5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe
Size

256KB
MD5

5298dbd7f55b4e06b57afd8b6d711884
SHA1

e99993d088ff4859880e9490fc8989ca04e55694
SHA256

5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e
SHA512

64fd90c253b958ab8600e8a36c760c3954fe6695374111dae7a47600e3ae7c28c0c7e6d34ddd41d995c07d522b62d9e11e04ead11fa2dc7b3ffbcafeb5a096ec
SSDEEP

6144:aTZvTvvnG7cM9C81NByvZ6Mxv5Rar3O6B9fZSLhZmzbBy9:cbvvns9C8HByvNv54B9f01ZmHBy9

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dannij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lbinam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplpll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehhaaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dinmhkke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahcajk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fipkjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dndgfpbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqqdeod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijqmhnko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phfjcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjlalkmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eomffaag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Momcpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iafkld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niklpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qepkbpak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omegjomb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klcekpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgeqmjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpdaepai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhnikc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcfbkpab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgihfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkpmdbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jepjhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npjnhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoofle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgeghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnajppda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npchgdcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebmekoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jinboekc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqnjgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hdhedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgqfdnah.exe

Executes dropped EXE 64 IoCs

pid	Process
1396	Jfnbdecg.exe
4708	Joffnk32.exe
4688	Jbdbjf32.exe
3732	Jeekkafl.exe
5084	Jnnpdg32.exe
4932	Jehhaaci.exe
384	Jpmlnjco.exe
3488	Kldmckic.exe
4332	Kihnmohm.exe
1752	Keonap32.exe
1540	Klifnj32.exe
2120	Keakgpko.exe
4740	Klkcdj32.exe
4988	Kfqgab32.exe
320	Klmpiiai.exe
936	Kfcdfbqo.exe
4392	Llpmoiof.exe
3084	Lbjelc32.exe
1552	Lehaho32.exe
3776	Lnqeqd32.exe
3112	Lfhnaa32.exe
576	Lhijijbg.exe
3744	Lppbkgcj.exe
3752	Lbnngbbn.exe
4272	Lihfcm32.exe
4564	Lpbopfag.exe
3764	Lflgmqhd.exe
860	Lhncdi32.exe
4428	Loglacfo.exe
1656	Mojhgbdl.exe
2436	Mlpeff32.exe
2464	Mffjcopi.exe
2216	Moaogand.exe
4644	Mbognp32.exe
2124	Niipjj32.exe
4700	Npchgdcd.exe
2652	Nbadcpbh.exe
2440	Niklpj32.exe
4212	Nebmekoi.exe
4904	Ngaionfl.exe
1184	Nipekiep.exe
4568	Npjnhc32.exe
3712	Neffpj32.exe
1788	Nlqomd32.exe
1976	Opogbbig.exe
436	Oekpkigo.exe
4616	Oocddono.exe
1464	Oenlqi32.exe
1000	Oofaiokl.exe
4900	Ogmijllo.exe
2356	Ohnebd32.exe
1696	Ocdjpmac.exe
3276	Ophjiaql.exe
952	Pjehmfch.exe
2416	Plcdiabk.exe
4840	Pgihfj32.exe
3396	Pjgebf32.exe
4404	Pqcjepfo.exe
3380	Qjlnnemp.exe
1148	Qoifflkg.exe
3412	Qjnkcekm.exe
2932	Acgolj32.exe
572	Afelhf32.exe
1484	Afghneoo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fjjnifbl.exe	Fdqfll32.exe
File created	C:\Windows\SysWOW64\Lhlgfb32.dll	Hlhccj32.exe
File created	C:\Windows\SysWOW64\Ejljgqdp.dll	Jdfjld32.exe
File created	C:\Windows\SysWOW64\Khbiello.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Lnbklm32.exe	Lldopb32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pfandnla.exe
File created	C:\Windows\SysWOW64\Caojpaij.exe	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Bcelmhen.exe	Bmkcqn32.exe
File created	C:\Windows\SysWOW64\Okkdic32.exe	Omgcpokp.exe
File created	C:\Windows\SysWOW64\Bdpaeehj.exe	Bochmn32.exe
File created	C:\Windows\SysWOW64\Ekjali32.dll	Iehmmb32.exe
File opened for modification	C:\Windows\SysWOW64\Gfkbde32.exe	Fjadje32.exe
File created	C:\Windows\SysWOW64\Cmflbf32.exe	Cfldelik.exe
File created	C:\Windows\SysWOW64\Najceeoo.exe	Nijeec32.exe
File opened for modification	C:\Windows\SysWOW64\Ckclhn32.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Jadgnb32.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Dlaebn32.dll	Jehhaaci.exe
File opened for modification	C:\Windows\SysWOW64\Acgolj32.exe	Qjnkcekm.exe
File created	C:\Windows\SysWOW64\Lfdqcn32.dll	Pfandnla.exe
File created	C:\Windows\SysWOW64\Klmpiiai.exe	Kfqgab32.exe
File opened for modification	C:\Windows\SysWOW64\Mofmobmo.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Nlhego32.dll	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Gkgmdnki.dll	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Kamojc32.dll	Ijcahd32.exe
File created	C:\Windows\SysWOW64\Kageaj32.exe	Kkjlic32.exe
File opened for modification	C:\Windows\SysWOW64\Jcfggkac.exe	Jphkkpbp.exe
File opened for modification	C:\Windows\SysWOW64\Agimkk32.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Aojjhafd.dll	Cgqqdeod.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Hapfpelh.dll	Kpqggh32.exe
File created	C:\Windows\SysWOW64\Jgbfjmkq.dll	Mjpjgj32.exe
File created	C:\Windows\SysWOW64\Nmaciefp.exe	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Dndgfpbo.exe	Dhgonidg.exe
File opened for modification	C:\Windows\SysWOW64\Ennqfenp.exe	Emmdom32.exe
File opened for modification	C:\Windows\SysWOW64\Djdflp32.exe	Cidjbmcp.exe
File created	C:\Windows\SysWOW64\Ccegpn32.dll	Eqncnj32.exe
File opened for modification	C:\Windows\SysWOW64\Jkaicd32.exe	Jdgafjpn.exe
File created	C:\Windows\SysWOW64\Jcdihk32.dll	Fijdjfdb.exe
File opened for modification	C:\Windows\SysWOW64\Iehmmb32.exe	Iamamcop.exe
File created	C:\Windows\SysWOW64\Oanjomjp.dll	Naecop32.exe
File created	C:\Windows\SysWOW64\Njmhhefi.exe	Nccokk32.exe
File opened for modification	C:\Windows\SysWOW64\Ipeeobbe.exe	Imgicgca.exe
File created	C:\Windows\SysWOW64\Aciihh32.dll	Mmnhcb32.exe
File created	C:\Windows\SysWOW64\Coiaiakf.exe	Cfqmpl32.exe
File created	C:\Windows\SysWOW64\Jpmcbhlp.dll	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Lchfib32.exe	Lcfidb32.exe
File created	C:\Windows\SysWOW64\Pnkibcle.dll	Pbcncibp.exe
File opened for modification	C:\Windows\SysWOW64\Pqcjepfo.exe	Pjgebf32.exe
File created	C:\Windows\SysWOW64\Alkdoago.dll	Iqmidndd.exe
File opened for modification	C:\Windows\SysWOW64\Ohghgodi.exe	Oondnini.exe
File opened for modification	C:\Windows\SysWOW64\Dmfeidbe.exe	Dflmlj32.exe
File created	C:\Windows\SysWOW64\Iofeei32.dll	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Efeihb32.exe	Ennqfenp.exe
File created	C:\Windows\SysWOW64\Mpkcqhdh.dll	Dglkoeio.exe
File opened for modification	C:\Windows\SysWOW64\Jekjcaef.exe	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Iohcia32.dll	Caienjfd.exe
File created	C:\Windows\SysWOW64\Gfkbde32.exe	Fjadje32.exe
File created	C:\Windows\SysWOW64\Mqfpckhm.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Kbbhqn32.exe	Kgmcce32.exe
File created	C:\Windows\SysWOW64\Enjgeopm.dll	Ncqlkemc.exe
File created	C:\Windows\SysWOW64\Nbkdke32.dll	Kjccdkki.exe
File opened for modification	C:\Windows\SysWOW64\Pdkoch32.exe	Palbgl32.exe
File created	C:\Windows\SysWOW64\Llgdkbfj.dll	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Iqmidndd.exe	Inomhbeq.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12164	12108	WerFault.exe	733

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kihnmohm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Enkdaepb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikgbdnie.dll"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hockka32.dll"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inbhocbm.dll"	Bbiado32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fplpll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckcdlpbd.dll"	Fniihmpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kefiopki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Niipjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iqmidndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogbdnipf.dll"	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpijle32.dll"	Lflgmqhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjnffjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ejalcgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lippqp32.dll"	Fbgihaji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdmlfj.dll"	Apjkcadp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Emmdom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benibond.dll"	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohnebd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oodlnfco.dll"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgicnp32.dll"	Dkcndeen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogakfe32.dll"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opogbbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchace32.dll"	Lbinam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhbdbmfg.dll"	Palbgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paoinm32.dll"	Fkhpfbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpecpo32.dll"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnkibcle.dll"	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmgnn32.dll"	Bhoqeibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfjehbcf.dll"	Imgicgca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nmnqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfpnk32.dll"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhijep32.dll"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fgjhpcmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iahqoq32.dll"	Afinioip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ikdcmpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Locfbi32.dll"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpbdco32.dll"	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kolabf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkeekk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchcpi32.dll"	Cfpffeaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcoaglhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnjnqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kicpplqn.dll"	Fhabbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mbdiknlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocedcbl.dll"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkaobnio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Haafcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdnacn32.dll"	Pmcclm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1396	1232	5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe	85
PID 1232 wrote to memory of 1396	1232	5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe	85
PID 1232 wrote to memory of 1396	1232	5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe	85
PID 1396 wrote to memory of 4708	1396	Jfnbdecg.exe	86
PID 1396 wrote to memory of 4708	1396	Jfnbdecg.exe	86
PID 1396 wrote to memory of 4708	1396	Jfnbdecg.exe	86
PID 4708 wrote to memory of 4688	4708	Joffnk32.exe	87
PID 4708 wrote to memory of 4688	4708	Joffnk32.exe	87
PID 4708 wrote to memory of 4688	4708	Joffnk32.exe	87
PID 4688 wrote to memory of 3732	4688	Jbdbjf32.exe	88
PID 4688 wrote to memory of 3732	4688	Jbdbjf32.exe	88
PID 4688 wrote to memory of 3732	4688	Jbdbjf32.exe	88
PID 3732 wrote to memory of 5084	3732	Jeekkafl.exe	89
PID 3732 wrote to memory of 5084	3732	Jeekkafl.exe	89
PID 3732 wrote to memory of 5084	3732	Jeekkafl.exe	89
PID 5084 wrote to memory of 4932	5084	Jnnpdg32.exe	90
PID 5084 wrote to memory of 4932	5084	Jnnpdg32.exe	90
PID 5084 wrote to memory of 4932	5084	Jnnpdg32.exe	90
PID 4932 wrote to memory of 384	4932	Jehhaaci.exe	91
PID 4932 wrote to memory of 384	4932	Jehhaaci.exe	91
PID 4932 wrote to memory of 384	4932	Jehhaaci.exe	91
PID 384 wrote to memory of 3488	384	Jpmlnjco.exe	92
PID 384 wrote to memory of 3488	384	Jpmlnjco.exe	92
PID 384 wrote to memory of 3488	384	Jpmlnjco.exe	92
PID 3488 wrote to memory of 4332	3488	Kldmckic.exe	94
PID 3488 wrote to memory of 4332	3488	Kldmckic.exe	94
PID 3488 wrote to memory of 4332	3488	Kldmckic.exe	94
PID 4332 wrote to memory of 1752	4332	Kihnmohm.exe	96
PID 4332 wrote to memory of 1752	4332	Kihnmohm.exe	96
PID 4332 wrote to memory of 1752	4332	Kihnmohm.exe	96
PID 1752 wrote to memory of 1540	1752	Keonap32.exe	97
PID 1752 wrote to memory of 1540	1752	Keonap32.exe	97
PID 1752 wrote to memory of 1540	1752	Keonap32.exe	97
PID 1540 wrote to memory of 2120	1540	Klifnj32.exe	98
PID 1540 wrote to memory of 2120	1540	Klifnj32.exe	98
PID 1540 wrote to memory of 2120	1540	Klifnj32.exe	98
PID 2120 wrote to memory of 4740	2120	Keakgpko.exe	99
PID 2120 wrote to memory of 4740	2120	Keakgpko.exe	99
PID 2120 wrote to memory of 4740	2120	Keakgpko.exe	99
PID 4740 wrote to memory of 4988	4740	Klkcdj32.exe	100
PID 4740 wrote to memory of 4988	4740	Klkcdj32.exe	100
PID 4740 wrote to memory of 4988	4740	Klkcdj32.exe	100
PID 4988 wrote to memory of 320	4988	Kfqgab32.exe	101
PID 4988 wrote to memory of 320	4988	Kfqgab32.exe	101
PID 4988 wrote to memory of 320	4988	Kfqgab32.exe	101
PID 320 wrote to memory of 936	320	Klmpiiai.exe	102
PID 320 wrote to memory of 936	320	Klmpiiai.exe	102
PID 320 wrote to memory of 936	320	Klmpiiai.exe	102
PID 936 wrote to memory of 4392	936	Kfcdfbqo.exe	103
PID 936 wrote to memory of 4392	936	Kfcdfbqo.exe	103
PID 936 wrote to memory of 4392	936	Kfcdfbqo.exe	103
PID 4392 wrote to memory of 3084	4392	Llpmoiof.exe	104
PID 4392 wrote to memory of 3084	4392	Llpmoiof.exe	104
PID 4392 wrote to memory of 3084	4392	Llpmoiof.exe	104
PID 3084 wrote to memory of 1552	3084	Lbjelc32.exe	105
PID 3084 wrote to memory of 1552	3084	Lbjelc32.exe	105
PID 3084 wrote to memory of 1552	3084	Lbjelc32.exe	105
PID 1552 wrote to memory of 3776	1552	Lehaho32.exe	106
PID 1552 wrote to memory of 3776	1552	Lehaho32.exe	106
PID 1552 wrote to memory of 3776	1552	Lehaho32.exe	106
PID 3776 wrote to memory of 3112	3776	Lnqeqd32.exe	107
PID 3776 wrote to memory of 3112	3776	Lnqeqd32.exe	107
PID 3776 wrote to memory of 3112	3776	Lnqeqd32.exe	107
PID 3112 wrote to memory of 576	3112	Lfhnaa32.exe	108

C:\Users\Admin\AppData\Local\Temp\5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe
"C:\Users\Admin\AppData\Local\Temp\5855d2acd767ae0e4c2a314c9023a1f73cef26fdd93181d6dc97384fb520272e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\Jfnbdecg.exe
  C:\Windows\system32\Jfnbdecg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\Joffnk32.exe
    C:\Windows\system32\Joffnk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\Jbdbjf32.exe
      C:\Windows\system32\Jbdbjf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        23⤵
        Executes dropped EXE
        
        PID:576
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        24⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        25⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        26⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        27⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        29⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        30⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        31⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        32⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        33⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        34⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        35⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        38⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        41⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        42⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        44⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        45⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        46⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        48⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        49⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        50⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        51⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        52⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        54⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        55⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        56⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        57⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        60⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        61⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        62⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3412
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        64⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        65⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        66⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        67⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        68⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        69⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        70⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        71⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        72⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        73⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        74⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        75⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        76⤵
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        77⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        78⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        79⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        80⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        81⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        82⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        83⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        84⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        85⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        86⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        87⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        89⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        90⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        91⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        93⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        95⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        96⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        97⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        98⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        99⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        100⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        101⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        102⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        103⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        104⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        105⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        106⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        107⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        108⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        109⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        110⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        111⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        112⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        113⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        114⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        115⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        116⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        117⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        119⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        121⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        122⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        123⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        124⤵
        Modifies registry class
        
        PID:660
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        125⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        126⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        127⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        128⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        129⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        130⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        131⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        132⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        134⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        136⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        137⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        138⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        140⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        141⤵
        Drops file in System32 directory
        
        PID:784
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        142⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        143⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        144⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        145⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        146⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        147⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        148⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        149⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        150⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        152⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        153⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        154⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        155⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        156⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        157⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        158⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        159⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        160⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        161⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        162⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        163⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        164⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        165⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        167⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        168⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        169⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        171⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        172⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        174⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        175⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        176⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        177⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        178⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        179⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        180⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        181⤵
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        182⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        183⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        184⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        185⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        186⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        187⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        188⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        189⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        191⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        192⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        193⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        194⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        195⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        197⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        199⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        200⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        201⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        202⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        203⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        204⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        205⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        206⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        207⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        208⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        209⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        210⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        211⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        212⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        214⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        215⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        218⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        219⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        220⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        221⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        222⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        223⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        224⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        225⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        226⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        228⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        229⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        230⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        232⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        233⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        234⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        235⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        237⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7876
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        239⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        240⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        241⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        242⤵
        Drops file in System32 directory
        
        PID:8048
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        243⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        244⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        245⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        246⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        247⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        248⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        251⤵
        Drops file in System32 directory
        
        PID:7532
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        252⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        253⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        254⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        255⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        256⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        258⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        259⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        260⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        261⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        262⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        263⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        264⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        265⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        266⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        267⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        268⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        269⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        270⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        272⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        273⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        274⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        275⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        276⤵
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        278⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        279⤵
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        281⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        282⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7908
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        284⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        285⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        286⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        287⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        290⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        292⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        294⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        295⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        296⤵
        Drops file in System32 directory
        
        PID:8636
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        297⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        298⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        299⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        300⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        301⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        302⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        303⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        304⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        305⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        306⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        307⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        308⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        309⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8224
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        311⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        312⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        313⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        314⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        315⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        316⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        317⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        318⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        319⤵
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        320⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        321⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        322⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        323⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        324⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8216
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        326⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        327⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        328⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        330⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        331⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        332⤵
        Modifies registry class
        
        PID:8984
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        333⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        334⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        335⤵
        Drops file in System32 directory
        
        PID:8368
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        336⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        337⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        338⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        339⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        340⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        341⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        342⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        344⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        345⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        346⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        347⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        349⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        350⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        351⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        352⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        353⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        354⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        355⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        356⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        357⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        358⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        359⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        360⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        361⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        362⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        363⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        364⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        365⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        366⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        367⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        368⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        369⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        370⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        371⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        372⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        373⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        374⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        376⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        377⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        378⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        379⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        380⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        383⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        384⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        385⤵
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        386⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9788
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        389⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        390⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10084
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        392⤵
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        393⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        394⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        396⤵
        Modifies registry class
        
        PID:9780
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        397⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        398⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        399⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        400⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        401⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        402⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        403⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        405⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        406⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        407⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        408⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        409⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        410⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        411⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        412⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        413⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3732
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        415⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        416⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        417⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        418⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        419⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        420⤵
        Drops file in System32 directory
        
        PID:1552
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        421⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        422⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        424⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        425⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        426⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        427⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        428⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        429⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        430⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3548
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        432⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        433⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        434⤵
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        435⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        436⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        437⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        438⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        439⤵
        Modifies registry class
        
        PID:1348
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2216
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        441⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        442⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        443⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        444⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        445⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        446⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        447⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        448⤵
        Drops file in System32 directory
        
        PID:4212
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        449⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        450⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        451⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        452⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        453⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        454⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        455⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        456⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        457⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        458⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        459⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10672
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        461⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        462⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        463⤵
        Modifies registry class
        
        PID:10796
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        464⤵
        Modifies registry class
        
        PID:10836
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10876
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        466⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        467⤵
        Modifies registry class
        
        PID:10960
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        468⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        469⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        470⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        471⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        472⤵
        Modifies registry class
        
        PID:11156
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        473⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        474⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        475⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        476⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        477⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        478⤵
        Drops file in System32 directory
        
        PID:10356
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        479⤵
        Modifies registry class
        
        PID:10380
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        480⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        481⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        482⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        483⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        484⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        485⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        486⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        487⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        488⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10828
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        490⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        491⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        492⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        493⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        494⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        495⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        496⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        497⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        498⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        499⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        500⤵
        Drops file in System32 directory
        
        PID:11256
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        501⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        502⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        503⤵
        Modifies registry class
        
        PID:988
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        504⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        505⤵
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        506⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        507⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        508⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        509⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1712
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        511⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        512⤵
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3480
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        514⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        515⤵
        Drops file in System32 directory
        
        PID:1512
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        517⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        518⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11104
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        519⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        520⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        521⤵
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        522⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        523⤵
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        524⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        525⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4308
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        527⤵
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        528⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        529⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        530⤵
        Modifies registry class
        
        PID:9432
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        531⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        532⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        533⤵
        Drops file in System32 directory
        
        PID:232
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        534⤵
        Modifies registry class
        
        PID:10928
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        535⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        536⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        537⤵
        Modifies registry class
        
        PID:11084
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        538⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        539⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        540⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        541⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        543⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        544⤵
        
        PID:572
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        545⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        546⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        547⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        548⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        549⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        550⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        551⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        552⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        553⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        554⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        555⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        556⤵
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        557⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        558⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10636
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10748
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        562⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        563⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        564⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        565⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        566⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5620
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        567⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1740
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        569⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        570⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        571⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        572⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        573⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        574⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        575⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        576⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        577⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        578⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        579⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        580⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        581⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        582⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        583⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        584⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        585⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        586⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        587⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        588⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        589⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        590⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        591⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        592⤵
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        593⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        595⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        596⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        597⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        598⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        599⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        600⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        601⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        602⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        603⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        604⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        605⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        606⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        607⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        608⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        609⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        610⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        611⤵
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        612⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10528
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        613⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        614⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        615⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        616⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        617⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3684
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        619⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        620⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        621⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        622⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        623⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        624⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        625⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        626⤵
        Drops file in System32 directory
        
        PID:11344
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        627⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        628⤵
        Drops file in System32 directory
        
        PID:11432
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        629⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        630⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        631⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        632⤵
        Modifies registry class
        
        PID:11604
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        633⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        634⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11680
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        635⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        636⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        637⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        638⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11856
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        639⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        640⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        641⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        642⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        643⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        644⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12108 -s 420
        645⤵
        Program crash
        
        PID:12164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 12108 -ip 12108
1⤵
PID:12136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aafemk32.exe

Filesize
256KB

MD5
425875d52c0cc597487f5fa6aa35e0f4

SHA1
e5df67468bb22f3b9e09f4789522745fbced5be0

SHA256
85fe92aacb96f0fee54222356a77f1644f4dd8394562c315ba01ccdd8d10a12f

SHA512
e8b814609b39cb10b7eb63ad6c47d2e3b8c77e11342038d42d782509c9c831dae0ab301783a91c7c5e351a3800091d0199fd64a49d92c0781d38219e7344fe0b

Download Submit
C:\Windows\SysWOW64\Agiamhdo.exe

Filesize
256KB

MD5
e97f12424f2fc921d4fe019724ebbdf8

SHA1
9dc6700e247f94fe4dfb8642639e1eb55a9d2e7d

SHA256
4f133ad3eebe6114d25ff6ac0c996ebb20e4c91624edd96778785c1df65da14c

SHA512
304e23177cd476d83ee3db1c5c1c747ea08661e30da8e0374e22388734da21948d88238fa2d6d6bc5c71e89c46bbef309179b1e071f99d183acc9f11c7ef2476

Download Submit
C:\Windows\SysWOW64\Ahcajk32.exe

Filesize
256KB

MD5
2417111f019e7975a8eef9e641a1ec1f

SHA1
3b2e8ba22d073a2f584901f3e3b54d9cdeae1d5d

SHA256
03231ab219e0f90a068ad3f40d94b1181176c3de0dec6c2351c399d5259645c0

SHA512
1f3e1bf89c43f75fc559f2cd1a4b9ab5ce092367778913c22244946b298248ae99357b21331a590048940451e3dcd9388976d2b6b4304b15e96119c9438675bb

Download Submit
C:\Windows\SysWOW64\Bhoqeibl.exe

Filesize
256KB

MD5
c7d171713776535beb95a7aa9e5e5b24

SHA1
fca98982334b9aef3fbf8a3241435404bd75878f

SHA256
f1d14340ca3bd7395046a114e17f8418430f34a3a8541136b4db38b5140536aa

SHA512
69f0a22740fe24810b0bc7cc836cb67904c75a523379a9de521193b2a2a3d616dde01313c516a1583fcd0d878cdcac5c30e3e0323af905ccf15298aa1dd97203

Download Submit
C:\Windows\SysWOW64\Bjicdmmd.exe

Filesize
192KB

MD5
232b5dcced8954633f829086f370de18

SHA1
53252ef85ce884ecca5cefe148cdda0d070b43c8

SHA256
482e3f9e1a6fe7f40a9db0be08590ccdab1af91dbaa7228fa88d18ba663d2f19

SHA512
26c03552121c632562d763f3b4270332837a11f79526008c3b95ab9df8e29d0f8b53d94cabc647aa381503527a53734ef9d7a23df71e077c2a5aa885896968e8

Download Submit
C:\Windows\SysWOW64\Cadlbk32.exe

Filesize
256KB

MD5
92d81b33ca5e5e91b4f2c354d91f4375

SHA1
a8d7b4c23f3b938917ae4d6133fa58846060bb39

SHA256
918397a1b7747cbab7c910c837ea7f3d36eabbeabacd8711660b8a4f470a665b

SHA512
dffdc499897d2d0334cab0dcf70861f3ffb50bd6dfcc1c00a90ee70939a409af478348f52b06ece586b4665ab8d99bb6309e5b88562e8046ea5ffb3ae195816c

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
64KB

MD5
47f50d7f22e8c9725d14a85c7eaa54d4

SHA1
8dff23d1ae806d650cf2c290535fbef601a0ff7f

SHA256
b932f8be7aa5394605c66584c7a6fe09dc5994694267a42a0a8b2848cec6abe0

SHA512
cc033183e49512dee3c8ee1ca06906e6ac1727a36ea9d82cd60d0e336b9b7ea88b31465d6932bb9848c810d8789a49034494885cee176e6c6a689f849f7f862b

Download Submit
C:\Windows\SysWOW64\Cfldelik.exe

Filesize
128KB

MD5
4536426defb3d86304bee1808f007796

SHA1
5d3e36e616a0d9a5d112230d317570d94c3388a0

SHA256
6962310848e987f4efc08b7b75cd17cdfe0656103745a1925bd078c81a605803

SHA512
d90328770254de91d95ca1cea6babdbd5fd1e8dcac3eba83ff7de7a5afcc2d5aab32006836a22dcc6c82c2cd90a21777ee4b28393264f1e607a220c8c02046e4

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
256KB

MD5
972bdcaf3591d9725a34b45eb2ce26c1

SHA1
abe54cd0259b91b07b0d847ad4b20aa1e50c0458

SHA256
4e7870181efc6691e105bcde372fdc8562ab22c937faa72ef6dacd38f17d8fba

SHA512
c6f0f48582fc9e4091d8ec0df05ca4b3290fe5ac26e63597b35d9bebc075256eeec81bfb55c82aa0c0e9824227082f5bea6161894d25a392035669e823834cfa

Download Submit
C:\Windows\SysWOW64\Dinmhkke.exe

Filesize
256KB

MD5
3ad61bf5e3759a388dfb4e40cbcaf7b2

SHA1
ac9332b2d14199bbffcac3c770243b38c17aba9b

SHA256
3947a902df9ae87410a4bf12dbc18d80444e8aa70be2c2ab8f683a20bc689923

SHA512
772c438ee026f3026111617cb36e2c5e5a49c60fde44b32a1222a18f0abe078df53ccbe54a8ca3528c92446e3cb90bcb33a32fbf59b5b831b3ea7aec0552fa2e

Download Submit
C:\Windows\SysWOW64\Ebejfk32.exe

Filesize
256KB

MD5
a7522de849215752f9662386f1394d2b

SHA1
90ebcae61dfbc98b532f18faca7d828cac5caa6c

SHA256
5b7158df522e2e18e0bc50d38c31e4512daa49dd35b83909e7b6e6c79133a7ed

SHA512
f7162a4a54d97b68cbc39884b7e7e643fd74f440991ccfee53c626f208ae1946056ef63b823de860fda6a395150000687f23c5dfb35761685da91579ba27edb4

Download Submit
C:\Windows\SysWOW64\Ejalcgkg.exe

Filesize
256KB

MD5
3e974da843aa41d34d699abd9894bebf

SHA1
595443f9cd7f588686bfae6b584d2d32de9fdecc

SHA256
e78d0124aac32650cea50b2894f737fa9b361b42eebda8018b9d85dcfa130e7e

SHA512
79e2148c3b6664d21efc9ddfc14de37141744edc9368d6f24a34182261f1165832b6353a6f75a3ed4cee220b6142892c96ef456f78808f5f36e0b8dc022874c0

Download Submit
C:\Windows\SysWOW64\Epjajeqo.exe

Filesize
256KB

MD5
a48d88f4ca4ce493e3d3c7fbd50c13f9

SHA1
3d88f8edcf0105d55e357541f00e3c2be35adbd9

SHA256
a608c2565d1f74139a7b90c885f2039874454ca08c807687d98d5f365d2a3a88

SHA512
74bfc5e3e74f6c8800aa03f0ae568a97c174392c84c50ca072efd8072a2fe51911a3b12feb647e4f0cf2cce37b80b719bd83ff3be56e6e466510426fd5f13b56

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
256KB

MD5
1125571e783d60c357868cf064889465

SHA1
1d509d2bdd09c263e639ebd1285b63bded3def9f

SHA256
4d548ba478fd3887ec6043289c922d97ae6157e38df3031bd2417c70ced9d35f

SHA512
1419a9a17a49a4b432ef7d38f19046926842a834456096eba844a98decf98eee7c841cd5ef44deec2912215e1d974d3e694b3d5f0de578bd3e0904a6805e5e8d

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
256KB

MD5
823bb46246d65e25d705c57b58cbf4f4

SHA1
58d550d06164d4b21256b36bad32ebb9460ba566

SHA256
b109848808fd3f5c539112b12396a72d34bf5d662deae370b24408564683aae0

SHA512
6a3361516b3c91a138422d10a02d993da7a4e4daa99544b1eb33bd2064f55a6e4cabc5805249d977ea4a3aa034b62ff23f80cd46c05942c9c7df61abf703299c

Download Submit
C:\Windows\SysWOW64\Fganqbgg.exe

Filesize
256KB

MD5
0e56b5ab130414fa4b49c87bda882ecc

SHA1
58e934db41329401c64f231cd03f96db58e043c6

SHA256
b4b9089e8c44227d70293568331be7dc29084a8434f33e9904cc3d0ef51bb80c

SHA512
f1a97cc3a7c9ef4b35e63e95ecf1d8c5e4aa4eb9cf2d02975916583a8e4c7e3b4919ce9a839b127e81535bdff4246d88a7364c7ac16c28a21934e4614643553d

Download Submit
C:\Windows\SysWOW64\Fjadje32.exe

Filesize
256KB

MD5
3d70375ac73d3f524fbe9f0d6eae401a

SHA1
7037e454a6e3468654463c1a1fe66f31290659a4

SHA256
4ba2532f1e51451d49a6cc0fa7a316f9fd01b5bb7e809422bfc2adbd53a6d99c

SHA512
a8874e6fa9b6be75b94840941e697c07d60a0199b5dce3dfa635af4b9ec5faefd65f9650e16ae1bf5b4aa9f273e3d019a8dff5b838d4437e3d3b5d329bc7af95

Download Submit
C:\Windows\SysWOW64\Gifkpknp.exe

Filesize
256KB

MD5
15c3845e8898db8840de22ea591e3bad

SHA1
7a9d7223550c456fba3335c490c9da2e469c2446

SHA256
c473d5db79a73770439b2af4ced4348223d55016b718a6bb4cfcd3d1efd088d0

SHA512
a766efcb1044c89548f3f2d1f3d6da8948ab784a8a940fe6d6ce63f28388f3ced57ca20ddf198f0a97acfe150ba17a64cc3d23e9505e99112c36a2a38a5ecf95

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
256KB

MD5
89af7a71237bed2352d8e068dfc0e551

SHA1
d3e6e341b0b5ffd21f39a21dae504842f195aa35

SHA256
6276e9b886016a492cea170eb711fd6432590bb6e8afe21ea3f7df56089ebf8c

SHA512
67fbf2f20819822f62cfcc4a4b34bb334c4b3edc95317b4b8fc0405d5def0e36d74a4b2319d47976eea2b3eb57e4933bd88300b7b5fc13bf81a170efc812c4a2

Download Submit
C:\Windows\SysWOW64\Jadgnb32.exe

Filesize
256KB

MD5
3e5295f9d851323aad0a1b1afce54777

SHA1
25832366ebe4303febc48014541eb16593f263d7

SHA256
c7d296a18927b93c29bdc74443f5bfe5a282364b8f6838c21edd74cb1930778b

SHA512
c06e997a4310fade6170da01c64388dbcaeb7a36bea4fea3d7a107038dac240c11288ad0b4135c2400ee42ff1cb9af3253e90eca7d4370c9b7fc90be08458049

Download Submit
C:\Windows\SysWOW64\Jbdbjf32.exe

Filesize
256KB

MD5
b0eebeaac46026439b8fe1c0ce28eec1

SHA1
9d6fb7ecbeb65596bd8b81e7e2d6982867ea7157

SHA256
fea7f9b2302d5c864b5b568ca60cb0c96cd2579d0ccd9c7ecbef29806643fca2

SHA512
d3ad34f61e96061c190bdd2df34fcb6ddef407b3cfed445636bd87353bb52d8c1ed2c0a59c2e9bed52a62e87cf171f2284435d3b6ae01e0054aa88ac9a25235f

Download Submit
C:\Windows\SysWOW64\Jeekkafl.exe

Filesize
256KB

MD5
e8eba16d210af9a37d416d6d814e47d2

SHA1
41d917e6591848ff7e1ee218ff449ffee9433a3c

SHA256
ebb87517bbb7b52fc25f19ca87dfe4b37c1f0401673ef317468379b911105902

SHA512
145c57898029b3e17faaaf80963527d191654c97f045e611d6cb044462852d96d12cdf03ef7cf6c4d0cc611fdd26ddca521e5e58db7c642b087f08a9663246d2

Download Submit
C:\Windows\SysWOW64\Jehhaaci.exe

Filesize
256KB

MD5
032e8eedf53195576c1f94e58ac281fe

SHA1
f9389a22fab24e0b56a7595b8fdcdbcbdbfe3d02

SHA256
62527a7ddbf2fa145678a043fa277b41e2ad1fc1281f525dd01a1a3b25e01e43

SHA512
a02382bd4af77ee03879f16091c361ab8cb489138dfc50b90ca31a5bb8279458f44ad0bae36e3d3043a4f0dd41fb146c9967434b87c90cb17da0946db6b80028

Download Submit
C:\Windows\SysWOW64\Jfnbdecg.exe

Filesize
256KB

MD5
be20667147d698f275c59f8ee4442511

SHA1
bff0cd46f5c335ad07b087f37bf526c4e3ebdf22

SHA256
93f38b607510a4dccf7f76c61b55e13fd43bcc639187741068473d572b2a2284

SHA512
58385c6b7b307cac2b72a953a3f8a3c6a750b34b9b160084f96437a5a85655a07b4eccf4d9365b143f7231d30725fdf726af6ff58d44291c28f246f09eb918d2

Download Submit
C:\Windows\SysWOW64\Jieqei32.dll

Filesize
7KB

MD5
2bb715d1ee6803e962ec0afd2195c69d

SHA1
2342f6ad94b056aa77dbdbbbfb8941a31a49c7b5

SHA256
4ac9370364f9e430c1105cfdf9816b4fb0ec9f75173ceb0e8a1bf031eb4735e4

SHA512
762d02038896a463294a26e84df38cfb48b441250cf231d0ddef06196f59183d01dfc608eab669d95d916d387fee07c8185d9f079e4f46ef0678698cdedf695d

Download Submit
C:\Windows\SysWOW64\Jklinohd.exe

Filesize
256KB

MD5
38830bf3d2f3ca73cdba119fe1f08143

SHA1
2460c53020e348b4f4c7019c0b96bb507be6736e

SHA256
c685aa6817dabeae088717f041b1f6895a0c6b6054dbd653c1fa04ad4b2953dc

SHA512
4d586d5d0f1d4190a084022e40f55f6350f78aa3131506553b0ad2a9cd5b0ecadae1d2e5ca793ddbc8d9b72c9f39dfa20fc2b203502899fe9f99bf97e70061ce

Download Submit
C:\Windows\SysWOW64\Jnnpdg32.exe

Filesize
256KB

MD5
2d4c7c2fcd4a299894f36c541815c295

SHA1
80e02a27667f13c3a9f7513599b2b370f454535c

SHA256
2edf86fe76f59343a3d923b0da3003ad3b39abe154b701fa09aeb9a8f2532ce2

SHA512
bd2dc22b074106034f2d8c7b6436aa55b36fe55b1edb56b9b97719853796b0bc7e8f404fb185df656fe6b6664b1bcbc923d3953245a696676cd33c4936d0d2b4

Download Submit
C:\Windows\SysWOW64\Joffnk32.exe

Filesize
256KB

MD5
3a7e8b0742c50584c6aa8c0c7c2f5c7e

SHA1
25312e7272f2353f1e2ab6c6710956e1a328b311

SHA256
535a3a6ebf049a55669ddbce0b92661f4d61179707ae6f06ec8d740f4e70fb99

SHA512
63c0353f0881476e56cef8a9060d27a9f5d3d008ef0fe076f9d9f177dbefd087942b1a86da9d88e7fcf7616fcecf1e6a9f1888f34a357d77d26670620baaa379

Download Submit
C:\Windows\SysWOW64\Jpmlnjco.exe

Filesize
256KB

MD5
7975ffb378d959a114bff6d57392a4b2

SHA1
9962ccbe5931d656f7a300a424e6348f7eba6722

SHA256
0c424674810089c383511bd04df3ed754c3ab5aacdc64039d7a87b45157269e8

SHA512
90407573b3a75e0bd380b6048a45393087a6b3ef9e35c4e1ecf76eaf579832c562ff28fc1a40cb2712a9ae898ba75bbf36d54c333337d3e6af8d5924d17284f6

Download Submit
C:\Windows\SysWOW64\Kageaj32.exe

Filesize
256KB

MD5
5c8bc92890e16af3365ddc9f86efe3de

SHA1
7b2a04f354b48c06cd613f157c764dcdd65cb312

SHA256
87401420682f1d1a6234a4537d2a6c7ecbce251c3d3c58ac085dd16c9e61507d

SHA512
03210f1ad054cfa6b154d6225fe4ca0fd368f2ea86414cc9ac6474a0841cac6f0d1cf20856777001f8a9a1e39b1d0a24fd16bbd224a5dc25683f8c9f8b0d3cab

Download Submit
C:\Windows\SysWOW64\Keakgpko.exe

Filesize
256KB

MD5
7fb5e8d99bc8a3b3891d06b5153db12a

SHA1
41069575af5da2e4dad66327d667f4f037439144

SHA256
4f39b17d63a4d1981a98f6411ffe93f1b2efe25d00436c6c044795328984633c

SHA512
b936039f8022568b9e11de7b9cd93b34d414ce5369eb025905233c211f4c25fbea7db1da3358a98cb32a07057e464b16110006242770ff2e392b614b1b2b87e8

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
256KB

MD5
3de4a67f4ad3507ee3dfcc3fb5df68cb

SHA1
f669dbd81bca1e91b94249f2aa01c96e7f31bcb8

SHA256
3b0010d6caf004b19c0a00b8c2fa6032fcb0d4a4d02bf1c331138afc9d563779

SHA512
4ab43baa149473c516b98a1f67f5ae1bc9b39a4f4cb1b69116727299638a2a01ef4cc63f619ea4cf3edc705db41d6ba80573d1a00ceb5f8e69d27cbb15270459

Download Submit
C:\Windows\SysWOW64\Keonap32.exe

Filesize
256KB

MD5
e5b755f5c35dbdd19e08e9ec2ea18cf2

SHA1
25786f8ce6338a465ae38ac33edf022bf4f91dcb

SHA256
2c5605f1c2c3f21779ae7ff55f7d3feff5c85c69b4edf5275694189b99c6d281

SHA512
51bc36d0a65f72ad0417e20f1e91e39915ec0c8bc30d5bd4b0dc30a89479b56590f76d19a2a6e7a4016bf514eae6ce098d6863c1521168765b6bb0d6e498140f

Download Submit
C:\Windows\SysWOW64\Kfcdfbqo.exe

Filesize
256KB

MD5
6d81e0a74e80fe696fa5bf166ea9bd17

SHA1
87fee7a61aa46d7377f2f7b4e38c0117b98d2b9b

SHA256
63ce610008dfc7b1fd4ded65e3f6584475333dd26209758b43dd32422526a632

SHA512
2a4be000cea8565c90915217d66e73ae9cd6a0aa27d75d300d67e27c649515dbeb7cecd98e3896886fc04e9d3841bbaabc1acf93a3fce889cfe9799454105368

Download Submit
C:\Windows\SysWOW64\Kfqgab32.exe

Filesize
256KB

MD5
f0c1e1839ad88c38f277f726591bda12

SHA1
89f1e54ad6a32e0ad39c710c037d57916b197d47

SHA256
8f36597ef119f7e00ff7787718236481a45d8fcc678255cbc665c15fdc74b125

SHA512
04dffbd317be72ba81d3880d87e8b694514f4c3d090ea7d06cb7e0dd8c232a16a9e4f5c863fae8e16981e81775d35cf1c111a7c4e0468c4e65095e61972b8aff

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
256KB

MD5
74fa7ab329f62147c2e4f96793365e3f

SHA1
2c5e2fe735796bcaa91a3db5151eea56aa478289

SHA256
4d602bd9f0208fca46415d627f718fe7d984f9ea8d0b7a2cc846db9f336dc88b

SHA512
fcfc0bb4be5f3aa6c3020ae7dea4fc19c35349f8b8b9d4b7af32053363d0fc9fab9f04a15ade71625334acd2438b75f2b1bee820e98754afcc67b66f9f35c085

Download Submit
C:\Windows\SysWOW64\Kihnmohm.exe

Filesize
256KB

MD5
ee0074ed1b507a001da1a0346fa4e335

SHA1
a1712330224800ced7ffd260f84a1ae9127c727a

SHA256
cdb2960667b57896d74880760f2deb35cbe985d069c189a719ead2101a11b234

SHA512
4844f0ba12d6ff9c13651ac7ff9d4cdc62b4d1b8f204107c95e087913143fe6b7585e9bd9756105b9d58f32dcf4d5a28b5921c83d0873fcdcacb45e885e08d4a

Download Submit
C:\Windows\SysWOW64\Kldmckic.exe

Filesize
256KB

MD5
356709777f58efc939643db419425e61

SHA1
919653472dcf20f1ad604fc33b358e6a542aa89e

SHA256
6fccddfc59e0fa0d6b8b818a4dfa8e1c66bf594c38606f029d46777a858ba249

SHA512
36ad306715ce52303b18191147abc404a956472d2d4cc06dbe53028af36a9e6cae0cf5b6f128e000841275e10fa163e8225c1f7e7db64b32e6648203a683760d

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
256KB

MD5
152ba8f7869715e6f60c5ff73f53d9c7

SHA1
51dc79bb296b87fe8a0b88fa167fc66d3db52a96

SHA256
085bab5e160dc784f7d3a179ecade562ef9802d9258e5353c79d93cfadebfd74

SHA512
6ebc9a3fd11d8b98e97ee5eec01b90d2edb8a6a68d3bb2c70345e8df8eb868b1175784dee51241cf8bd0045f9b889d24a794ef48c5cfa8679ec48b671eb1fab5

Download Submit
C:\Windows\SysWOW64\Klkcdj32.exe

Filesize
256KB

MD5
90d8e3dea4be76ba48d0672d1e24184b

SHA1
0772257677d69c5e063f8e5e7fa54ec4e549e802

SHA256
38374fb4535f4b92469e63d0dbdce322c59959e92f9980615a72f58549c0552d

SHA512
34265800cb939ea46955c1698c34b0147cb8d9b0ea58edbb999277d63ac9ae4adbcb3e29d6e6fdfe8d75a7f836e62aba2e82647a73437895709bfe1bbb9cb9c5

Download Submit
C:\Windows\SysWOW64\Klmpiiai.exe

Filesize
256KB

MD5
923f0fc2c873d0acbf0002b440f0f287

SHA1
78c8c09391c962968dd8ab7c98477ae28b6fb30d

SHA256
0759c1ae8eb2426885747ee28622337ca8fce23c206efa9dadaed8afdf948060

SHA512
030fa9d2ecf454f2515c69f72b7669e2d6f0ef624799f0906b393b92e0e64f7a22cb9eea00d42f3e49d73338f333ed794b381cec56eea87e01e888212dc0de62

Download Submit
C:\Windows\SysWOW64\Lbjelc32.exe

Filesize
256KB

MD5
85947937eb8f84442d8e43dc9872090d

SHA1
76f18f74ef8f3fef0fec2137816334f68a85be54

SHA256
4cc0b27763c51d9c711b99f7cdbf3ee05d9016a1eab6b6dd44d9be8c0dcd164b

SHA512
5da33904c2732f728dcbb8cff4d9e26d295376ab35336b066b6181f546d02eeb1e91c06f4a50fe37c50099e3036a5f29e1e632632d4ecd15e3f99f65ba60ee31

Download Submit
C:\Windows\SysWOW64\Lbnngbbn.exe

Filesize
256KB

MD5
5200d15c9db97c78fc0b8e72a05e607b

SHA1
5f70e63436ef8f1ae8d372d497425104fedb907e

SHA256
f559d687c829c94868ab7587d7492f675797169dab455a17b4c63b4bc41afff1

SHA512
778289fae3e9076f322d78ab9022f50f056bb91b8aebb373d036dd7057c47d19bec40f6c976d2ef011bb960e0cf927f8971ae574cf6c53109484ca13fce07abe

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
256KB

MD5
a7ba9d4c405a86ccc52e5eaf25f9c8fc

SHA1
5245e36118b0767f8192232946f4b8d507763ad1

SHA256
9a38150fe264e8866f09032fa0c244c88b761f5723f02147b66ab9d73d8f6c71

SHA512
b6be548a98e66a41566f030287381f8ad23f7cb558355c03754ce18e9815f35c87da12a8da5e0dd5a059077c25d528db7f3e6b9574a5835bfc00d105fbfd67ec

Download Submit
C:\Windows\SysWOW64\Lehaho32.exe

Filesize
256KB

MD5
8519230de8cfb2f4e16c5ac2703a26b0

SHA1
65421dad9065b9941fac00f8e6c3a7445156aeca

SHA256
48e295a37c9b82eab8b2cabcea1d4c89021164cb8cb9b842e87ed3a5c4e5c82b

SHA512
6c5a18703c065114a9dcaa61d1c2d2da5b86b55eab5cbb165b5669fab60ebe43220694738ee75628ceb245c762e008a364a5f235dc6aaec84cb7952e692a1d85

Download Submit
C:\Windows\SysWOW64\Lfhnaa32.exe

Filesize
256KB

MD5
1e45fb9e776d5d7c9c9ca5ac44d7075e

SHA1
4b11db32d3eb2ac5049e6533c7cb0b5d1f7f1149

SHA256
2a4d65d346f5b9d9a3a6c9d45e6e7b94457eb9d6f5017622d19d8de291dd255f

SHA512
8b60868f60c1d7def5a2e619ffdf04d7b154fb5c50524caa3f3c73def9ce7fff8897b39863382fdba99e45a3c38a7da803e1915e73e543da4120ff58aa93f4b4

Download Submit
C:\Windows\SysWOW64\Lflgmqhd.exe

Filesize
256KB

MD5
9304273556b07f882bb3e2ef0199b837

SHA1
dfa21109f57f4a20eefa3280b7723d01d98d48ad

SHA256
815079502b4c456209498915f531fedb3bfe67bf1f6fe160491f5b55bb1e6c70

SHA512
01c74fd0bbc1232151acd283f650b30fbe3f5cebe1a8fbd5b173615d1b8a7c4dedd29914ccc29fe48ef2fd76964fd50f05a57ff703432007a2efa6b38910dffc

Download Submit
C:\Windows\SysWOW64\Lhijijbg.exe

Filesize
256KB

MD5
81d5dce837d4539d6e7b691abb83b803

SHA1
d9cd4854c120723f583e7a9438dd13ba088bc39b

SHA256
15046270c6a3a6ba1bb6cb7f233b1429293be9be43abd2ad0147ed5e97f13237

SHA512
d072f937ba177d0a7b2848533ef52d606b19b153c77176e2d94a2ee8796f901bc44561570c3f80298596dd89970d8a2a19dbb2a5d9effc4976dfb646a79f8cb6

Download Submit
C:\Windows\SysWOW64\Lhncdi32.exe

Filesize
256KB

MD5
3cd2d6208eab53b513a328e9fe91f609

SHA1
bc6ed2fdca16e15ea61e7079463ee132b0ed519f

SHA256
d3ca5955ebf999c09daf09da12b89ee76c69fbd99651ec5abc6af141c64b230f

SHA512
ada49880a25babbb2f6d764f8882e8fd6384596e0f6c134324a6e2e8f835873f8f5bb254500adbc446d82d6a7c96fbdfda6b6864e6f2d09853b8f63d8ffb63a2

Download Submit
C:\Windows\SysWOW64\Lihfcm32.exe

Filesize
256KB

MD5
c85e88d6b760e330fcf909c63a3ddc3f

SHA1
53c5e7e24f7015151c6cad8d7b1949b4967fdb22

SHA256
467a175c4fb7a403ea2db7f5e329d7f6155a77d915b2f6ca8eed23e905fa0fb6

SHA512
465a9c8996b6a9f904a04d45d5103eee757e9eb9c73e77b0b7099311cb1172f36a40c58be660ba15d55c8c3052534c2cf1ff5ea7bbc84c80f8f28a964c4673fd

Download Submit
C:\Windows\SysWOW64\Llpmoiof.exe

Filesize
256KB

MD5
3a26e23dda35986b36ddd8bca6e9d3bf

SHA1
ec953e64fcba3c734c99c10fa1c16b2b5fbef38d

SHA256
ec1868473312be7faa9082b4c5962768d11700a3d965d5f51430bb59b8553b95

SHA512
1ff6261e4fd161b38f5cafceef532174fa125734f0da2942f2e127ea2892f02caa803862c61d99d9b88adfcc352d9dbb6fcd55be4f02308d4f4ed7e73580040d

Download Submit
C:\Windows\SysWOW64\Lnqeqd32.exe

Filesize
256KB

MD5
0b5b27c6c2a08c2c812d309304f97e40

SHA1
3c7ecf299e5082c90ce7d0d7fbe89724c6793fba

SHA256
1132d1bdc049823f919ea939a65f93cd4fa8f07d53bbab15acd6670ddba231f2

SHA512
6370244ccc6c6f43e07083ce82bb42ad3633628df0366232d7571905bc3739e59e2814f09caa77a1e22cf46fe6ffcc12d907c5a7fb7ed6e05739677b808e8979

Download Submit
C:\Windows\SysWOW64\Loglacfo.exe

Filesize
256KB

MD5
6609d6d50a7a51787b83d16b0f96df0e

SHA1
303b78c753adf8b17e97e8f68df5b26da937bd40

SHA256
6cee437a09a8076a605350a2938490efd29e8d2cbc620875e7cf72515de697c7

SHA512
08ad1d1ef8e69dd71b3bb0aa0a403b312a3b31c7c3269128bf185afd1ff0fc6caaad1f98fc146a05e2a9518dcd991e034cbfc282e4f33e10b2183aa4ba2a9c9e

Download Submit
C:\Windows\SysWOW64\Lpbopfag.exe

Filesize
256KB

MD5
504da530a426eb6ecfa64ef3d2df40cd

SHA1
5212fdcd22fcddc8ecebe0bf3f05dfebdd67017a

SHA256
0ccaa90a79c1b57816eeb90c74c3991e79229281cb81d2e359dff696945ace3e

SHA512
d0780e7c7efeadf183cde30a303338963607ff3f561bbb3e9e5281fbea5f461d0dec01af5597904dd6c66c14a6d91b708367e7f36c3e6d639736a6123f781b8f

Download Submit
C:\Windows\SysWOW64\Lppbkgcj.exe

Filesize
256KB

MD5
a5de2e64d11ea8a88fb701a22cf96191

SHA1
21d0009b55dbd8f5794ba68ace7c515fec788bf9

SHA256
012de16558c219aa0f75a36904f967cdea90cbf98b377ec08cf9f167f7f4fbef

SHA512
d765e76c70248e5c6ff15bde558d7cdc80e0ef519f793e06588da98881b489f9d170374415d669b71a555662f9d6a4171222288ca9991ed33511e9d3938a8816

Download Submit
C:\Windows\SysWOW64\Mffjcopi.exe

Filesize
256KB

MD5
6b5225c3c25c79182b582d8e0fc26726

SHA1
ec072a8bf3e74427d652d37369bed609623a0997

SHA256
33499c3eaf6a6fde499e6577c0064c848ba3030a14d56b86eef227e8871f07f2

SHA512
56d76d14b30032fb9bac9af1a0aff6c6e77fd860b7cfaee4e9e03f5f52eb042e557bc2f422d2ae907ac37e4c7e2dbaf088f6f38ea4d07b813bc854c40581b176

Download Submit
C:\Windows\SysWOW64\Mjbogmdb.exe

Filesize
256KB

MD5
571a812dab8a5d1219d8ced281cae2f6

SHA1
4e7f501e0c2282d8bfd1397c6fd023c012df9658

SHA256
96c2224114ec7d1717599779db6b0745f1e4071422a552da56e7c546201c4cab

SHA512
3966f8e2cd183f1430585a48a6867d5c654db3c0e4e3ffe97d2301cfc2590fe3066895cc09fdf4904333dde7e1618840bb7d5fbff2c0613c06cecabdb86a497d

Download Submit
C:\Windows\SysWOW64\Mjmoag32.exe

Filesize
256KB

MD5
31a85a6411ac34c49d5f1969a0cd548e

SHA1
61058259740fc8c4a0f61ccd57994012d420fafa

SHA256
2a0605eb3bb7d28ecdf1b4186c22745c9dfc90d24b2e81ad7611e26149e6d81c

SHA512
08d9aea772570abb4e06705cb57925eb8fd6bdb5284cd5665d42c539ea6ca2283556a3722cefb62491b1e154a28635db46bd923ced1c85d0386ade019f0926da

Download Submit
C:\Windows\SysWOW64\Mlpeff32.exe

Filesize
256KB

MD5
bf0424e7b408476a52ca0ca795c3e3d0

SHA1
a234187222558f3896619bd0635ce115f053ee49

SHA256
53820894266aa3dc3b6cec77ea7747c532417dcb6732e9781177e314d4da36d2

SHA512
38b711b84ef236b0304c41439344635ded2111c35961b0a80ed29884f740baa66d1d096edd88d414fdeb9280b33b6c26f8849b48a7d504f64dcdf403d17db145

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
256KB

MD5
27c97d985dd2a322d7c0c8abaaf8654c

SHA1
42cc4001c1086569ec718935325972679b68fc94

SHA256
4dcbc09411245393d83ddac3d56d228f742136ca8ad8e0ad182c3ca155487877

SHA512
ffd0bbc6d0b52e02f291442738422dc6372b2db73334dbc932790119382b5fb8f09b1d1b527a5482f3b681b2190f9a164274d82d1233b510340d6970a64d44eb

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
256KB

MD5
495097c87b5f55f7e387669f0a404c91

SHA1
f0e20f9ad21584da00deead5bfffef7fd716f1f6

SHA256
47e99cbdcd14e8dd32937a51de6612a8b7a5f76bbac3ed85efd8026bf0923896

SHA512
d05d9b07d7a82fde64b4167d180d0a873efac48139bfdace91ce3b4d650afd10b8e76e387a3ddd7dfec46ec393b3c207c5e85ebd20223f684034d2454b8cea66

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
256KB

MD5
2edbce77abf40ee55e4609918c52e45c

SHA1
474cde90833cfafb4c546dc7ac7cd87a3a30fcf2

SHA256
ff10d4a6e1d895312aa4b843126935a78c5bdf2f8a7fc662c967fe8dddf6c78a

SHA512
9d39307b6fdafe096a6828a8aca24b0be5afec9c5cb44dbaa8bf15098f3403bb48a7fefcfe357b87e7456b5a80d70099dffc4efa4f8d5b67c9a02f6ecb2efc9a

Download Submit
C:\Windows\SysWOW64\Nijeec32.exe

Filesize
256KB

MD5
0269e9e8946ab78acef4386207644199

SHA1
aadacd19b9a2ebedc383d417d035a5ba011e5132

SHA256
9d24976f6c797d3521939518c7ea9b4d66827b34b3beae5ea03f3b307efb46be

SHA512
fb8d8969d2b2ea50e285886af12cfb586a5e25925cd4777febd049f163e8e3e6aeb77098f4d7c9670309c75b52646005d50e0300d6daf0a45a0680ccfe91bb11

Download Submit
C:\Windows\SysWOW64\Nqoloc32.exe

Filesize
256KB

MD5
ddfe983ef0609fbebf67cdd6b48366b3

SHA1
fb7fdeaff6f84dbfe7a48c357c6b616630a0087f

SHA256
2df0809f01e71ade12f27bbe588c3b835742a13bd9f3c78786308c63c48878b4

SHA512
4e8dcbdcf31a53e76dfd5cdc2f11cb5b7fb3f90c4b19710c397c34c37d0f5fe02c2c867c84bb0b4da8ed715501d2381228441a51718f494ef795a20fbd1ccb12

Download Submit
C:\Windows\SysWOW64\Ohghgodi.exe

Filesize
256KB

MD5
6793e33a94c59caf8c5db07dcf6be116

SHA1
70c6612bf2224659893b2df073b1cad7575fbc4b

SHA256
6639b668236c709afe269cba2851e932a0cb7725040bab48f3d0576accc493a3

SHA512
e2a41df753445673162b39d60ac8f51a091b2604f86542cc79e8a1d2893119fab4c4e60e26640720e75f57f91a48de10283127ae008e36e2e7007655bcdddfe9

Download Submit
C:\Windows\SysWOW64\Ojdnid32.exe

Filesize
256KB

MD5
3a1f22b0370e9d4d7696a3c7fadad8dc

SHA1
cfae80fd86f21ae7a994666a4f7a1e341139c6ce

SHA256
2d4a8c1046ee040c6f89d9f563953390c45bab36a692c99ed51c6ab2c9881f60

SHA512
9bd4f4d4bada1f6d33c313fa0f842e3033c9056f17daa93edfc60c3903d6bc1edbd48957c724555a63490fa4bd3e97ec741e04a2e0f0377c02d2937208c416e8

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
256KB

MD5
c246a673ece2a9c38b0f6c01d4f3266c

SHA1
18b1ef069da4fe38b65310a2406d5f5e63c7b685

SHA256
992511108f6b3add854733ea36bfb9c6634b2dd479de8f7e244338305ef5e5e2

SHA512
2e929b88842e028bb733ea9404d6cf8ddbe906e0869efb889af6dde038ebb39fa73b9167a9f4de6f5fc938bb30888fe39d429174d8a11748c02757daa0a66822

Download Submit
C:\Windows\SysWOW64\Plpqil32.exe

Filesize
256KB

MD5
1ef1bdd88d3e15564ea5e8c35bcdf6de

SHA1
b343c3622d5a4fd0c4fd0d747a9f2b8f930bfac4

SHA256
568fc904e4c1cad8b699282132960e82cfed077cc81772815f8108b452738576

SHA512
22db0a1796b53ecf71f4fb0ee81417f3bf372f65db44e705c4c4cbd0b6312984c61a7fada92cef3e721271fa54beb1b3314adcff39e97097cfcec9ebb2c0d71c

Download Submit
C:\Windows\SysWOW64\Pmphaaln.exe

Filesize
256KB

MD5
cc7999364a51e6c089da3225b08b48af

SHA1
4d138249b4f8098c5ca94b1d97df353414e9cba2

SHA256
c21744206e5d0c3ae8a5a8f4b5cc68c50f74f165fdfd02c9817abef1fc5fd3a7

SHA512
66fba4c0a328c3836acd9973f2402df4732e1737d1018ab8d15d70c60dcebaac7fb2963a009fc11ca19133c19a702d6cfb6b452e6601c7731dafa76f7e1cba5f

Download Submit
C:\Windows\SysWOW64\Pnmopk32.exe

Filesize
256KB

MD5
8e27f1b57abbab736aab549312c82c34

SHA1
812deac1bdd7fc7d75f5cde5a9ff1c7f32141713

SHA256
788d0695b56e36a91d6716050ca7e25d2caa0be9c55b4f661aeadcaf61916675

SHA512
4a9942774da729657d17b1b57b01e5101d48d7446fde65e040e54ba5f88020e8bd247f0276e917abc4b3aca82c67a9f7dac3e5299c1e268504fdafded5abd060

Download Submit
memory/320-124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/384-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/576-243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/860-245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/952-389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1000-359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1148-429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-310-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1232-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1464-353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1540-87-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1552-237-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-254-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1696-377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1752-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1788-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1976-335-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2356-371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2416-395-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2436-260-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2440-292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2464-261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2652-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2932-441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3084-146-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3276-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3380-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3396-407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3412-431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3712-326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3732-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3744-215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-222-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3764-232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3776-166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4212-298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-223-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4304-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4332-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-148-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4428-250-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4564-227-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4568-316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4644-268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4700-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4708-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-401-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-365-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4904-304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-47-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-112-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads