53d7cb0b7e67c127a22321ede242c55d27513b776b479340704e79bed8a63847a8781ffdd6f349b6a21cfbffe58c154ed92532923ebdc445386316091589c0b3
SSDEEP 12288:hnVDNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:hnVDNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njciko32.exe

Path C:\Windows\SysWOW64\Njciko32.exe
Size 976KB
SHA256 98b24710c453a1e8ed8c30ae57aa1c65f4be1b907f635679443e1051b0c874b6
MD5 63a9de6c5a4c60360299065268ddcdf0
SHA1 c2ad86590351cd1e9cd8e70171aa7cd8cfbaa835
SHA512 b8939cabbb92ce8f38891ec9d2753687283e7a8b0b7bbd4f1a6ded9dcee1d38c0041e001935999f4e3992ee96eb67852e1c60d74d1ea56d6714572c97ce7401d
SSDEEP 12288:5DiENIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:lTNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njefqo32.exe

Path C:\Windows\SysWOW64\Njefqo32.exe
Size 976KB
SHA256 9f7b56761ccc061951d30f071215479203a73472077fb919cb01fd9cb88e73b3
MD5 d58ece1ae3f74f48124b7eedc25343a1
SHA1 32a9ecd910e23601f7d1c8dd72110c0f816ae308
SHA512 3324f6061d77e467b254b36c64d7c48722ebd5722f19f5c0bb7850cb137854299662ebde2459a2f19b88c231a41584af643f2802966a276ee10bac6f5e50846f
SSDEEP 12288:DqfUaA097KNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:DFW7KNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njqmepik.exe

Path C:\Windows\SysWOW64\Njqmepik.exe
Size 976KB
SHA256 9e3ad38df7b2d2d1e35d82489539c50806e183c5d5cced10a5a3e961fb13719a
MD5 eeb8fac99e7db2fdc16796fdfbb2fe35
SHA1 8ff6a3fcff247477f3b2b3786338150f35575e88
SHA512 f1423c81948e6d23e22cea1d262ac5a2b484099499df3d68df5a3039c403b71519daeee2a68f71f20db875e99f3893f8d4cc0dae11747d26f5e1447ffba52c52
SSDEEP 12288:W1ArCaNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:W1iNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nljofl32.exe

Path C:\Windows\SysWOW64\Nljofl32.exe
Size 976KB
SHA256 21ada868ff1b594835ec2fef75142edbe2abf038c84584fa53c9dc200c29fb0e
MD5 add1b82ed8ab1dcce8d7106064dd1aca
SHA1 3f6b33bfeeace7daa9f2ca9b254c15e7b11d5465
SHA512 2460eb65fe924b011e8788dfb8507c02ddc7d01887a720636c3d4bd71ab8317ddf27cab9f2747fe2c53aeaa40d4f71a5d51a235887e87e24dc98c73d6c408281
SSDEEP 12288:rrNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:rrNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjlpo32.exe

Path C:\Windows\SysWOW64\Nnjlpo32.exe
Size 976KB
SHA256 77953ae0c7912c84f94fefd95e9c9269316efd2a1a21fee4a6b9e55fad7dc729
MD5 c28163b5ab105bad4a028814574f61ca
SHA1 045819493412c6fdf5481d941ebc4efe4e66eb3b
SHA512 89dadce4f977cbbc970bebea9cb61cbdfa2b343cbd7c6933b3ab391148c21c9178264c4d3129964c97683bb72bd0d11009cfbb1b031e2d522b3d28b322156fc8
SSDEEP 12288:9fBbNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:9JbNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npmagine.exe

Path C:\Windows\SysWOW64\Npmagine.exe
Size 976KB
SHA256 5c2d95e7e855fcf4b82cfb33fc2ccbf0f7d5c1e2d225665d14934397b6687797
MD5 a97e9437d273273c046b573329fec49c
SHA1 87740c960815a1004a498a70af84d96d576ae4dc
SHA512 0acd34995d4469fdffe725ec8f8b223396acdc2ec82dc08de0153b069713616b2e4606767c17699c3798e22d93dae37f02f71694aa992357b7254b5e84c1ba1c
SSDEEP 12288:12S/NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:h/NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocbddc32.exe

Path C:\Windows\SysWOW64\Ocbddc32.exe
Size 976KB
SHA256 f46d0f0238af53742a1ce17d849626980e30d830b1910e879b1fe0b0ecccec7a
MD5 7cdcf2221c4e23803709f7f4cba56b2e
SHA1 0246eacbda6b5392cc9672400b1b2bc6183782c4
SHA512 e72c385da7416746f31ff0eaab37b61aa5eb30e138da0c263b2e53187898eec68894185d062426902b89fe230ee317694d169b1383abdb36f732695fc08741d9
SSDEEP 12288:0tgoJrGNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:OGNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocnjidkf.exe

Path C:\Windows\SysWOW64\Ocnjidkf.exe
Size 976KB
SHA256 0bd9f45af0505d914d262904aedb3a4cbb161a6b8bb852901890f10c6c3d50d9
MD5 cd327ec2b923e6ebcc85f4632b454bb0
SHA1 78117730d6066eaef8887fac4621d30dd8bd926a
SHA512 08b0d9789a960c71ffbd544eede97d48bfa7c7ff3c9f466075a95166530b11e8f900a539b8594e186f8c894a4af449f6f2f3b368e8751979a0e92999d025d8a9
SSDEEP 12288:JNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:JNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogbipa32.exe

Path C:\Windows\SysWOW64\Ogbipa32.exe
Size 976KB
SHA256 07ead0590803a4dd779940b91904d18661e28502532a545fa6af0c046c3c4963
MD5 f4c00a771f33d42aaa9fcded6abe30af
SHA1 32043f3424d99e72a3fd65cb0f617de37eaf75d9
SHA512 8f333bd7b097789dad433722944762f69814155f8acb332bfb7e91230043d651bb826701281b3f2ecafc03d2481d15ea236c69bb05309f96d2209dad299e58ef
SSDEEP 12288:voNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:voNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogkcpbam.exe

Path C:\Windows\SysWOW64\Ogkcpbam.exe
Size 976KB
SHA256 60efd5b916b3c15cadaa304f968a67e08f09c24786dcab7c5a0724114dd87b0a
MD5 b3c7055cc698ae65ecb371f8574cf34e
SHA1 3b8d8111d9300b98a1a7c71f28a5d9c9954b54de
SHA512 84390aa813e58dc255ab9853fb68e932a24aca10782a11d305223ace75711f8cdd3ba61c05a4ab368e09abe09223dcdd20c594e8c33e4bc9bcb3b757ca97a0c5
SSDEEP 12288:q45NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:q+NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogpmjb32.exe

Path C:\Windows\SysWOW64\Ogpmjb32.exe
Size 976KB
SHA256 790499298929cda31c6877da9c8e309b6e4225d8b5297f0df130ebb32edefe78
MD5 59d6dd42a44e08739abcef57bf882c54
SHA1 d81cd0f670b2af7c19433886af2f9bf6f3962f90
SHA512 08108e284ff23b915fe567a24f6bdce111a0c9d3ba5c1772df1b6968386dfa430d2be4ba4cd480732bdd889f792cf4e7f33ad9fbe6023dfb74dcf45635152fff
SSDEEP 12288:gvNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:mNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojgbfocc.exe

Path C:\Windows\SysWOW64\Ojgbfocc.exe
Size 976KB
SHA256 a59f616a3d40c7162d88196497217bcce738dbabb84a5ab21fb6fc417e952069
MD5 5be3f8b29077042182d394d634ae807b
SHA1 46051b3cc232b25f7ca7fd3176e945fb8a0d7522
SHA512 79509a090e101e6a8f381f9660d17e4715e1347e14a70116a43db1bafb9c4129eab4dad5eba030fb854bd0c3114d7f98b97ee898b6d5f520615fd3672485ae3c
SSDEEP 12288:Mm8o4NNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:LWNNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oklkdi32.exe

Path C:\Windows\SysWOW64\Oklkdi32.exe
Size 976KB
SHA256 b2216145c7095c9ec2265ace9cb40629a053ea135958f76b24c515b240bccade
MD5 39c501544f2d8b8fc0be87a8b0636d1c
SHA1 ba7fcb90d70b28304e99e4f4021cb2de8e0d3dec
SHA512 ede4d34ff316b116bbd195fb407e1a553d8456ddfec624bf1b4aa404a0aff34e259eb51cc5fe0476ba05d208ff4392119958759de53d0c5ce2f3093320bab9f9
SSDEEP 12288:p26zuNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:kNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olcbmj32.exe

Path C:\Windows\SysWOW64\Olcbmj32.exe
Size 976KB
SHA256 574b68c08cc1a21e8699bc530677536606474697bb9282aaa82e64004a36dc25
MD5 560f016ed61293850851cb791337aaa6
SHA1 8ef9c08a30b7e5987ffab1754fab7ddfa0ce525d
SHA512 9334d644e604455c75c4e2e867decd8e733322ad22c9f33156dd98472d27fe7f6127cc887060c6d0a1909eb0ef65c2521336777a076cc55890ad55a5528833ec
SSDEEP 12288:ZB2WNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:DzNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olfobjbg.exe

Path C:\Windows\SysWOW64\Olfobjbg.exe
Size 976KB
SHA256 99f80ba6afbdbd8d2b3dbab9cd0613c0b4ae88bc33b966269c24ea8f21f7c60e
MD5 8053962f457b76c8e72ddd631aa6f4e9
SHA1 bdb74ad594b4006e10450e5b9e8396451cb7c023
SHA512 d8197045faa65aeb3234d8e08938a8a72f885990cc2f966ba014b3d37f219dd9182e0a2c603f9d78bdfa8a4d3497072d3321dd2d4971f0e8829fe485ed3e69d3
SSDEEP 12288:upapNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:8MNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oneklm32.exe

Path C:\Windows\SysWOW64\Oneklm32.exe
Size 976KB
SHA256 20381743cb0d133a6f0f84c4bdb1d8b30d89efc8844b1cbbc713b7061d6bc459
MD5 c02e7aaf4b152bc9bb8e0e0433425f50
SHA1 9004829302ccb6477db0a9e06ed3d5d69c36e611
SHA512 b72cf9bda17238b9a967e26543f58d2f52749706f6061f18da4aa5f4e65bce160d491f4e3a07cb9bdca251b23e64c752af80608791a9b1de0046c2fa47179c2e
SSDEEP 12288:mVNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:mVNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onhhamgg.exe

Path C:\Windows\SysWOW64\Onhhamgg.exe
Size 976KB
SHA256 d8d49924c7910b04b98510b397c2ca3cd69a9671adfff810f2e848a7d8eea29b
MD5 b29e20ddfbfdba809d03444a0acad9c0
SHA1 4986b32d348474171aaf0e71e2a7ce089c227b87
SHA512 633c1cad31f2793025e2599ab34ef0bc87cb86156dbff4365e95ca79d8a323427cef08ef8a158011674da69ef7baafca7227312c2d135fd2290284bdeb8ff421
SSDEEP 12288:PqlNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:eNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onjegled.exe

Path C:\Windows\SysWOW64\Onjegled.exe
Size 976KB
SHA256 41caa77a44fd3d1d98bdcb712ea629baaffe1f2657e52519e0fd5242bf643a89
MD5 7179043d64cb162623c5c057ae699a16
SHA1 8d458135daa9947b61d5f071a294abb35625d27b
SHA512 3720fe53d26c2c717beb256a79703318bcfd5c651c4f88c19958d61b43c28f9a570da84508a7ae6a995af23a201a9d88850aa95b928712873d36c617b587dd9f
SSDEEP 12288:ie34VNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:XIVNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqfdnhfk.exe

Path C:\Windows\SysWOW64\Oqfdnhfk.exe
Size 976KB
SHA256 0be4f93c20148d4170f4b42bae3be214211cd3bfbd147766fd6ff55aff2caa23
MD5 2b0da7c647d3e8df1cec84c779660953
SHA1 1aad3a0b91b886fab818aa5248ee897c22af89a0
SHA512 d6734870c0fc28e82d898425da0be8e7f6f37cc88b925500ab5939fc0c1718c8ff78c6dcc69ca7196cfa3929d97ea86fbc727cd2d652f30eb611edc4eee60dd1
SSDEEP 24576:9aGCk8kAk8k8kykykykeNIVyeNIVy2jU8NIVyeNIVy2jUO:wk8kAk8k8kykykykRyjAyjH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqhacgdh.exe

Path C:\Windows\SysWOW64\Oqhacgdh.exe
Size 976KB
SHA256 ac5edb25647ba4d64d0f5dd9e7a6c771b8dfaa71ea269d40bd8103757b0bd834
MD5 6c481fe1800face85e9b102fed1f618f
SHA1 cb5564bcfdd4ccb6daf246134ab435fb8e115ea6
SHA512 7a8a738e3be34b025ff6f33a9f7f4fe1f8e44eb14adb6a09306a22f3d81ef3334a260e7b0601fa7c1f8c22e752e9651527bd3d3d37ff95ff906aea3dae2e009f
SSDEEP 12288:bJ7nNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:pNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcijeb32.exe

Path C:\Windows\SysWOW64\Pcijeb32.exe
Size 976KB
SHA256 c55ec1220f38a5929e36f092305f859c7c64401520eee458d2b55f69679cefc5
MD5 a7458d830dff73dee0a3b8cf3f9a1e71
SHA1 b7659997df27efa070dbbfa9c33d46edb8d011e3
SHA512 7d74702fff8a5bccd439098d7a62fbb7a2cacc5bce06b134a4f5f83625a13af942135b781e53bec4f5259f9dc55eb908fd4d8bde0bb87e92a656568d493e9980
SSDEEP 12288:k6NIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:k6NIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmoahijl.exe

Path C:\Windows\SysWOW64\Pmoahijl.exe
Size 976KB
SHA256 2cc8930353497ea4e14f9cc8ed21b3b5a6068a20273a2c310ecd3ac52d157e53
MD5 80ff2056c8ee374272e87bd096ca933c
SHA1 1f2e2029a1d0ea24e22b0336469fc1a02de07ec8
SHA512 4f0379b94a15ade2a437f23a4ab8a1c2fbb047285c3c24f07daafff103a45c8e900971b63ec607060f8190097557b455234dde128617ac08d8037e841fff0ea8
SSDEEP 12288:lOHNIVyeNIVy2oIvPKiKCvPNIVyeNIVy2oIvPKiKO:UNIVyeNIVy2jU8NIVyeNIVy2jUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/792-554-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/904-549-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/932-570-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1240-569-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1328-41-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1328-959-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-550-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1428-564-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1476-26-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1476-945-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1492-528-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1628-571-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1664-538-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1764-540-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1792-985-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1792-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1840-534-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1884-560-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1892-542-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1932-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2244-558-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-5-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-81-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2328-546-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2392-552-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2572-572-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2740-536-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2964-526-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2996-533-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3116-563-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3148-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3148-919-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3196-527-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3240-562-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3328-523-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3516-18-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3516-944-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3532-539-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3596-535-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3816-548-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3848-555-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3880-531-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3920-958-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3920-32-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3940-532-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4000-556-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4088-541-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4216-568-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4228-530-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4328-94-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4372-544-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4444-567-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4464-543-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4472-529-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4508-537-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4512-73-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4512-1023-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4532-547-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4616-566-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4628-524-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4728-525-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4732-49-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4732-964-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4744-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4844-565-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4896-553-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4900-86-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4904-559-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4988-557-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5084-561-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5100-992-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5100-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads