60457f5624c0743e0d100c0328fedc6591b1cc229ecf87c55da81807d537c4b6

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0103af7ba56581d43568217157fd474d.exe
Size

128KB
MD5

0103af7ba56581d43568217157fd474d
SHA1

52c8408056f5b903b5e3717b6d0a88aa28e79f82
SHA256

60457f5624c0743e0d100c0328fedc6591b1cc229ecf87c55da81807d537c4b6
SHA512

a5034652e330c05f70ed48e2887e5fb400ddcce434b943a038887c7a770cfe01dbad00c267ea8693515cad81c49896d59e5bbfbe53c5e4be4a12785fbec09b34
SSDEEP

3072:cGZlccKgAOH9MQH2qC7ZQOlzSLUK6MwGsGnDc9nhViX:cGXfPH9MQWfdQOhwJ6MwGsy

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbonoghb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieoapl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpaacblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onbpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gacjadad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapgdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknnoofg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amfobp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijedehgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngaabfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkpool32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mejnlpai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nahdapae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjcjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eolhbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goedpofl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mablfnne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgfdgpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifihdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijpcbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokbgpeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqmicpbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhdeinhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dngobghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qamago32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igieoleg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdlhoefk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjqme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Folaiqng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olijhmgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplimi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdehlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgfdgpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jenmcggo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oadfkdgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haaaaeim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlicflic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjmmfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdagbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcecjmkl.exe

Executes dropped EXE 64 IoCs

pid	Process
4760	Jpnchp32.exe
4496	Jpppnp32.exe
3496	Kiidgeki.exe
384	Kbaipkbi.exe
740	Klimip32.exe
1740	Klljnp32.exe
2268	Kipkhdeq.exe
2080	Kpjcdn32.exe
3524	Kmncnb32.exe
4228	Kdgljmcd.exe
3764	Ldjhpl32.exe
3104	Ligqhc32.exe
1520	Lboeaifi.exe
3584	Lgmngglp.exe
2108	Lepncd32.exe
2532	Lljfpnjg.exe
804	Lbdolh32.exe
4968	Lllcen32.exe
4408	Mipcob32.exe
4576	Mpjlklok.exe
4140	Mgddhf32.exe
5020	Mmnldp32.exe
2392	Mdhdajea.exe
3432	Mlcifmbl.exe
2712	Mnebeogl.exe
2360	Nngokoej.exe
1032	Ndaggimg.exe
648	Nebdoa32.exe
2432	Ndcdmikd.exe
4536	Neeqea32.exe
2744	Ncianepl.exe
1828	Nlaegk32.exe
3528	Njefqo32.exe
2276	Odkjng32.exe
2556	Oflgep32.exe
2960	Ogkcpbam.exe
464	Pjcbbmif.exe
3664	Pqmjog32.exe
2144	Pmdkch32.exe
5112	Pjhlml32.exe
2728	Pdmpje32.exe
4224	Pjjhbl32.exe
3140	Pcbmka32.exe
4732	Qqfmde32.exe
3628	Qgqeappe.exe
3532	Qcgffqei.exe
4864	Ajanck32.exe
3848	Adgbpc32.exe
2672	Ageolo32.exe
4532	Daekdooc.exe
3648	Dddhpjof.exe
4204	Dgbdlf32.exe
3796	Dahhio32.exe
4332	Eecdjmfi.exe
4428	Egdqae32.exe
1588	Eolhbc32.exe
3608	Eefaomcg.exe
1656	Eggmge32.exe
2444	Eonehbjg.exe
3184	Edknqiho.exe
5128	Eopbnbhd.exe
5172	Eaonjngh.exe
5208	Edmjfifl.exe
5248	Eobocb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nfdjaieh.dll	Ilmmni32.exe
File created	C:\Windows\SysWOW64\Lnmkfh32.exe	Lknojl32.exe
File created	C:\Windows\SysWOW64\Ofblbapl.dll	Fkhpfbce.exe
File opened for modification	C:\Windows\SysWOW64\Ihjafd32.exe	Igieoleg.exe
File opened for modification	C:\Windows\SysWOW64\Ghhhcomg.exe	Gpaqbbld.exe
File opened for modification	C:\Windows\SysWOW64\Dddllkbf.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Ljclki32.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Cgfmol32.dll	Kpgoolbl.exe
File opened for modification	C:\Windows\SysWOW64\Dgpeha32.exe	Ccdihbgg.exe
File opened for modification	C:\Windows\SysWOW64\Eopbnbhd.exe	Edknqiho.exe
File opened for modification	C:\Windows\SysWOW64\Epagkd32.exe	Embkoi32.exe
File created	C:\Windows\SysWOW64\Fkpool32.exe	Fdffbake.exe
File created	C:\Windows\SysWOW64\Eieijp32.dll	Jghpbk32.exe
File created	C:\Windows\SysWOW64\Mfqlfb32.exe	Mnegbp32.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Coegoe32.exe
File opened for modification	C:\Windows\SysWOW64\Qjhbfd32.exe	Qbajeg32.exe
File created	C:\Windows\SysWOW64\Bmnjkq32.dll	Fjoadbbc.exe
File opened for modification	C:\Windows\SysWOW64\Klljnp32.exe	Klimip32.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Eiekog32.exe
File created	C:\Windows\SysWOW64\Ngemjg32.exe	Ndfanlpi.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Lgpjggdi.dll	Gaogak32.exe
File opened for modification	C:\Windows\SysWOW64\Gacjadad.exe	Ghhhcomg.exe
File created	C:\Windows\SysWOW64\Aaenbd32.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Bkgppbgc.dll	Lljdai32.exe
File opened for modification	C:\Windows\SysWOW64\Gpnoigpe.exe	Gmnfglcd.exe
File created	C:\Windows\SysWOW64\Nebdoa32.exe	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Mjnnbk32.exe	Mcaipa32.exe
File created	C:\Windows\SysWOW64\Nhbfff32.exe	Goedpofl.exe
File opened for modification	C:\Windows\SysWOW64\Lknojl32.exe	Lddgmbpb.exe
File created	C:\Windows\SysWOW64\Mkfefigf.dll	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Fkmjaa32.exe	Finnef32.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpla32.exe	Epagkd32.exe
File created	C:\Windows\SysWOW64\Bpemfc32.dll	Laiipofp.exe
File opened for modification	C:\Windows\SysWOW64\Lfnmcnjn.exe	Lpdefc32.exe
File opened for modification	C:\Windows\SysWOW64\Dabhdinj.exe	Bclang32.exe
File created	C:\Windows\SysWOW64\Gejqna32.dll	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Pfccogfc.exe
File opened for modification	C:\Windows\SysWOW64\Aadghn32.exe	Afockelf.exe
File created	C:\Windows\SysWOW64\Lcnhho32.dll	Oflgep32.exe
File created	C:\Windows\SysWOW64\Eiildjag.exe	Ehhpla32.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Qpbnhl32.exe	Qbonoghb.exe
File created	C:\Windows\SysWOW64\Jdnoeb32.dll	Acqgojmb.exe
File opened for modification	C:\Windows\SysWOW64\Baepolni.exe	Bkkhbb32.exe
File created	C:\Windows\SysWOW64\Knenffqf.exe	Khifno32.exe
File created	C:\Windows\SysWOW64\Anfimpdb.dll	Ifihdi32.exe
File created	C:\Windows\SysWOW64\Ignnjk32.exe	Icbbimih.exe
File created	C:\Windows\SysWOW64\Dqpfmlce.exe	Doojec32.exe
File opened for modification	C:\Windows\SysWOW64\Kplijk32.exe	Kiaqnagj.exe
File created	C:\Windows\SysWOW64\Lqdcio32.exe	Lhiodm32.exe
File created	C:\Windows\SysWOW64\Ljeafb32.exe	Lcimdh32.exe
File opened for modification	C:\Windows\SysWOW64\Ihagfb32.exe	Idfkednq.exe
File opened for modification	C:\Windows\SysWOW64\Gpaqbbld.exe	Gkdhjknm.exe
File opened for modification	C:\Windows\SysWOW64\Phincl32.exe	Phganm32.exe
File created	C:\Windows\SysWOW64\Mcecjmkl.exe	Maggnali.exe
File created	C:\Windows\SysWOW64\Kmmfbg32.dll	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Ikbphn32.exe	Idhgkcln.exe
File opened for modification	C:\Windows\SysWOW64\Mjodla32.exe	Mfqlfb32.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Ppolhcnm.exe
File opened for modification	C:\Windows\SysWOW64\Gpolbo32.exe	Gghdaa32.exe
File created	C:\Windows\SysWOW64\Hahnld32.dll	Cfljnejl.exe
File created	C:\Windows\SysWOW64\Fmipfknd.dll	Nhicoi32.exe
File opened for modification	C:\Windows\SysWOW64\Lgmngglp.exe	Lboeaifi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5276	6024	WerFault.exe	696

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplmmdoj.dll"	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijedehgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmdlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdnjja32.dll"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nehjmnei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnojcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ablmdkdf.dll"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipgdi32.dll"	Galoohke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpgghoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jenmcggo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinclj32.dll"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmklnk32.dll"	Hfajlp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knenffqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olijhmgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbfoaba.dll"	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Momcpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdpfkn32.dll"	Eecdjmfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnjmilq.dll"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfiji32.dll"	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknjec32.dll"	Kofdhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Podbibma.dll"	Biiobo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eaonjngh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pllgnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ignnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efjecajf.dll"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocaikjof.dll"	Hkpheidp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oadfkdgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aldjigql.dll"	Cmpjoloh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdkpma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkjnfkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgpldd32.dll"	Lpmmhpgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnkggfkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpdjbapj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iehjdl32.dll"	Lddgmbpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hihibbjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dimcppgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enndkpea.dll"	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Ofkgcobj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icpecm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbokknag.dll"	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phincl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bafehe32.dll"	Mmpdhboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdmjlm32.dll"	Mackfa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4760	1976	0103af7ba56581d43568217157fd474d.exe	94
PID 1976 wrote to memory of 4760	1976	0103af7ba56581d43568217157fd474d.exe	94
PID 1976 wrote to memory of 4760	1976	0103af7ba56581d43568217157fd474d.exe	94
PID 4760 wrote to memory of 4496	4760	Jpnchp32.exe	95
PID 4760 wrote to memory of 4496	4760	Jpnchp32.exe	95
PID 4760 wrote to memory of 4496	4760	Jpnchp32.exe	95
PID 4496 wrote to memory of 3496	4496	Jpppnp32.exe	96
PID 4496 wrote to memory of 3496	4496	Jpppnp32.exe	96
PID 4496 wrote to memory of 3496	4496	Jpppnp32.exe	96
PID 3496 wrote to memory of 384	3496	Kiidgeki.exe	97
PID 3496 wrote to memory of 384	3496	Kiidgeki.exe	97
PID 3496 wrote to memory of 384	3496	Kiidgeki.exe	97
PID 384 wrote to memory of 740	384	Kbaipkbi.exe	98
PID 384 wrote to memory of 740	384	Kbaipkbi.exe	98
PID 384 wrote to memory of 740	384	Kbaipkbi.exe	98
PID 740 wrote to memory of 1740	740	Klimip32.exe	99
PID 740 wrote to memory of 1740	740	Klimip32.exe	99
PID 740 wrote to memory of 1740	740	Klimip32.exe	99
PID 1740 wrote to memory of 2268	1740	Klljnp32.exe	101
PID 1740 wrote to memory of 2268	1740	Klljnp32.exe	101
PID 1740 wrote to memory of 2268	1740	Klljnp32.exe	101
PID 2268 wrote to memory of 2080	2268	Kipkhdeq.exe	102
PID 2268 wrote to memory of 2080	2268	Kipkhdeq.exe	102
PID 2268 wrote to memory of 2080	2268	Kipkhdeq.exe	102
PID 2080 wrote to memory of 3524	2080	Kpjcdn32.exe	103
PID 2080 wrote to memory of 3524	2080	Kpjcdn32.exe	103
PID 2080 wrote to memory of 3524	2080	Kpjcdn32.exe	103
PID 3524 wrote to memory of 4228	3524	Kmncnb32.exe	104
PID 3524 wrote to memory of 4228	3524	Kmncnb32.exe	104
PID 3524 wrote to memory of 4228	3524	Kmncnb32.exe	104
PID 4228 wrote to memory of 3764	4228	Kdgljmcd.exe	105
PID 4228 wrote to memory of 3764	4228	Kdgljmcd.exe	105
PID 4228 wrote to memory of 3764	4228	Kdgljmcd.exe	105
PID 3764 wrote to memory of 3104	3764	Ldjhpl32.exe	106
PID 3764 wrote to memory of 3104	3764	Ldjhpl32.exe	106
PID 3764 wrote to memory of 3104	3764	Ldjhpl32.exe	106
PID 3104 wrote to memory of 1520	3104	Ligqhc32.exe	107
PID 3104 wrote to memory of 1520	3104	Ligqhc32.exe	107
PID 3104 wrote to memory of 1520	3104	Ligqhc32.exe	107
PID 1520 wrote to memory of 3584	1520	Lboeaifi.exe	108
PID 1520 wrote to memory of 3584	1520	Lboeaifi.exe	108
PID 1520 wrote to memory of 3584	1520	Lboeaifi.exe	108
PID 3584 wrote to memory of 2108	3584	Lgmngglp.exe	109
PID 3584 wrote to memory of 2108	3584	Lgmngglp.exe	109
PID 3584 wrote to memory of 2108	3584	Lgmngglp.exe	109
PID 2108 wrote to memory of 2532	2108	Lepncd32.exe	110
PID 2108 wrote to memory of 2532	2108	Lepncd32.exe	110
PID 2108 wrote to memory of 2532	2108	Lepncd32.exe	110
PID 2532 wrote to memory of 804	2532	Lljfpnjg.exe	111
PID 2532 wrote to memory of 804	2532	Lljfpnjg.exe	111
PID 2532 wrote to memory of 804	2532	Lljfpnjg.exe	111
PID 804 wrote to memory of 4968	804	Lbdolh32.exe	112
PID 804 wrote to memory of 4968	804	Lbdolh32.exe	112
PID 804 wrote to memory of 4968	804	Lbdolh32.exe	112
PID 4968 wrote to memory of 4408	4968	Lllcen32.exe	113
PID 4968 wrote to memory of 4408	4968	Lllcen32.exe	113
PID 4968 wrote to memory of 4408	4968	Lllcen32.exe	113
PID 4408 wrote to memory of 4576	4408	Mipcob32.exe	114
PID 4408 wrote to memory of 4576	4408	Mipcob32.exe	114
PID 4408 wrote to memory of 4576	4408	Mipcob32.exe	114
PID 4576 wrote to memory of 4140	4576	Mpjlklok.exe	115
PID 4576 wrote to memory of 4140	4576	Mpjlklok.exe	115
PID 4576 wrote to memory of 4140	4576	Mpjlklok.exe	115
PID 4140 wrote to memory of 5020	4140	Mgddhf32.exe	116

C:\Users\Admin\AppData\Local\Temp\0103af7ba56581d43568217157fd474d.exe
"C:\Users\Admin\AppData\Local\Temp\0103af7ba56581d43568217157fd474d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\Jpnchp32.exe
  C:\Windows\system32\Jpnchp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\Jpppnp32.exe
    C:\Windows\system32\Jpppnp32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\SysWOW64\Kiidgeki.exe
      C:\Windows\system32\Kiidgeki.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:384
      - C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        23⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        24⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        25⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        26⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        27⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1032
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        29⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        30⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        31⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        33⤵
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        34⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        35⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        37⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        39⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        40⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        41⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        42⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        43⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        44⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        45⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        46⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        47⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        48⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        49⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        50⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        51⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        52⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        53⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        54⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        56⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        58⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        59⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        60⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3184
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        62⤵
        Executes dropped EXE
        
        PID:5128
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        64⤵
        Executes dropped EXE
        
        PID:5208
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        65⤵
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        66⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        67⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        69⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        70⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        71⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        74⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        77⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        78⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        79⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        80⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        81⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        82⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        83⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        84⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        85⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        86⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        87⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        88⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        89⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        90⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        91⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        92⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        93⤵
        Drops file in System32 directory
        
        PID:1236
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        96⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        97⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        98⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        99⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        100⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        101⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        102⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        103⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        104⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        105⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1408
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        108⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        109⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        110⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        111⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        112⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        114⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        115⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        116⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        118⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        119⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        120⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        121⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        122⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        123⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        124⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        125⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        126⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        127⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        128⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        129⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        130⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        131⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        132⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        135⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        136⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        137⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        138⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        139⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        140⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6204
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        142⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        144⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        145⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        146⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        147⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6956
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        149⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        150⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        152⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        153⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        154⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        155⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1100
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        157⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        158⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        159⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        160⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        161⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        162⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        163⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        164⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        165⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:736
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        168⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        169⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        170⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        171⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        172⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        173⤵
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        174⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        175⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2600
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        177⤵
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        178⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        180⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        181⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        183⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        184⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        185⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        186⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        187⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        188⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        189⤵
        
        PID:648
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        190⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1104
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        192⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        193⤵
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        194⤵
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        195⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        196⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        197⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        198⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        199⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        200⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        201⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        202⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        203⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        204⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        205⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        206⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        207⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        208⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        209⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        210⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        211⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        212⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        213⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        214⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3848
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        216⤵
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        219⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        220⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        221⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        222⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        223⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2108
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        225⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        226⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        227⤵
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        228⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        229⤵
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        230⤵
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        232⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        233⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        234⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        235⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        236⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        237⤵
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        238⤵
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4580
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        240⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        241⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        242⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        243⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        244⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        245⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        246⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        247⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        248⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        249⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        250⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        251⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        252⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        253⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        254⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        255⤵
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        256⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        257⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        258⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        261⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        262⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        263⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        264⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        265⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        266⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        267⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        268⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        269⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        270⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        271⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        272⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        273⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        274⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        275⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7932
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        277⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        278⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        279⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        281⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        282⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        283⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        284⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        285⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        286⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        287⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        288⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        289⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        290⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        292⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        294⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        295⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        296⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        297⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        299⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        300⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        301⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        302⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        303⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        304⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        305⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        306⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        307⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        308⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        310⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        311⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        312⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        313⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        314⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        315⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        316⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        317⤵
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        318⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        319⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        320⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        321⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        322⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        323⤵
        Modifies registry class
        
        PID:4740
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        325⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        326⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        327⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        328⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        329⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        330⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        331⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        332⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        333⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        334⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        335⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        336⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        337⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        338⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        339⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        340⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        341⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        342⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        343⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        344⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        346⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        347⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        348⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        349⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        351⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        352⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        353⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        354⤵
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        355⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        356⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        357⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        358⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3116
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        360⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        361⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        362⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        363⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        364⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        365⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        366⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        367⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        368⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        369⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        370⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        371⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        372⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        373⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        374⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        375⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4548
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        377⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        378⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        379⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        380⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        381⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        382⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        383⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        384⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        385⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        386⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        387⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        388⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        389⤵
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        390⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        391⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        392⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        393⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        394⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        395⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8960
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        398⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        399⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        400⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        402⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        403⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        404⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        405⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        406⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        407⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        408⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        409⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        410⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        411⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        412⤵
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8688
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        414⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        415⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        416⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        417⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        418⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        419⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        421⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        422⤵
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        423⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        424⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8296
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        425⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        427⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        428⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        429⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Jmpgghoo.exe
        
        C:\Windows\system32\Jmpgghoo.exe
        430⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        431⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Mejnlpai.exe
        
        C:\Windows\system32\Mejnlpai.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        433⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Mgkjch32.exe
        
        C:\Windows\system32\Mgkjch32.exe
        434⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4416
        
        C:\Windows\SysWOW64\Mobbdf32.exe
        
        C:\Windows\system32\Mobbdf32.exe
        436⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Meljappg.exe
        
        C:\Windows\system32\Meljappg.exe
        437⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        438⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        439⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8468
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        441⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mmjlkb32.exe
        
        C:\Windows\system32\Mmjlkb32.exe
        442⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Meadlo32.exe
        
        C:\Windows\system32\Meadlo32.exe
        443⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        444⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        445⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        446⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        448⤵
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        449⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        450⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        451⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Nehjmnei.exe
        
        C:\Windows\system32\Nehjmnei.exe
        452⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        453⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Nhicoi32.exe
        
        C:\Windows\system32\Nhicoi32.exe
        454⤵
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        455⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        456⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        457⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        458⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        459⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        462⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        463⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        464⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        465⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        468⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Iobmmoed.exe
        
        C:\Windows\system32\Iobmmoed.exe
        469⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        471⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        472⤵
        
        PID:788
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        473⤵
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        474⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        475⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        476⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        477⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        478⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Igpkok32.exe
        
        C:\Windows\system32\Igpkok32.exe
        479⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ifckkhfi.exe
        
        C:\Windows\system32\Ifckkhfi.exe
        480⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        481⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        482⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        483⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        485⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        486⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        487⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Jqofippg.exe
        
        C:\Windows\system32\Jqofippg.exe
        488⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Jginej32.exe
        
        C:\Windows\system32\Jginej32.exe
        489⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Jjhjae32.exe
        
        C:\Windows\system32\Jjhjae32.exe
        490⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        491⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        492⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        493⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        494⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        495⤵
        Drops file in System32 directory
        
        PID:4692
        
        C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        496⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        497⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        498⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        499⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        500⤵
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        501⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        502⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        503⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        504⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Lfjchn32.exe
        
        C:\Windows\system32\Lfjchn32.exe
        505⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Lobhqdec.exe
        
        C:\Windows\system32\Lobhqdec.exe
        506⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Lijlii32.exe
        
        C:\Windows\system32\Lijlii32.exe
        507⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        508⤵
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        509⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        510⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ieoapl32.exe
        
        C:\Windows\system32\Ieoapl32.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Bjgifhep.exe
        
        C:\Windows\system32\Bjgifhep.exe
        512⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Bpaacblm.exe
        
        C:\Windows\system32\Bpaacblm.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Fmkqknci.exe
        
        C:\Windows\system32\Fmkqknci.exe
        514⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        515⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Fjoadbbc.exe
        
        C:\Windows\system32\Fjoadbbc.exe
        516⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7960
        
        C:\Windows\SysWOW64\Fpnfbi32.exe
        
        C:\Windows\system32\Fpnfbi32.exe
        518⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Fgencf32.exe
        
        C:\Windows\system32\Fgencf32.exe
        519⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Fjcjpb32.exe
        
        C:\Windows\system32\Fjcjpb32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Fmdcamko.exe
        
        C:\Windows\system32\Fmdcamko.exe
        521⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Gfmhjb32.exe
        
        C:\Windows\system32\Gfmhjb32.exe
        522⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Gmfpgmil.exe
        
        C:\Windows\system32\Gmfpgmil.exe
        523⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ggldde32.exe
        
        C:\Windows\system32\Ggldde32.exe
        524⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        525⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Gjmmfq32.exe
        
        C:\Windows\system32\Gjmmfq32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5136
        
        C:\Windows\SysWOW64\Gmkibl32.exe
        
        C:\Windows\system32\Gmkibl32.exe
        527⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ghanoeel.exe
        
        C:\Windows\system32\Ghanoeel.exe
        528⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Gjojkpdp.exe
        
        C:\Windows\system32\Gjojkpdp.exe
        529⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gmnfglcd.exe
        
        C:\Windows\system32\Gmnfglcd.exe
        530⤵
        Drops file in System32 directory
        
        PID:1412
        
        C:\Windows\SysWOW64\Gpnoigpe.exe
        
        C:\Windows\system32\Gpnoigpe.exe
        531⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Hfhgfaha.exe
        
        C:\Windows\system32\Hfhgfaha.exe
        532⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Hdlhoefk.exe
        
        C:\Windows\system32\Hdlhoefk.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Hmdlhk32.exe
        
        C:\Windows\system32\Hmdlhk32.exe
        534⤵
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Hpchdf32.exe
        
        C:\Windows\system32\Hpchdf32.exe
        535⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hhjqec32.exe
        
        C:\Windows\system32\Hhjqec32.exe
        536⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Hjimaole.exe
        
        C:\Windows\system32\Hjimaole.exe
        537⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Hhmmkcko.exe
        
        C:\Windows\system32\Hhmmkcko.exe
        538⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        539⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hfajlp32.exe
        
        C:\Windows\system32\Hfajlp32.exe
        540⤵
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Idfkednq.exe
        
        C:\Windows\system32\Idfkednq.exe
        541⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Ihagfb32.exe
        
        C:\Windows\system32\Ihagfb32.exe
        542⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ijpcbn32.exe
        
        C:\Windows\system32\Ijpcbn32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Iajkohmj.exe
        
        C:\Windows\system32\Iajkohmj.exe
        544⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        545⤵
        Drops file in System32 directory
        
        PID:2392
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        546⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Impldi32.exe
        
        C:\Windows\system32\Impldi32.exe
        547⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ipohpdbb.exe
        
        C:\Windows\system32\Ipohpdbb.exe
        548⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        549⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Iandjg32.exe
        
        C:\Windows\system32\Iandjg32.exe
        550⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Ihhmgaqb.exe
        
        C:\Windows\system32\Ihhmgaqb.exe
        551⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Iobecl32.exe
        
        C:\Windows\system32\Iobecl32.exe
        552⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Idonlbff.exe
        
        C:\Windows\system32\Idonlbff.exe
        553⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Ikifhm32.exe
        
        C:\Windows\system32\Ikifhm32.exe
        554⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jacnegep.exe
        
        C:\Windows\system32\Jacnegep.exe
        555⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Jognokdi.exe
        
        C:\Windows\system32\Jognokdi.exe
        556⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Jaekkfcm.exe
        
        C:\Windows\system32\Jaekkfcm.exe
        557⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        558⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Jknocljn.exe
        
        C:\Windows\system32\Jknocljn.exe
        559⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        560⤵
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Jajdff32.exe
        
        C:\Windows\system32\Jajdff32.exe
        561⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Jkeedk32.exe
        
        C:\Windows\system32\Jkeedk32.exe
        562⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        563⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Khifno32.exe
        
        C:\Windows\system32\Khifno32.exe
        564⤵
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Knenffqf.exe
        
        C:\Windows\system32\Knenffqf.exe
        565⤵
        Modifies registry class
        
        PID:6392
        
        C:\Windows\SysWOW64\Kpdjbapj.exe
        
        C:\Windows\system32\Kpdjbapj.exe
        566⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Koekpi32.exe
        
        C:\Windows\system32\Koekpi32.exe
        567⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        568⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        570⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        571⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ldkfno32.exe
        
        C:\Windows\system32\Ldkfno32.exe
        572⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Lgibjj32.exe
        
        C:\Windows\system32\Lgibjj32.exe
        573⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        574⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Lhiodm32.exe
        
        C:\Windows\system32\Lhiodm32.exe
        575⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        576⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        577⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Ldblon32.exe
        
        C:\Windows\system32\Ldblon32.exe
        578⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Lgqhki32.exe
        
        C:\Windows\system32\Lgqhki32.exe
        579⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        580⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        581⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        582⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Mhenpk32.exe
        
        C:\Windows\system32\Mhenpk32.exe
        583⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Mdloelpc.exe
        
        C:\Windows\system32\Mdloelpc.exe
        584⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Nkjqme32.exe
        
        C:\Windows\system32\Nkjqme32.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        586⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Ngaabfio.exe
        
        C:\Windows\system32\Ngaabfio.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        588⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Nbibeo32.exe
        
        C:\Windows\system32\Nbibeo32.exe
        589⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Nicjaino.exe
        
        C:\Windows\system32\Nicjaino.exe
        590⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Nnpcjplf.exe
        
        C:\Windows\system32\Nnpcjplf.exe
        591⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Oghgbe32.exe
        
        C:\Windows\system32\Oghgbe32.exe
        592⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Onbpop32.exe
        
        C:\Windows\system32\Onbpop32.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        594⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 404
        595⤵
        Program crash
        
        PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:7784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6024 -ip 6024
1⤵
PID:8424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afghneoo.exe

Filesize
128KB

MD5
4aa0ce4e82dfcd3e02cec4ca3b7de693

SHA1
d0afefcf8c9ee88882f33cbbb76e68abbab90ee8

SHA256
9e111ea682d7b2ff0af9d208fc90cd2ef740292aeb1ba04332206798dd7be95a

SHA512
1d3bec4846b2307006be02dcdb9b316085a5aa47bfaf5327447655e65e629efe87e4f2bdbce1936ab93bba223fadec3f77f02fcc3239195e11a635f6e57756ff

Download Submit
C:\Windows\SysWOW64\Aibibp32.exe

Filesize
128KB

MD5
3963dc291aa66422f59ec83c0f651672

SHA1
18c4a83d78b1c75be70e60b803275470ed471261

SHA256
be8d2014db9f9eadccc541b9736a490f8d979d3efc349005cb93b635b6fa4731

SHA512
93c3fe500563f831464d561f0223fe86c244638a6cefb0b03ec8ec3d1eb707a6fc25b81f0a58151cfbe50c1631cac2ad9d4fa70f512a804fabd26211f41a9268

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
128KB

MD5
509df283a59153bea0f4c9ea599e07b2

SHA1
2f9e14cdf08a0504094119aa6cb23207f58e0cc4

SHA256
d3415f3547ab93654d98669a4efbe86d09c37967f9e8edda9080c47fb9f0a7a4

SHA512
e1efaaab1733a007af45e26c1cc1157f723ae8801f26e9ed47150d7f92aec4602507306af69d558def79a54d3051702649433fb8f5314b1028116bed02d544cd

Download Submit
C:\Windows\SysWOW64\Bagmdllg.exe

Filesize
128KB

MD5
a59f696eaa8d63de8354dcfb67c53a61

SHA1
48279323a341a8bd3391456f78b901f54dc65460

SHA256
b9e4261a71a9ab04997ded33910a0d028ba24dddc70782fc9b852528b8e2c070

SHA512
bc0875a3b418adf07346d8d629ed7a7d0cda8205d014593ecf72514e5054416c27718d41dbdf32b8de0ba2a45babb611809b3b138a8c577eb5a88b8aaa75b9bb

Download Submit
C:\Windows\SysWOW64\Bjhkmbho.exe

Filesize
128KB

MD5
01b98c4053c967b5805cc90615844fcb

SHA1
21df383d22554126e63059b8dd654c57bef65267

SHA256
fee5c6e3a706772bf972ffd4963a60360bed83b6c56fe2962e7a8af93a44a43d

SHA512
49f167dcc1a23ce74dca80d94e222a172486274015af664574079a34eab0cd5ca1850a212606b0ef3eaee70f276508650f7b23d91249253bbe0b4c5924ebac2a

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
128KB

MD5
11e98aee74ae5b26650f44f401e08e15

SHA1
a6df1b09f21158f157eb3e26d50513e1e423d446

SHA256
210a706b423082cde48385f937caede7fdfd53f42a9d164add30f2da9a09147b

SHA512
eeb6a8830b21a5b70323417e80220e2642d9611353df5c6b374db84d6acf42c5ac19d202439abf7aef7ef595cd714194a0e56d94cd6477c69663380348aef6b9

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
128KB

MD5
beb87e83f7b99964014475d073452aad

SHA1
eb6c14da06fdcf4b0ca9569d87fc8ecdbaf3f2a4

SHA256
b6ffd5477433b91eac7dc607feccd3229ae1f23be0b47ec3988a047e0d41dceb

SHA512
06c8f98bd50fda05f063c548a2849a7d1357a20cd7f99b2c2b01c5ab02b61dc1117fd3a5db81abbe14b85f1432a11b267d9ddfc1cfb1780460241f27662ec49e

Download Submit
C:\Windows\SysWOW64\Dinmhkke.exe

Filesize
128KB

MD5
fb655853180d6e32e473dc230bf17eb1

SHA1
f8fb2049c1ba1a3c4f72e3970a4d1aff62f21a77

SHA256
e77e5a75a0ec2bd011d9ed4336813f1c7fff9026975f49ed141b9c0ae474a1c4

SHA512
cd7fefb3f1eb200c9f49a80f8567be6fc088589d07764bf6d17a817d9437267e5a30c0e4ea1c5667435f1a40592d639a966d0d03229ea3eb4b76816e0df9676a

Download Submit
C:\Windows\SysWOW64\Dknnoofg.exe

Filesize
128KB

MD5
ab7a509322aba98982e67770fa4acc75

SHA1
f63b3673fb26957b62ee473b9f3b06f9222771d0

SHA256
d9073595d35d2a22c7fe29909d7a39d2c857af91c88ca5fe736d07fedb6395c8

SHA512
5ae232dad07868968469e662761713b5f68d210647df02a23236b02d185725d17b562b411ec844961f75dca6b3e352a709b0152d90a5a5e3230e393e8201cf2b

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
128KB

MD5
6d3909e693e94c765b7a7653cb1eaa79

SHA1
b05bd2175f1f4959149062da229143297004c8c5

SHA256
460606cf37cac967d53bc63d472ddb24d23f62be0cac107d0ddfcbbf4821a7b1

SHA512
ad826913df1766e2a6e5dafbb805ec3d4643359ee11c2588b7f65603692870741ae582a5cacddb01b0e0d3478acb693d6eb052dd54287301fae691355a72ee8d

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
128KB

MD5
cc1883c55b00be0c22e43d8201eb73c2

SHA1
85d0cfded28f089fc716722fa592a0e485b9d678

SHA256
58fd2319993f5a52a64b69a2a51ee33067f1df4a36ad07fc1c9215ef7bba5dd9

SHA512
7cf922b6ca0d9a6085b7409e961fb3ecada4b661099ee81fe40b40d79135e76d9bf00ac2f56cdd3c3b8829c63a0bd0c0de4460daf436e4f1b26a9c83f5079255

Download Submit
C:\Windows\SysWOW64\Fdijbg32.exe

Filesize
128KB

MD5
89cc9d3ab313c146233aede1e0132451

SHA1
a4c86496ca8528853bd63e518acd41e631733563

SHA256
7520344817ae822bf2cfa5e6d1024a9f2e30c030490ede794728eae647d0268c

SHA512
9f7e00883a9d152f9e16cef2955a4ac65d239a9ebcf8e39fa8ddc6d1d9ee6204791c4643b12d4c24bcc381fc30f3a851ce5565d17368e6482fcfba405138ab6f

Download Submit
C:\Windows\SysWOW64\Fdkpma32.exe

Filesize
128KB

MD5
55b7ef2b075449ae64ed58a906385066

SHA1
eec9231848cf74b88c2fabe1d2a48cc901d8b409

SHA256
f60b890b13a6110642492a62869b6ca22898f05221edd51647fae4212ba84f8c

SHA512
80708264607e1a252371c65a5a7717e59e44253542f93953aad0ca06f7d854a17b3c9a260dd89fc42d64dbe86a837347410835c86b2d79c4e15af6344abf69fd

Download Submit
C:\Windows\SysWOW64\Feocelll.exe

Filesize
128KB

MD5
8a2d9e180de50533eb21d50072560318

SHA1
6ea52100831b5385c8cc46ec11c8aa5aaaac99e0

SHA256
d12d4ba84ecd5bdd36e6597751c9cc91f91e61a67f4b6345660882e181221f6e

SHA512
b3b8e2bd506777036ad85aee21d47f9fd49c73c0cd1d514b143858ce42793b38a72e5a455dab3d4ca95b3f964455415cf48ec253600f86261ada0288ebf179d9

Download Submit
C:\Windows\SysWOW64\Fjcjpb32.exe

Filesize
128KB

MD5
18cca3479791e972ef9694a8328412e3

SHA1
634c9873ff9f60b2ead4a1e3b9f2a33dae1f08a2

SHA256
0a67a425c28f9fe7bc64db54e6572a41a73fb699f901aa427964b05da3016660

SHA512
7b13f6a14be65b622f6859eadfe190a2b57b3e6fc0d35815dc079e51af7dc21172c22cd743972cbb6e95ee1f0d3bd5967ae091a7ba45809d1d208b41b5f4efd1

Download Submit
C:\Windows\SysWOW64\Fphnlcdo.exe

Filesize
128KB

MD5
8d272da4b806fd85459e7007ab9fbdf6

SHA1
ae54af6db02ecb57a40342826ee65c16e7c0f9d4

SHA256
5b16f0160e44a3836fd02b7ddcc232fb6e7179a6824c0276354150f2de891556

SHA512
bde3fa6a0a26c70e99f167f1008b98ad31495e88905972873db08b00c35dbd68a7c9b23ccdf1a37c263b32c202e111701328cb8eb475b3e3cf876b5e43f54347

Download Submit
C:\Windows\SysWOW64\Gaadfkgc.exe

Filesize
128KB

MD5
bf3e47ddded4dbd392ed452749454579

SHA1
6ff97920a571a33e0ba1f4723347990259344a81

SHA256
6f96b39dbf02e3a352b5026e3fdc67cd039d8a8c7c881477b7db707bbdbaeaa0

SHA512
902e6314177e8d623d7d389e4a4bf72ce72cc78af01f681b3e00bcd073983bc5814a5bc5649784500f5ed4f2e78896067997853736fe5bacfddb85e5564a0c8c

Download Submit
C:\Windows\SysWOW64\Gfmhjb32.exe

Filesize
128KB

MD5
925f08a4738cf13c30c03a6e703f509e

SHA1
c900763e97f8ae7bb0b9a5769c8b6cedc8148fd7

SHA256
b9974d24956cc9075b18a92a5ca3ab97f042518fd1f3c1b7154751891a34042c

SHA512
cf982efe8faf7def269cb0253974ee77373e6aacaf64e40306eef4a9a45237193f67c8838e9eb57029ad06c17a9bf93f9b0623e0ff883406094222f64c619110

Download Submit
C:\Windows\SysWOW64\Ggldde32.exe

Filesize
128KB

MD5
50a22428d886588f1cf1776366206e77

SHA1
6cb2d3a7b0805665ec52da2f6f074546a15bbb74

SHA256
c2d852006b50856467bb4f03b7e229afb4821be3da83ad2eb76860884596ffa9

SHA512
a32a79149e4d6f1d8159744eb077448935227176e79f589e9be2904da902feb86933b3ccfadd0393a8ffc2b5d7ee026ac638eb39970c3082c42e9cbdc17b77f8

Download Submit
C:\Windows\SysWOW64\Ghhhcomg.exe

Filesize
128KB

MD5
e3c0109e6d05a0b98419ac8ed08b0215

SHA1
2264b1b5fa79adf1771b01106d76693846e20261

SHA256
6bc66095ed7ebddc4819e9003cbcc7d4ad9c23ac311eb9f70b6a47ee5f208acf

SHA512
043270df99ec84fe3ba6ecc8be92a08603e6b9fd7eefbe973ba43f7ae1a1aae67276ecdb4eb78289ce3a35d685f976de7cf1aa4c11b43c57701997077d25a66b

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
128KB

MD5
5507cf0b8d932f97cd8f8e590eaffe2a

SHA1
680912e8a48696d0543e9fb21311db2fa4eef84e

SHA256
4870e2e8e58959ba98cc3a1a37137fb37a2114ed8b72a62eeac3b7a806613fd5

SHA512
8704233e365c028bfde98e9bbc80439045a56fcaffb55d0908c0741badb199347441e69ef0bf556b619a104190480742b876571cfa74630b07e19b5cb56e08ab

Download Submit
C:\Windows\SysWOW64\Hbldphde.exe

Filesize
128KB

MD5
5772949e1af3d32d9202cfb9aba621c5

SHA1
cfb96e6819356da397f087c506664d93bb0c5cdf

SHA256
b94e72381674f483809431b95f271740588075f986f87cf54e342b70a50dd4a3

SHA512
98604da1b80e4b1182897421caa68e3b63979860405181d91f55e15b9a003b90d86afa1c2e3f868cf104938cebd927fc6c294f56c8b03ea8590a6289732474eb

Download Submit
C:\Windows\SysWOW64\Hhfedm32.exe

Filesize
128KB

MD5
bb58944318141bccc1cbc9744497d986

SHA1
39ff03e5ea6856710c7779d4f1b823c2c525a75a

SHA256
f3008df7b6db74cbacd5e313fb0bc8672c21bf42c93bfa73b8f5fa054acbed12

SHA512
b39675facd2cfd4d5ddab35fc9c05f0fc042d72067af804b868dcbe5f3a648a81c5505909959ffea40629f2d9f702a460b90626fda22c6bbe0f4833d5d6b8fcc

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
128KB

MD5
7731ca4e3e141af991ab40bba0f9217d

SHA1
6e398cdbc938b6ddadf5a34a7b58ab8fc7776cb9

SHA256
dcea31dde7ba026dacfb60dbc4fbcc11c0fcb5efe95e34eb2968a4fa1d881556

SHA512
3d86040c1d08205d02f4bb21a546147d11112af356390456fb1046c3c74a04d0b4166e39504413bc59625469f98924fba9a76d663951b26e3285760b35087b2f

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
128KB

MD5
0de4bc624919c207c6c744f796d96312

SHA1
7a3fbc5d7aafc12ccb6827bf8ea5043e19bccfa1

SHA256
496c76562822fe626cbe8b420af82891fc8158379d70f228d91b37f527483386

SHA512
d47d4ad0c21bb3c231148d20b871c34c87865bbec1edd2d96435cb13b657755c47234736d8df661beec2390c5d42b6b17d509900ccd38af84d34f2f4bb5aeb77

Download Submit
C:\Windows\SysWOW64\Ibjqaf32.exe

Filesize
128KB

MD5
8f8899004e1ef885eff8a53b0ddfe1a3

SHA1
59d4fcf9f35ff2b737327e0079785c5eabc61cbb

SHA256
83ef9120f43f5b91c3d3dcac82235c23af5d789d61c75fabd2cad55bf90f2ec0

SHA512
67bfa825200e98d4b82dd300d9224dd85fff4592358ef6d79d4fed355b5aeca6e98a83835f30fe751358ce0177ae525e0b416ffb83582f4d998e3dc7058783a2

Download Submit
C:\Windows\SysWOW64\Ifckkhfi.exe

Filesize
128KB

MD5
f9434542d622d67b41af043eb98f2454

SHA1
cfbf0dd0bd335874ff7a30d60e4dc0b168a1686e

SHA256
fcbb1eee896171218edcec5cfc32346af823cd130eec355b191db108999f6ed8

SHA512
67a56883c3380cd2ecfbaa4f719b80a8aeee02f301615bd393c3007e50b55d5e627d3fae6ce7f0b139ca0fa037e5602fd125181498bb69284de372d25c28cd75

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
128KB

MD5
b6650ce66c2801d8ec138d0d078993cd

SHA1
1f8f326439d383f4a8340b167f755cd248bce968

SHA256
727775197591601c31126863660d0aeea84ef05d96887a514ccf654c1e4b3932

SHA512
7d1d3d3e13438ac44f9a32fbf5d45b90da990f75c0cb6bd0304ccf02977513c35a0e03d257c5c1ec37ceca0fc62ccd3d2bdcf8dec78e050b4b4230b3c11a316a

Download Submit
C:\Windows\SysWOW64\Ipohpdbb.exe

Filesize
128KB

MD5
0f0a12165bb5c7de31839be30995b7c2

SHA1
5777e6b2fb6553bd210d1ba2b766282417999dac

SHA256
22e37638c8924d7cc01bbcd07347adcfe6ea441be8e8decbc28dba9f782abc38

SHA512
2b133a235a942af1c095c81f5567e7468f9ebe1ff8aefbfdd5b35923c050856a322ba748406bc9f522c72aec6f75d175590f1442dd4160c1a28700606c848365

Download Submit
C:\Windows\SysWOW64\Jenmcggo.exe

Filesize
128KB

MD5
4fc2a454db5f6bd8d0438b284f696395

SHA1
ad9a99d5046886f5c59680619a23f66de34f74e1

SHA256
508dc22ca85360be66cb9a92443379e08233248cb5183bf7f648c069fc065d5c

SHA512
cada7280c49ec8011968f8890cbca7f19e23c28f3b13722900371fe89c043b04659639ba459fc8b2bdddb062b35caa1367204b6a286cc88ecabf0af1021eb5c0

Download Submit
C:\Windows\SysWOW64\Jgbchj32.exe

Filesize
128KB

MD5
bcf52df11da3f14f290dff9eb996c875

SHA1
08d1d7db67d0fc906bd772ff17f622c293b5fcc1

SHA256
38d35eaa3df18e85e08e17c993bd005e5e244811aad3665951601ed094894bbf

SHA512
ecd7000ca251168ee21d61a91e19602f0968d695fd7a11e19e050f450725b804296745f95a9be6b00ce1e7f5ea4f49f1f2cfbf1b30ec1163e68d1e68e26c58ae

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
128KB

MD5
a306f1789c82d0439a15de1c610eed8b

SHA1
f64a6574b135a8c85c6a498ead2e8b360d4420aa

SHA256
1c38421456cb8e3fc750cc077b4a6630ab8664149d9fb365d8ea71a625ed7940

SHA512
c4caa3e9ae1d7a7e43020961225c43cb7caf9bca200a2ff5a3bd935a70189f22d459b1ad591539af5693ca0907e69bca0415a3de3900d189d127b523cfd4c5ef

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
128KB

MD5
ffad105d28c767b0d2c1decdfc639f5c

SHA1
5ddbfa7a5c48257dc874b89b67b46b57ece9fe56

SHA256
84d850206f5e541623b1fe2338b3454c6cdf37060bef76e3151106c496ebe51d

SHA512
f24bc94f196839bf336e1012f817f367fd61ba7478080a19df0feecb91b7b6b64e682df0cf1a5e2572d0511ed6359218c9cb917a6e001427e1c4f29d2feed30d

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
128KB

MD5
80f156c3dc444a5ee28c67d799ca5492

SHA1
a23fa2512b9b74a35a44dd330039ee8bb3a028fc

SHA256
f71818d7416ea9704fdad99448bb01d8d8e8aa1ed979587f72abd17c663f4ca6

SHA512
45e8f0ab2a645af8bb8acccb5b447bdd5243461b6c22123a0110c78a208f43e1e7cd39e2874472733a2608ecaf45f15660888a35d770e500d9c4ce33507d53f2

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
128KB

MD5
4a277621b8ece460a553470e5b2073a6

SHA1
ec3ffa08cc140a3a8aaaf6077e29141f25b86636

SHA256
f1df7c7112879c74385a0bd2603d5d87d17f6831c30e0a06997f6db582abc69b

SHA512
ac6835622655d1b7b257c3190c3a55d07221e00413254357227038563d4cdd7ad5d48eedd4c5c83542624db34b7cd1c8a69138315c7db5a38f733c22a477fb74

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
128KB

MD5
fe566b00d136fde9dc201512c3152f53

SHA1
71d2651293b2aeffc47e08b7f5dba4555cace8ae

SHA256
55e53efd9badd2a35993c01ee941310a6d7f648c1d35f77a096efab4788346b0

SHA512
82fb30d72fd5bde53fafa8067d8dab36ebbcd5a717461fc414d77a30aa1ffb2c4fbce672c5800b702fcb3fda71b271de9e24be72728b798fe4461066ab1c8993

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
128KB

MD5
140adb1a454cf2d307604fb64a2d62be

SHA1
ea8716acc2685edfa388d37424b874cbe05939f3

SHA256
cb70b046c5478068d310529fb3eb862f60ec683752e7bb1b2689e1ae6d33484d

SHA512
2735aef6517cfbaba151aa87f2321bf346b29c523956547d224d3096109754f2a8a137bf546301bb431d9369fccb463236de8cdca6ee0c9fe7058910576fcbf8

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
128KB

MD5
653eafb39989d7890692a32652a2e0dc

SHA1
9a6b410249d5967bd104a6d93a49d7077ca4d788

SHA256
2c9ddde0b10df7b3696ce2ea94008687b4f4a4a058aa59b4dc8e730ca99ff779

SHA512
3b75266cd1386f40e3f3bb140cbfa9bdb7ee1a26cca047420ede25253921083850944cdb67d76bf90c064e5b26333a4a33d19829e61ec394044f854c2e3711a4

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
128KB

MD5
c0e55d3b5e106d2be2e9f502a77f1301

SHA1
46b55b582ee70306bdf683e76cd0a217474313c4

SHA256
377445b0e3541b2a6df22f9d73875a3ae5a0e79af772bcd1aef820886ddf5e78

SHA512
37f85b5e5bce241e25796dd8125e6b8c9b0262735b8ab19a7a8ebdfc996c46d852ba373db7c7be60724f4469111db438cf7221afa09e441f4f3005f9d515117e

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
128KB

MD5
537d8e0f2fdad107c9c44ab7f7841cb3

SHA1
f82fb5588111b25c0ddf9b8df51e630558bbc7f3

SHA256
6d80cfe5570726b16ceb2d8656e596a7fd692e08e371d2aae8d639fcc0254c1d

SHA512
2bfef0c2f538c16e77973f2ca8c8e2299adad920194f90f6cc499a701beb5a37acaf3819fa861a952d628b68a27fc554d7b45bf651cf48ea84ee65ba1d8542fb

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
128KB

MD5
85f320162165c0f7ba5241ce6fce94b9

SHA1
d9d4b89ff2d1db17551873c4da5d5c6b404db29b

SHA256
6b4c1c998da397090cc53a8e8581796f169156ed82da873daeb5ddc2255cfe40

SHA512
61dfa5b75adaf893cb2a464f6992f8400fabc80f25f6be4bb3ad2ee847b3c81db72dcc56d899fc73b8fb3e7be8f42ec587cf3fca9e7a5d0947f9ae3779e8029a

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
128KB

MD5
8368f3d6ee5aee480af3018a24899dc6

SHA1
6890eace80872dcd483c99ae028db10782246a57

SHA256
f83edf6b2215c1ed8524a7f6bbd8fd3984e27d095cdc0127b67308242097fdf5

SHA512
a8283b6a4a02b44a69a0af8372ed17c781c17c568d924cfc17418ecdf9712c4650b11df2cb81508ca155631c39c125eca8d775f800210b92d16ae8c9f3660049

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
128KB

MD5
36e57e69c49e8557ad4b30bb81b73772

SHA1
82ced94f09e9ac3e5338831b9d88e2f91a2334d6

SHA256
335df029d927b625e8281b5314331d98517331e585895471e2baa8cd2385c45d

SHA512
acdf59b4616d8d2a17a6ae461887169587c7510dc83b3a0bad54bd8bd6cf26c9957bc0a38804dadd00643217fbc056f97144841df2fd703ff84e106cd48848c4

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
128KB

MD5
cf99097ae4350643dd8f2b9824937da7

SHA1
128c6199e55420c4ff107175565f60e58f051502

SHA256
d460e007577b3980cc569274ccb1fa0c8bfbbdc80d04f432353244e82f028007

SHA512
0fd02b9f56dc1b1ee41d10afa824dec753a8e9c2d15a896ef04c4cd10a43ad8d200194aa3b2eefcbe55c2709b9173970076213eadbb20d36cb57f33e07083e75

Download Submit
C:\Windows\SysWOW64\Lcimdh32.exe

Filesize
128KB

MD5
518ffa54b3f045555b9e6530f103c1f3

SHA1
676721fc6106db10fd4a64308d2dfcafa66cc8d4

SHA256
0d1fb10363011842e02833706d331784c005b4d9bbca075509728e4767f51923

SHA512
3f82f1de1563d8d66c6037120db2b994f84cebd0920534e90a8f22bc3ec5a53bfd419df56949c510dd6af5587789462d1e019c8614e6732832ba0232f468d468

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
128KB

MD5
e8ceb9ceef60b1b863f1473a0a71877b

SHA1
a60a5fdf921b1d168522123d67871496b314d878

SHA256
042636b917a62249cfc55803bfaadc0c3609f558c5e75a0489dbc8f1f4dc06f4

SHA512
758d3c365f2a8f404e33a3c5614ebb314582ad92f6e938a94c80a013d0f6645f8ee5a783642d5ef03f01e0249f5970d03335ccef18e7f44baf2ba75f6062b944

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
128KB

MD5
e25d6c77c78f64f2792f08274de441b1

SHA1
5ebd1a1ae1b18c6e9c0c95e63530be51e7b01f51

SHA256
f5ddbe59d32f7bfeeb0121690e1de0ed698d82a3ac104a31b969bf77f4c40790

SHA512
d92f528d8a8cd9416f7b3c07ff759ca6e1b0e1d57e56740819d6f970f0c71700673f00e7a6b805fa93f29c7fe8b338ff1a978381881d1a7dfdec8a1615018553

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
128KB

MD5
cfc10b9b029a8c287a967ee3a179beda

SHA1
078ba5803aa5e66879c01633208d3126df9bfb5a

SHA256
9c9cd1afa382db0bb455da29bf1d2c94bc8ee69c05a40f4d7a0fb5030a28911f

SHA512
32cf360a605c278ca69a86d09165649b21b98f135fdba12e5c5d8915a49243188abd281bca300a59337721f7aa58fd0651ae6fc6b2d88494fd1591d62e6ed78c

Download Submit
C:\Windows\SysWOW64\Ligqhc32.exe

Filesize
128KB

MD5
098b03eabad073cc403145d1de29e353

SHA1
7d2d4fc103cf5bd6453396a029c1a6f84a7e3ccd

SHA256
119c43b4b9971d4c44dd874140107b7558bcc16aecda03edddd374687bb30b1f

SHA512
d0bbc224e013e1a369fb3a4c13ab677307edde15addf8c19f1b3d9fba7b3abcca5b6509c0520b25cbc19605747d26257f4727d1c7818016c94f7e26d74251ce9

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
128KB

MD5
e72c8b51a1a123c78d59b4212c5fe69c

SHA1
cc820d17f50b41e24ee2f051c5b3d303584a5c67

SHA256
38197400f277725ff1f1f3a4eaa7533908d474404381819842a3f89bbc764abb

SHA512
d3dac731f5bcdb161c5e9201e97b3c7711402e4e3c20143cae8ac92dfc65031fbc769a14e964168b22db8d96dd4f63b15c3be15fd6d649fec3bfa95dd75e62ed

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
128KB

MD5
a0e60f3ce60e6c5367bb9f2dc270f69f

SHA1
45802848e2e68f7de0acc0e86fa4d7f8a163d32d

SHA256
43c34170ab7e61b8c29c3001e81f5cd6c996f549513f7b40d44f00049102d6cf

SHA512
40c498129c48d708e4f928975abebf1fb9809f8905406a45512702457e75d5560502899d914c18840e03ff1bec6d51b01f87873106b234266cdcf9ff73a28723

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
128KB

MD5
5d9dcceb68c643be6a61ce3e31186a52

SHA1
8fb5966af6389facd196e32843b1aac944804b8a

SHA256
4c56a242b75352d7ff63c8b55a8f9c861086af72427b8c7b076b48c4dc7722f4

SHA512
ba820c317c79c87cab222204e201836333cb7f82edb79bc232336acf63eb814e322377aafbfeb3dfcadfbd7a99f50c955d4d720ae2d9b48350b108c814debef9

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
128KB

MD5
468fdd365aebc0637502a0a94b726ea3

SHA1
c2cacf9a6673abca125175331ce6fd2ad4016e4b

SHA256
3848a17761017f0ba9f655e08b6acff58ac2ae80a6ccc4cae552ccb0f41f0c44

SHA512
e99f6b8fec0b9a3eec0b7f65a5e3efab12f0bd924feea2b3f639a49df0ab4217bd33159afaddb468219851620e6b836eaed9081b25fd54e2643c1659941c5fab

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
128KB

MD5
08def04415eac519be40cf93800514a5

SHA1
8dc44bc4032c7abca51dd5f51288f7238e871e1c

SHA256
f066be75c09bb33a90635ccc9aa3d1da6cf9326db1e40d56db7451e307bafefc

SHA512
a17ce0dcfee6609884acd1be8f73c3f31978e640653924dd745da5dfbccb1ba537d620aa27c845a52b11456744f76dc0f9988ec55ce27fe2029e5e624dccb6b2

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
128KB

MD5
936c22e6eb958a4d0ca511980a621a67

SHA1
b3da0f8c651417d1742a77f3ed59588ef74a8f34

SHA256
ad9682dd86f0ec378632e834dd9657cb22b898162aa3042503a0f3a97cac5cde

SHA512
59b62651af64a21a70f00ea0c6c51bb6ed71f7ba43944b7c20c7c9dc09d43082d02f4402ee112b4975823a026f6ecc1cdc079b7f9fa1f1c94773e3025eb1f4ad

Download Submit
C:\Windows\SysWOW64\Mdloelpc.exe

Filesize
128KB

MD5
0ad6975a09b0214c8ec56fa49856598c

SHA1
30b25ac5a2812d346baf7e848068ccac03abfb06

SHA256
ab4a6a452d33c893026e774e5cee4b7fde5edbd90d91d09bec7a015723517a47

SHA512
e4bf24fc60743425f1876efbf18696a69a5bec375c1ee08de5a513b8b5100a4092114709775b7859d8452a3c360cd3a6ed175d4ea4ef3464e545a9a6b32e1e0c

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
128KB

MD5
5f6e61f9567ab30cd781d745dfe1bffc

SHA1
033ed1a7880038e02be04de920473a7a956064bc

SHA256
799010b739c22a2bd2afee7576186fb59e1eaf62b1675720c7d85e1c7219ccdf

SHA512
5dce82bf9bd0c2ddf2b929482e35618f439ce7ea89948ce5bc4beeeb125f20b56226e4f3e026af116104ec04250485753cbc83cb746b47ed9c4131f8dc38fe47

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
128KB

MD5
342184b4009d086a0b3459448957d00c

SHA1
295bbbb24e37311118fc82fd708b586beea62c85

SHA256
e925a978d685d51fced16068088ab7f162afcdd2b7f4e51b95b35bf0d31ba6ae

SHA512
787e7f7761c90d8ad4881c89096429671cff5b3dd5363e75211f6581c287e5b8a51ebfd8f1e52949c9dfa2a3977212ea5493a14246c54f16f2e814f8f4b8c26a

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
128KB

MD5
9ec101d1d6a226a3eb96b2da91da3f7b

SHA1
45fae58d8fae9463cbfb9e812802cc7255516f46

SHA256
61e3704d968718db0292d51d9c068ed36c31fb93cf6b977d412e0581c6c04486

SHA512
e8d35ee6400995b4adf8053d6f8151a73368ae285586fe34502d678a00fb601c0162ef7064d61638121bcea2a6d948176546630055fadb6ec31312031bcced4c

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
128KB

MD5
4b3bf5abe782952cc48e20000c7480ab

SHA1
369aefb7237368bbaa45c39cf838e7dc9f37c083

SHA256
1ee804df2254bb26a038f5a412fab0fdec7eaed4df3326e1510d62e97d13ad12

SHA512
39a4298e2a742b13b6ce6133922575881eb49bcf9fd2248bb208cf6f004f9304e3c22366b01a9acb8a57564d254204a58451046530f410f0f19592c3d2263a35

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
128KB

MD5
31ae1b98e8711ede5b179cdba9032385

SHA1
f019892ef7c6d4bcf8d70f7400919c4fcaf922de

SHA256
6212d341896aebb8e7a6876a742444b48678b36fc5849f0eaaac2f715a0ba60b

SHA512
db66112656def969db7e230bcdd9610d31921dafd04a1c8c116c932b02b78d65e0392335141c0e2aa515fdaaa749af0a2967df9733f26c9e356d206445df7824

Download Submit
C:\Windows\SysWOW64\Mnegbp32.exe

Filesize
128KB

MD5
467de18b763c4a544f68230168fc78a9

SHA1
fc243cd42fb3b66ecac5e9dcaf90de69d0d8b4b3

SHA256
14b40f384ab564fd5f455ec39547aafc2916f6b7d04aeb79d8470ee7f770873b

SHA512
a947c2ec6c239c81acd8191e96cf2bebc84cfa1ea2f0336fa8b399bc1db51b524463807de8b936fd744fa735558bc45e269ccee80b39c46b4c56fd7f279f47a4

Download Submit
C:\Windows\SysWOW64\Mnmmmbll.exe

Filesize
128KB

MD5
ff79bdee900d77cdb966bb33fb7b265d

SHA1
a3544cd24c94898eb48220a86359be1440167a96

SHA256
f93d3ca2715c56451e122fcc9bbcf474c159315bd8b7836ccad77964d72ec3be

SHA512
2069781560021b5d52e579a283d675eee5028773bfeda1b8ca1cafb8db9706d56f03d37cbdae5c477c82a4a987d837c9236e5824a144205695ec1fe2c016db39

Download Submit
C:\Windows\SysWOW64\Mnojcb32.exe

Filesize
128KB

MD5
0b160f5c42cd6ba25c67b3ab26ccc57c

SHA1
2cc24464bff864f505621f65509d352d47209f7a

SHA256
698e6f10d78f01763abe3626b6eaacedb2dc13a02c3b2161c12cda15b955976f

SHA512
b247e2afeed25d2dcb433634187882455551069e8e4a0f05dad32c7b3a9791bf1a91e201b7d689ba7750f17f761161e821432510b1b87aa603dcc774949735e9

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
128KB

MD5
9db42cacc3619c41763137e57bd38beb

SHA1
cfaa33519d59cc2615579d9346feb6eeed11491f

SHA256
ed86ed8f496dd3a67be6bbca4e1eef7e6e38e351a0d224abfabd03a606aa0134

SHA512
08f9bda36c53dcb23fb1ba6186d046bd87879d15d2c7a3c5752b1ff76e0fe27b6e2adfca331c119557607818d43e4704e756c9ee41d8897b2d0c5635bc60198d

Download Submit
C:\Windows\SysWOW64\Nacmdf32.exe

Filesize
128KB

MD5
c4a9a2c88bb6eae191cd7060e8a3bf87

SHA1
5f53108daa025ad58902fd28f68f595483e074f5

SHA256
567bab5d06c44edb19d34b37591e5b7b4b7b9c95e59b6de0d2893e0863ae7beb

SHA512
3f25b0d91dfc4ce9e6778f494005639c0d0f5b6f07a760f3450bfd74399be604b8b4ee71b6904ac6a693dbc35b2c2f7779b8398a12df20e4161054d3712236aa

Download Submit
C:\Windows\SysWOW64\Nbibeo32.exe

Filesize
128KB

MD5
73a2cd7b18f6dcb80cf1a87624bed289

SHA1
0d1a8a3363a9f3eb4d6e203fee16d533731d19c4

SHA256
621849cff8c33c4d49c05aad6559684bbdc97937e76857626924a1a45441e98e

SHA512
a83d9740f090ad2b6c3be6d173049d3d968fb2e3bf6eb46ad36a98bdc78a41cb8afa62a2686911837a58a7326173829308f6784b19fa42f3f30e5c13c3bb54fc

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
128KB

MD5
25be241a7a92ed1ede90a05f3e6e3d1d

SHA1
ee1a860f2c70d7e4371d928332fd3176d2119f49

SHA256
417d5993408c8dbbbd9ecd406a8394f5a6f68779b8406ebbf182938d77579d9e

SHA512
e50dba4175a3a56a04d94ef7c5de6d0fb84b2f457267171b39fb57c39ba8f8469144b919198cc7f37f2c109c570eb16b1d409033cea9a4743ee4d04a403cc1ae

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
128KB

MD5
f21dc005bf8111f4e6479c3b50e61434

SHA1
2f84e115037dcb8445ac78ca89ca80d3ec1d5e4a

SHA256
01ebbe7184784b71aac9ac13d026a72c421664d13b4a42b5db910cb7f094828d

SHA512
a1789d80c47f0a3c4188c033a13686bc7d15275b63c5a9b01e8d507071229a6918769a59a5122132b25a3eb732787ad211cbb6c8c551570d51114b9df7774487

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
128KB

MD5
2274b45cf832bcea07094bcfd69eeddb

SHA1
bc33aeb3c266814a8fb065857752f17130c2d3a9

SHA256
1492b81ca0c176dd6a9b1bbc5cb635674b2ae35d040065682ee687a4908b070e

SHA512
0a6a45831148131090c93d8025e630c4bfacc95159a84a5df0603238ff34f1bd18bd2b21e0eb49243d4046d2ffa4d1c6ba01ee503d81656f50a1e1fa667c012f

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
128KB

MD5
1111771b72da5538135aaba673affcd9

SHA1
efb2846f5c2e389f785ae3ed9a5b0933a3c51965

SHA256
d558ff36c5642c7bc889ae79720c7ee5e3bca3f1e2683bc2d3e414da337feca4

SHA512
3648a637d4497925c66a31bbd4a0ffe86714acebfb1468806844645707ad82c76807c94d56213e0f221e599b84441c78cdf57d04cbb046cbf7ec46584ee2e804

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
128KB

MD5
8abbd1b4197469b551f6edf0a428378e

SHA1
41d760a6dea965929f617e1ce57a68e832c17f3e

SHA256
8585eb76e3a04e9122b1e4f500630f749af06e9348d57dc7fa3221d6de5eab67

SHA512
a6c698dbac3e3a2987cc28575b13527e8a68dbed33d8c9a004ce4911f61710030da39b4f5451448ce03d64430f9d451af59ee1c08fe4da9362d2dec109787137

Download Submit
C:\Windows\SysWOW64\Nhdicjfp.exe

Filesize
128KB

MD5
322eb2dc668ba5dae44fbc020c9072b2

SHA1
aa7a8a3a3335281cb21aaaee74093e8028bfcf8a

SHA256
1cb720296e9d4791387d23ab03a1432b2bcdeb13d6de4821236ad76178e4a346

SHA512
42093bdddf8ac51b79fd0bf9afdfdc6a30d5f79232200db5fc7f0a1c99194c93129601d866fd2b4085a042d3a48b09563392319f4e0ab12c40819eaae37bb763

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
128KB

MD5
f1e873cdba8c896196d97a54125fbdde

SHA1
4bbcb7562fc1ea829f0c3562b41d8c5e99d24954

SHA256
c5192742e8b2e1dc5bf7d98b39398fbdcf56ee0d08bd58ff3ddd7154101cb75b

SHA512
a44f0c5e1713ab200c266a421132366cc78208aaa26069e8f163593f35a55776b1afe917ac5edb43d56475dbb2226a747469c3000dbe774dace81a4dc0a23657

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
128KB

MD5
ecc52c0159265c214f1691f777fe86fd

SHA1
4a2515e60a4fc168202b08cf791cf25f31c79283

SHA256
ad42f0bf6c10bba75da70f5022d45eca3c1f9b9bcfdbe1eba197604b7fab7df4

SHA512
5429141acabd0de9bd6c715557954b4cec41e7141bb531a5280e33659fb5c51901ffd23af55496a152cf5e2a776daebeb509fd9a8f6bee13ecffc15af0408e3b

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
128KB

MD5
e50ad2b9ac2d6ae2c8b647de57ab0400

SHA1
516d4cbc05fcf912790e48c92c7200cc093f2415

SHA256
723d94a235c4658b464c726cbb3b442df3a9ec1e004054865abe1f223c6da352

SHA512
5ce420365c1af94ea5bc495eef504c3bca81be51e07f5d3ae461765bb93966d86b9f3f462dc57dcbdc9c637edb26e7445c3d9dd7b8155cce977ffec4335879a9

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
128KB

MD5
1e7ab450a2e6c3de736f47aeafb5ea18

SHA1
bca226bb128925aa66feb934e47175dc2a045a95

SHA256
0587b655a44ceb9fb23437ba7ad4ee513b729db09f7bd2efbd4af0f94f44c9fe

SHA512
cd7b14764ed46c8c57a2b191b32fc815cf0fa638d0ed2f3e1514bed5fcd5deaea3e93b156cbf64d810725f393315643874964cd296a6b1ec79829e6851073a29

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
128KB

MD5
2c49cd128808819870069c802d54fcf7

SHA1
0fee0375f78a6279b6b2d54b0ff9745fd673ec18

SHA256
ab3994e2fe6d01ed7f3ca2ddeb84dbf5bc56dd453089c379cabc61c352009aea

SHA512
5123e88904c29c895d618b278d225d664fc20295738f114c3751175ba7f68ab9e7984476678104c5b1f1de587af9acd99c8432975ff255b08995a33f2243a82d

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
128KB

MD5
016935ff7f516709eebbc1c6cef1364c

SHA1
0335f5d977b058eb8572d910fc5e249e1639fab0

SHA256
3eadfa5ed8927ebc64f17290b132858c8106ba82ce80bb269fed4ebdfcdc2aec

SHA512
533017487e6b222a0391ba50b8e9c7159bdeaf87066e11f68c9de6752fd147c588d848c92ff1c26b72ab70c7337c103dac728fd38fd62566a0c2a40c5cf0aa86

Download Submit
C:\Windows\SysWOW64\Phganm32.exe

Filesize
128KB

MD5
998a11aab661c1f733a827f83dccfbc7

SHA1
35b1b4d79047f9cc63f56b42a56ce8e3e284ec94

SHA256
66134906d357c80a1bd9c59be08debbbffdfc4990cf514c691e02d128c1449d2

SHA512
f621da179aa7820cfb8b66a278cf82f076fe992220b4b077b3c04184bdd97a626987234c3fd1ad36bd26bead6e1c14cd3ba3a4af743a3557d36422136e07e223

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
128KB

MD5
b16eae7c023e142f55579fe9338d4933

SHA1
0af086ba55a0115aa35f60f0e068da19019dbfdf

SHA256
b96839b48e4e74fc8236efd9e86903e27d2aedc6b413053d30ff273ad4d22837

SHA512
33442e5f7f5a6196c12d9014d2d111009928e0b62d8cd41ec3a945142219e62a708ca8fa13f26e3fc06269e3def59acdab092437b2203bda34cd495d203f7ef3

Download Submit
memory/384-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/384-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/464-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/648-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/740-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/740-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/804-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1032-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-109-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1740-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1740-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1828-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2108-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2144-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2276-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2360-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2392-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2432-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2532-178-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-350-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2712-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2712-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2728-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2960-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2960-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3104-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3140-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3496-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3496-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3524-78-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-279-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3584-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3628-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3664-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3764-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4140-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4224-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4228-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4228-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4408-195-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4496-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4496-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4536-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4536-251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4576-187-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4732-344-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4760-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4760-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-182-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5020-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads