a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe
Size

60KB
MD5

0a0593fb30770a29933866cde112b566
SHA1

00d3d2d28779021727e40bc0087e17d906c44789
SHA256

a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5
SHA512

d229ad81de88a3f0b9bd2506158b1f135a7e91f36de8c1f3079d1d6aa1452e4e38fef8e2d00e83ff3beb4e32a6d6d931ca183dddea5365fac88c67955b1b31f7
SSDEEP

768:DoQa28IENv8CRVea9nU1e0Ffwz8mSYGLq484JJJ2VisboJro/1H5CMB+XdnhMl/J:DJahNv8CRxHzqNAE2VmJiMMB86l1r

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajbmdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aejfpjne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaopp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqilgmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egdqae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccbbhld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iejcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjodl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbghfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npedmdab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabomkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehdmlhcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pamiaboj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emcbio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkjjlhle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poodpmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eggmge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaogak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gempgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgenbfoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjbena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaompd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkhoae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdlpneli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnfjbdmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe

Executes dropped EXE 64 IoCs

pid	Process
3188	Odednmpm.exe
3028	Onmhgb32.exe
4104	Oqkdcn32.exe
4412	Pkaiqf32.exe
4964	Pbkamqmd.exe
1532	Pclneicb.exe
4036	Pjffbc32.exe
1896	Peljol32.exe
1020	Pjhbgb32.exe
4004	Pbpjhp32.exe
1296	Pengdk32.exe
3128	Pkhoae32.exe
3968	Pnfkma32.exe
628	Pbbgnpgl.exe
3640	Peqcjkfp.exe
2584	Pkjlge32.exe
3040	Pjmlbbdg.exe
2056	Qkmhlekj.exe
3652	Qnkdhpjn.exe
3712	Qjbena32.exe
916	Qbimoo32.exe
968	Aegikj32.exe
2804	Acjjfggb.exe
2256	Agffge32.exe
4272	Ajdbcano.exe
1600	Abkjdnoa.exe
1944	Aejfpjne.exe
1748	Acmflf32.exe
3956	Ajfoiqll.exe
1564	Anbkio32.exe
5012	Abngjnmo.exe
2860	Acocaf32.exe
448	Alfkbc32.exe
3964	Ajiknpjj.exe
3756	Andgoobc.exe
2296	Aacckjaf.exe
3020	Ahmlgd32.exe
1936	Ajkhdp32.exe
2368	Aaepqjpd.exe
3228	Alkdnboj.exe
4872	Aniajnnn.exe
4316	Bahmfj32.exe
4500	Bhaebcen.exe
4556	Bjpaooda.exe
1180	Beeflhdh.exe
2508	Blpnib32.exe
2144	Balfaiil.exe
2076	Bjdkjo32.exe
4244	Bejogg32.exe
4476	Bjghpn32.exe
1464	Baaplhef.exe
2264	Bemlmgnp.exe
4692	Bhkhibmc.exe
2184	Bkidenlg.exe
4400	Boepel32.exe
4600	Cacmah32.exe
2796	Cdainc32.exe
2648	Cliaoq32.exe
3928	Cogmkl32.exe
3364	Cbcilkjg.exe
2152	Ceaehfjj.exe
2020	Clkndpag.exe
4292	Cojjqlpk.exe
5052	Cahfmgoo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kefkme32.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Leihbeib.exe
File created	C:\Windows\SysWOW64\Klngdpdd.exe	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Lbgalmej.exe	Kkmioc32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Fdijbg32.exe	Fajnfl32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Oiagde32.exe
File opened for modification	C:\Windows\SysWOW64\Llcpoo32.exe	Liddbc32.exe
File opened for modification	C:\Windows\SysWOW64\Foqkdp32.exe	Fgjccb32.exe
File created	C:\Windows\SysWOW64\Gdbpil32.dll	Ccchof32.exe
File created	C:\Windows\SysWOW64\Ajgblabf.dll	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Ghkebndc.dll	Hfnphn32.exe
File created	C:\Windows\SysWOW64\Kikame32.exe	Kfmepi32.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Ahchda32.exe	Qjnkcekm.exe
File opened for modification	C:\Windows\SysWOW64\Bfjnjcni.exe	Bjcmebie.exe
File created	C:\Windows\SysWOW64\Becnaq32.dll	Hkjjlhle.exe
File opened for modification	C:\Windows\SysWOW64\Idieem32.exe	Iakiia32.exe
File opened for modification	C:\Windows\SysWOW64\Kqpoakco.exe	Kiejmi32.exe
File created	C:\Windows\SysWOW64\Achgjc32.dll	Kqpoakco.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Hnqhicol.dll	Gkobjpin.exe
File created	C:\Windows\SysWOW64\Dhidjpqc.exe	Ddmhja32.exe
File created	C:\Windows\SysWOW64\Hflheb32.dll	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Mgfqmfde.exe	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Kdlndj32.dll	Fhgbhfbe.exe
File created	C:\Windows\SysWOW64\Pgihfj32.exe	Ppopjp32.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File opened for modification	C:\Windows\SysWOW64\Mlkepaam.exe	Lhmmjbkf.exe
File opened for modification	C:\Windows\SysWOW64\Ohghgodi.exe	Oampjeml.exe
File opened for modification	C:\Windows\SysWOW64\Dkoggkjo.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Enoogcin.dll	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Hoadkn32.exe	Hgjljpkm.exe
File created	C:\Windows\SysWOW64\Kiodmn32.exe	Knippe32.exe
File created	C:\Windows\SysWOW64\Niipjj32.exe	Mfjcnold.exe
File opened for modification	C:\Windows\SysWOW64\Lldopb32.exe	Lghcocol.exe
File created	C:\Windows\SysWOW64\Qkdbgdbg.dll	Gigheh32.exe
File created	C:\Windows\SysWOW64\Jiejmbkl.dll	a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Doqpak32.exe	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Dccdcfha.dll	Qfpbmfdf.exe
File created	C:\Windows\SysWOW64\Jnkcogno.exe	Jbdbjf32.exe
File opened for modification	C:\Windows\SysWOW64\Lhfmdj32.exe	Lfealaol.exe
File created	C:\Windows\SysWOW64\Dabhdinj.exe	Dikpbl32.exe
File opened for modification	C:\Windows\SysWOW64\Iqklon32.exe	Iafonaao.exe
File created	C:\Windows\SysWOW64\Haplhc32.dll	Kgmcce32.exe
File created	C:\Windows\SysWOW64\Aceghl32.dll	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Clkgcdmh.dll	Ggqida32.exe
File created	C:\Windows\SysWOW64\Nlcagc32.dll	Gilapgqb.exe
File created	C:\Windows\SysWOW64\Blpnib32.exe	Beeflhdh.exe
File opened for modification	C:\Windows\SysWOW64\Ldanqkki.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Fhmpagkp.exe	Eoekia32.exe
File opened for modification	C:\Windows\SysWOW64\Kflnfcgg.exe	Klfjijgq.exe
File created	C:\Windows\SysWOW64\Nohehq32.exe	Npedmdab.exe
File created	C:\Windows\SysWOW64\Meickkqm.dll	Iafonaao.exe
File created	C:\Windows\SysWOW64\Cnkfcl32.dll	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Jejefqaf.exe	Jicdap32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	4396	WerFault.exe	880

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojhnmh32.dll"	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncjginjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdnfdoa.dll"	Kmaopfjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfpbmfdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genaegmo.dll"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnhpfjhc.dll"	Olijhmgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgenbfoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doodkl32.dll"	Gepmlimi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgkelj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgbbek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpifba32.dll"	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjhib32.dll"	Abngjnmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aceghl32.dll"	Kmfmmcbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplcdidf.dll"	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcapmm.dll"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggnedlao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opogbbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaogak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhppji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehailbaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjhalefe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnmqkjel.dll"	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciagi32.dll"	Ghbbcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajkhdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhmeapmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dabhdinj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idieem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodfmh32.dll"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkibak32.dll"	Edpgli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nplkmckj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqcjepfo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3188	2636	a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe	85
PID 2636 wrote to memory of 3188	2636	a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe	85
PID 2636 wrote to memory of 3188	2636	a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe	85
PID 3188 wrote to memory of 3028	3188	Odednmpm.exe	86
PID 3188 wrote to memory of 3028	3188	Odednmpm.exe	86
PID 3188 wrote to memory of 3028	3188	Odednmpm.exe	86
PID 3028 wrote to memory of 4104	3028	Onmhgb32.exe	87
PID 3028 wrote to memory of 4104	3028	Onmhgb32.exe	87
PID 3028 wrote to memory of 4104	3028	Onmhgb32.exe	87
PID 4104 wrote to memory of 4412	4104	Oqkdcn32.exe	88
PID 4104 wrote to memory of 4412	4104	Oqkdcn32.exe	88
PID 4104 wrote to memory of 4412	4104	Oqkdcn32.exe	88
PID 4412 wrote to memory of 4964	4412	Pkaiqf32.exe	89
PID 4412 wrote to memory of 4964	4412	Pkaiqf32.exe	89
PID 4412 wrote to memory of 4964	4412	Pkaiqf32.exe	89
PID 4964 wrote to memory of 1532	4964	Pbkamqmd.exe	90
PID 4964 wrote to memory of 1532	4964	Pbkamqmd.exe	90
PID 4964 wrote to memory of 1532	4964	Pbkamqmd.exe	90
PID 1532 wrote to memory of 4036	1532	Pclneicb.exe	91
PID 1532 wrote to memory of 4036	1532	Pclneicb.exe	91
PID 1532 wrote to memory of 4036	1532	Pclneicb.exe	91
PID 4036 wrote to memory of 1896	4036	Pjffbc32.exe	92
PID 4036 wrote to memory of 1896	4036	Pjffbc32.exe	92
PID 4036 wrote to memory of 1896	4036	Pjffbc32.exe	92
PID 1896 wrote to memory of 1020	1896	Peljol32.exe	93
PID 1896 wrote to memory of 1020	1896	Peljol32.exe	93
PID 1896 wrote to memory of 1020	1896	Peljol32.exe	93
PID 1020 wrote to memory of 4004	1020	Pjhbgb32.exe	94
PID 1020 wrote to memory of 4004	1020	Pjhbgb32.exe	94
PID 1020 wrote to memory of 4004	1020	Pjhbgb32.exe	94
PID 4004 wrote to memory of 1296	4004	Pbpjhp32.exe	95
PID 4004 wrote to memory of 1296	4004	Pbpjhp32.exe	95
PID 4004 wrote to memory of 1296	4004	Pbpjhp32.exe	95
PID 1296 wrote to memory of 3128	1296	Pengdk32.exe	96
PID 1296 wrote to memory of 3128	1296	Pengdk32.exe	96
PID 1296 wrote to memory of 3128	1296	Pengdk32.exe	96
PID 3128 wrote to memory of 3968	3128	Pkhoae32.exe	97
PID 3128 wrote to memory of 3968	3128	Pkhoae32.exe	97
PID 3128 wrote to memory of 3968	3128	Pkhoae32.exe	97
PID 3968 wrote to memory of 628	3968	Pnfkma32.exe	98
PID 3968 wrote to memory of 628	3968	Pnfkma32.exe	98
PID 3968 wrote to memory of 628	3968	Pnfkma32.exe	98
PID 628 wrote to memory of 3640	628	Pbbgnpgl.exe	99
PID 628 wrote to memory of 3640	628	Pbbgnpgl.exe	99
PID 628 wrote to memory of 3640	628	Pbbgnpgl.exe	99
PID 3640 wrote to memory of 2584	3640	Peqcjkfp.exe	100
PID 3640 wrote to memory of 2584	3640	Peqcjkfp.exe	100
PID 3640 wrote to memory of 2584	3640	Peqcjkfp.exe	100
PID 2584 wrote to memory of 3040	2584	Pkjlge32.exe	101
PID 2584 wrote to memory of 3040	2584	Pkjlge32.exe	101
PID 2584 wrote to memory of 3040	2584	Pkjlge32.exe	101
PID 3040 wrote to memory of 2056	3040	Pjmlbbdg.exe	102
PID 3040 wrote to memory of 2056	3040	Pjmlbbdg.exe	102
PID 3040 wrote to memory of 2056	3040	Pjmlbbdg.exe	102
PID 2056 wrote to memory of 3652	2056	Qkmhlekj.exe	103
PID 2056 wrote to memory of 3652	2056	Qkmhlekj.exe	103
PID 2056 wrote to memory of 3652	2056	Qkmhlekj.exe	103
PID 3652 wrote to memory of 3712	3652	Qnkdhpjn.exe	105
PID 3652 wrote to memory of 3712	3652	Qnkdhpjn.exe	105
PID 3652 wrote to memory of 3712	3652	Qnkdhpjn.exe	105
PID 3712 wrote to memory of 916	3712	Qjbena32.exe	106
PID 3712 wrote to memory of 916	3712	Qjbena32.exe	106
PID 3712 wrote to memory of 916	3712	Qjbena32.exe	106
PID 916 wrote to memory of 968	916	Qbimoo32.exe	107

C:\Users\Admin\AppData\Local\Temp\a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe
"C:\Users\Admin\AppData\Local\Temp\a379ddf28f476f5797da0550233011762aefd201d5aff8992d50d9beb57afbb5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\Odednmpm.exe
  C:\Windows\system32\Odednmpm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\Onmhgb32.exe
    C:\Windows\system32\Onmhgb32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\Oqkdcn32.exe
      C:\Windows\system32\Oqkdcn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
      - C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        23⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        25⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        26⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        27⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        29⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        30⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        31⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        34⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        35⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        36⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        37⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        38⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        40⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        41⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        42⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        44⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        45⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        47⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        48⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        49⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        50⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        52⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        53⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        54⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        55⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        56⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        57⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        58⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        60⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        61⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        62⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        63⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        64⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        65⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        66⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4732
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        68⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        69⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        70⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        71⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        72⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        73⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        74⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        75⤵
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        76⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        77⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        78⤵
        Drops file in System32 directory
        
        PID:1460
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        79⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        80⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        81⤵
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        82⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        83⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        84⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        85⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        86⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        87⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        88⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2616
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        91⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        92⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        93⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        94⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        95⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        96⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        97⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        98⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        99⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        100⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        101⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        102⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        103⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        104⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        105⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        106⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        107⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        108⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        109⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        110⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        111⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        112⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        114⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        115⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        116⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        117⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        118⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        119⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        120⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        121⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        122⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        123⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        124⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        125⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        126⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        127⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        128⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        129⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        130⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        131⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        132⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        133⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        134⤵
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        135⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        137⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        138⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        139⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        140⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        141⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        142⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        143⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        144⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        145⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        146⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        147⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        148⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        149⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        150⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        151⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        152⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        155⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        156⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        158⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        159⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        161⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6724
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        163⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        164⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        165⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        166⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        167⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        168⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        170⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        171⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        172⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        174⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        175⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        176⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        177⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        179⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        180⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        181⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        182⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        183⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        184⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        186⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        187⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        188⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        189⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        190⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        191⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        192⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        194⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        195⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        197⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        198⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        199⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        200⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        201⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        202⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        203⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        204⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        205⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        206⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        207⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        208⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        209⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        210⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        212⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        215⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        216⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        217⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        218⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        219⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        220⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        221⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        224⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        225⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        227⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        228⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        229⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        230⤵
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        231⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        232⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        233⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        234⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        235⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        236⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        239⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        240⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        241⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        242⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        243⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        244⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        245⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        246⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        247⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        248⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        249⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        250⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        251⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        252⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        253⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        254⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        255⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        256⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        257⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        258⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        259⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        260⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        261⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        262⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        263⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        264⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        265⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        266⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        268⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        269⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8324
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        272⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        273⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        274⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        275⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        276⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        277⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        278⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8676
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        280⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8756
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        282⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        284⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        285⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        286⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        287⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        288⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        289⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        290⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        291⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        292⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        293⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        294⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        295⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        296⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        297⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        298⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        299⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        300⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        302⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        303⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        304⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        305⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        307⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        308⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        309⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        310⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        311⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        312⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        313⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        314⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        315⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        316⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9020
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        318⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        319⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        320⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        321⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        322⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8728
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        324⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        326⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        327⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        328⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        329⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        330⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        331⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        332⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        333⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        334⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        335⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        336⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        338⤵
        Modifies registry class
        
        PID:9356
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        339⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        340⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        341⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        342⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        343⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        344⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        345⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        346⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        347⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        348⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        349⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        350⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        351⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        352⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        353⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        354⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        355⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        356⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        357⤵
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        358⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        359⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        360⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        361⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        362⤵
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        363⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        364⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        365⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        366⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        367⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        368⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        369⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9888
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        371⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        372⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        373⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        374⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        375⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        376⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        378⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        379⤵
        Modifies registry class
        
        PID:9624
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        381⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        382⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        383⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10180
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        385⤵
        Modifies registry class
        
        PID:9232
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        386⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        387⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        388⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        389⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        390⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        391⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        392⤵
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        393⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        394⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        395⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10016
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        397⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        398⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        399⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        400⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        401⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10392
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        403⤵
        Modifies registry class
        
        PID:10436
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        404⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        405⤵
        Drops file in System32 directory
        
        PID:10520
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        406⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        407⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        408⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        409⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        410⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        411⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        412⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        413⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        414⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        415⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        416⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        417⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        418⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        419⤵
        Drops file in System32 directory
        
        PID:11068
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        420⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        421⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11188
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        423⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        424⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10292
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10348
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        427⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        428⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        429⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        430⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        431⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        432⤵
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        433⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        434⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        435⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        436⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        437⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        438⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        439⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        440⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        442⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10680
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10808
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        445⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        446⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        447⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        448⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10372
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        450⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        451⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        452⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        453⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        454⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        455⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        456⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        457⤵
        Drops file in System32 directory
        
        PID:10332
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        458⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        459⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        460⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        461⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        462⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        463⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        464⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        465⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        466⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        467⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        468⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        469⤵
        Drops file in System32 directory
        
        PID:11520
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        470⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        471⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        472⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        473⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        474⤵
        Drops file in System32 directory
        
        PID:11716
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        475⤵
        Drops file in System32 directory
        
        PID:11752
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        476⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11832
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        478⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        479⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        480⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11988
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        482⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        483⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        484⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        485⤵
        Modifies registry class
        
        PID:12140
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        486⤵
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        487⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        488⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        489⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        490⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        491⤵
        Drops file in System32 directory
        
        PID:11420
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        492⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        493⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        494⤵
        Modifies registry class
        
        PID:11632
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11664
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        496⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        497⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        498⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        499⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        500⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12092
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        502⤵
        Drops file in System32 directory
        
        PID:12132
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        503⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        504⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        505⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        506⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        507⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        508⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        509⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        510⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        511⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        512⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        513⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        514⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        515⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        516⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        517⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        518⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        519⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        520⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        521⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        522⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        523⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        524⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        525⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        526⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        527⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        528⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        529⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        530⤵
        Drops file in System32 directory
        
        PID:11580
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        531⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        532⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        533⤵
        Drops file in System32 directory
        
        PID:8512
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        534⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        535⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12300
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        537⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        538⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        539⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        540⤵
        Drops file in System32 directory
        
        PID:12464
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        541⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        542⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        543⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        544⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        545⤵
        Modifies registry class
        
        PID:12672
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        546⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        547⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        548⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        549⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        550⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        551⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        552⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        553⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        554⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        555⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        556⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        557⤵
        Drops file in System32 directory
        
        PID:13184
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        558⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        559⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        560⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        561⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        562⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        563⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        564⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        565⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        566⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12848
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        568⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        569⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        570⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        571⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        572⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        573⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        574⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        575⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        576⤵
        Modifies registry class
        
        PID:12896
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        577⤵
        Modifies registry class
        
        PID:13036
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        578⤵
        Modifies registry class
        
        PID:13272
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        579⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        580⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        581⤵
        
        PID:13100
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        582⤵
        Modifies registry class
        
        PID:12532
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        583⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12776
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        585⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        586⤵
        Drops file in System32 directory
        
        PID:13348
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        587⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        588⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        589⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        590⤵
        Modifies registry class
        
        PID:13536
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        591⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        592⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        593⤵
        Modifies registry class
        
        PID:13668
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        594⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        595⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        596⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13796
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        597⤵
        Drops file in System32 directory
        
        PID:13832
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        598⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        599⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        600⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        601⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        602⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        603⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        604⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        605⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        606⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14204
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        608⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        609⤵
        
        PID:14304
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        610⤵
        Drops file in System32 directory
        
        PID:12456
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        611⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        612⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13484
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        614⤵
        Drops file in System32 directory
        
        PID:13528
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        615⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        616⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        617⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        618⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        619⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        620⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        621⤵
        Drops file in System32 directory
        
        PID:13968
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        622⤵
        Modifies registry class
        
        PID:14056
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        623⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        624⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        625⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        626⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        627⤵
        
        PID:13508
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        628⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        629⤵
        Modifies registry class
        
        PID:13680
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        630⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        631⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        632⤵
        
        PID:13960
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        633⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        634⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        635⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        636⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        637⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        638⤵
        
        PID:13900
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        639⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        640⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        641⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        642⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        643⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        644⤵
        Drops file in System32 directory
        
        PID:13736
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        645⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        646⤵
        
        PID:13932
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        647⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        648⤵
        Modifies registry class
        
        PID:14412
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        649⤵
        Drops file in System32 directory
        
        PID:14468
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        650⤵
        
        PID:14508
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        651⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        652⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        653⤵
        
        PID:14628
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        654⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        655⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        656⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        657⤵
        Modifies registry class
        
        PID:14776
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        658⤵
        
        PID:14812
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        659⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14848
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:14888
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        661⤵
        
        PID:14924
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        662⤵
        
        PID:14960
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        663⤵
        
        PID:14996
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        664⤵
        Drops file in System32 directory
        
        PID:15032
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        665⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        666⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        667⤵
        Drops file in System32 directory
        
        PID:15324
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        668⤵
        Modifies registry class
        
        PID:14364
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        669⤵
        Modifies registry class
        
        PID:14420
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        670⤵
        
        PID:14504
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        671⤵
        
        PID:14556
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        672⤵
        
        PID:14620
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        673⤵
        
        PID:14712
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        674⤵
        
        PID:14760
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        675⤵
        
        PID:14820
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        676⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:14884
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        677⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        678⤵
        Drops file in System32 directory
        
        PID:15020
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        679⤵
        Drops file in System32 directory
        
        PID:15092
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        680⤵
        
        PID:15136
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        681⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        682⤵
        Drops file in System32 directory
        
        PID:15216
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        683⤵
        
        PID:15304
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        684⤵
        
        PID:15284
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        685⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        686⤵
        Drops file in System32 directory
        
        PID:14404
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        687⤵
        
        PID:14492
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        688⤵
        
        PID:14616
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        689⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        690⤵
        
        PID:14872
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        691⤵
        
        PID:14992
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        692⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        693⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        694⤵
        Drops file in System32 directory
        
        PID:15344
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        695⤵
        
        PID:14584
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        696⤵
        
        PID:14804
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        697⤵
        
        PID:14948
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        698⤵
        
        PID:15160
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        699⤵
        
        PID:14540
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        700⤵
        
        PID:15128
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        701⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        702⤵
        
        PID:15256
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        703⤵
        Drops file in System32 directory
        
        PID:14600
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        704⤵
        
        PID:15384
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        705⤵
        
        PID:15420
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        706⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        707⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        708⤵
        
        PID:15528
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        709⤵
        
        PID:15564
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        710⤵
        
        PID:15600
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        711⤵
        
        PID:15636
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        712⤵
        
        PID:15672
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        713⤵
        
        PID:15708
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        714⤵
        Modifies registry class
        
        PID:15744
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        715⤵
        
        PID:15780
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        716⤵
        
        PID:15820
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        717⤵
        
        PID:15856
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        718⤵
        
        PID:15892
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        719⤵
        
        PID:15928
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        720⤵
        
        PID:15984
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        721⤵
        
        PID:16032
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        722⤵
        Drops file in System32 directory
        
        PID:16068
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        723⤵
        
        PID:16104
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        724⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        725⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        726⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:16224
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        727⤵
        
        PID:16260
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        728⤵
        
        PID:16296
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        729⤵
        Modifies registry class
        
        PID:16332
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        730⤵
        
        PID:16368
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        731⤵
        Modifies registry class
        
        PID:15412
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        732⤵
        
        PID:15464
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        733⤵
        
        PID:15536
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        734⤵
        
        PID:15596
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        735⤵
        
        PID:15660
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        736⤵
        
        PID:15752
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        737⤵
        
        PID:15808
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        738⤵
        
        PID:15880
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        739⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        740⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:16016
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        741⤵
        
        PID:16088
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        742⤵
        
        PID:16172
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        743⤵
        
        PID:16328
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        744⤵
        
        PID:15376
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        745⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4996
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        746⤵
        
        PID:15680
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        747⤵
        
        PID:15936
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        748⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        749⤵
        
        PID:16316
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        750⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        751⤵
        
        PID:15788
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        752⤵
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        753⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        754⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        755⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        756⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        757⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        758⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        759⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        760⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        761⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        762⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        763⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        764⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        765⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        766⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        767⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        768⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        769⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        770⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3956
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        771⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        772⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        773⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        774⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        775⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        776⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        777⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        778⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        779⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        780⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 404
        781⤵
        Program crash
        
        PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4396 -ip 4396
1⤵
PID:6784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
60KB

MD5
04d95a57ed8fd0cc4ea06af984f423fe

SHA1
11de55c87f9957bfba36fdce2115293fff291b3e

SHA256
20eb5ecc2e372eb5530d8e2b2e8bc9470870367f0599d5a2a69aa5994a45c57d

SHA512
d954f82e9e3ba574e1fa8fddbdd536b06e92ee01083e10885961725a76abedc74003659108a8f0cf74a921d636ef3785e44801c355159905cac070c8b0e671b7

Download Submit
C:\Windows\SysWOW64\Abngjnmo.exe

Filesize
60KB

MD5
3c90781994e9e1ab65cca319765adbb1

SHA1
9e88f3d989fdd41bfccf7f12dbdecb2c84b3a764

SHA256
d37cc0c31ddf74c8c0690b55221431cc5d9edb591f1a4b2a09e59e6346945e2d

SHA512
2f49f7d722b8cb9b3fef71cca28f2bd9395a1adbb56559ae2c40baae44edee9d638e01590f7c486ab18f3b98da8003d42440509fa1077be14887eaf60a2acc71

Download Submit
C:\Windows\SysWOW64\Acilajpk.exe

Filesize
60KB

MD5
7035e0b8b55fff832ddf86ddc4cbc770

SHA1
597d6e485aa70b2207611223a016db905a658437

SHA256
dd25776dbe83374ce328fd6e57a382e6eae8f68bb91b45d2d996b4916a9a9b58

SHA512
fcdca00ef4043bd66ac291ecd88414ec4980826c46dea2818b66cd5a713ff2d67674f4538541c8c9c6488adf9fa6ab644be081803aabadff7ef494fed5349bd4

Download Submit
C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
60KB

MD5
18c19beca7f9ec08a1c2383fdac90cd3

SHA1
2fc013656700e8b095edce515f972b1fc86a11d4

SHA256
e8a7773eda911def6013c57aa0dd30ed4d338640eddac3a4231487fcdefc6d17

SHA512
a7fa99c28aac263d75300b1ab01138e0ede0d20e7a5bdea1838c84a702f52c94556b3d40e8ced4bcfa2a6f403d2f171ce6458093c4a82da37ee3ee9a55223665

Download Submit
C:\Windows\SysWOW64\Acmflf32.exe

Filesize
60KB

MD5
59a3b14b94547833b219dc710bd23050

SHA1
c21ed70f0ef8f8fbc8a6117a21ec1a4d65cd49c1

SHA256
80801cc7211ec44c0030cc1510a6bc09c8b07bb4223a991373528c2272677daf

SHA512
967120255109cb9a9596bf6a397257113b4fc3678ff7085f0937ddf864ddf99634fd4825822dc068ecb05b113bf8e7e413bba1a92fb4cef85e92a5ed32f75da1

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
60KB

MD5
378fcbc928737d579042598b37b1634e

SHA1
94f4a623af10f9ee1bf3615428b18f11a076a38e

SHA256
7f1dc663c2644e1e4a1276a0708703d444d3888be2ddd2bb47654223bcb409c6

SHA512
cfdc3443b6173f5106c686c4d31b9f10ca1a26f08877ac8220bdeb2aef8d52ff1b48e4fbae92bd398111ba4144a205c5f7a8bc6e63f8bab338c75114897a44a4

Download Submit
C:\Windows\SysWOW64\Aegikj32.exe

Filesize
60KB

MD5
0b4ae36bbb0a3cae325136b22720cd10

SHA1
8b097f9756d71ce05ebb8b4d7d84c26205f4386c

SHA256
e0ce039e095fcccfa0984c54d082d0c825697d0b0364482d75d8bf167ac71c4c

SHA512
735286adddc3374d21eec40e912c2514b42f0361a1e96548197a93c2612a0204aa71e5bbfa453ae0af37e18c58f67c3f9c74e88fb72bb8f695bb1a9337633f14

Download Submit
C:\Windows\SysWOW64\Aejfpjne.exe

Filesize
60KB

MD5
904ded716567e5e085bae4dbb40db9db

SHA1
586faa62b478f8a3eb119453e25b2c39befcdc8f

SHA256
971d6f3ec64f37438c52c4e630a6d31c3371f895e14acac3c0819ffad0f148b8

SHA512
1d47d647fdc8d338cf8508f70f37b3ab6afc2cd295b148aaec54b352efe3de780cfc5529429fcc83919c20862094d5297f6b668793efd8a349ffeb1db2072234

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
60KB

MD5
2a81af82a0526dd69e6507dfbbc13854

SHA1
4c08b100348a73d4e9f5a25d9dd5af478499b25b

SHA256
676fb9b3fd778684a2dd2a480e753ec97733aee770b977922dbf07fc0404c7a1

SHA512
e1abeb42c0551b7385bfe276238ed3728858d1c84a6fd1bb6b55158decc0ecefa61717508ec49e53b2da7d04e01a387dfaab78bb3c40c2c42c016947bc3cae7d

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
60KB

MD5
ed81e54669c69032e6507291fd1f0878

SHA1
0e9c0b5caaedf97da4bfde4d88f7f99d006b92d6

SHA256
6b693c58d09129bdf08287e04fd1ff103f504143acf374057867bd9f61305c5b

SHA512
22253a112338242455289a3587f7615081c1d90b74110735ba7811114c053e9646846ed02c6feba5c73f349adf22a5b4365b8a74831a6e8ea3032d8dc2aa4142

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
60KB

MD5
e7eb8692b2bc228a43124589be685bb5

SHA1
f0f0d5bdc180f90e257bd3825746f90fdf040476

SHA256
1a7f321bf540a31bee8fc4d057140e69609702a5d21bc45e1fde4e89c778f9fc

SHA512
2400638c37ffe47a0463003495282d6237855cf26b6cc4694c33bd810ccf295b066e324e1ecb09b3dfcd8f454573e99b29170fbceba0780db1fb7b59db93ed2e

Download Submit
C:\Windows\SysWOW64\Anbkio32.exe

Filesize
60KB

MD5
4fd758eb9d8f93a6df706f703cc26d84

SHA1
37657350359e0f821f2f1efec6e2575f23f80d18

SHA256
0d76ed32753301437d9d9db3cd0ce39f39fd86f51e060087f9c4355ee4d960d9

SHA512
e8c85546411ee08f028add0d0311a4f8b3413b43cf8a5d9569e0e1507452a2b4d8d8bae7fd526756eea20f516dfd34c80d8b2a35f657a98e50abf2ab11ac1059

Download Submit
C:\Windows\SysWOW64\Bgpgng32.exe

Filesize
60KB

MD5
982f4c9c2faa9a56764dc5384e919d21

SHA1
1a392dc454b3d68c9ab08772610ad3f54405ffe8

SHA256
3de3a81d90a793747d336c988afafede533cf153740fd96ff257120e11c69655

SHA512
8710a82af83b168a73c0b3dfd68122cf96c4023d6d96c56d5dae0fa6a2af127fd016a7a67a43426e6271dd515a2b135a7f056380583fed5588bb79185c00d13c

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
60KB

MD5
0fc842ecbac6c16d3240e84733869fd1

SHA1
263b36fc4d0648564e9ebe96fae5c9a20b844f1d

SHA256
c6a3a29b72c90d1e6d29d8dd6ac6a84fb977f987b1f38dbf0f8eb398aab8f4c6

SHA512
99e2ef9341f2548229c03302c26328956a0db8ccd9af3384598b7896f10ee8dbb2235b33521e4e12c79a8b771b93ff64329968bf995f5caa7c92885b1f2da326

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
60KB

MD5
169737aa3cfb3a31658393f4762d977c

SHA1
694bc3c3f6d546130a678adbfae89c67e93661b0

SHA256
f82e3f43371a0ce411eb2c6787929f36d1e0c957eeb8bff270f9995b1ce0b74a

SHA512
d6c1616321bdcbe2641d0108839342a343edadb0104f38a9c539c627084f65de309f322c85158f7256131a1a702e0eae2ec03d8ff05cf9c7557f5693339304bd

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
60KB

MD5
36fab76b072c21a041c3d1cc5967835b

SHA1
b04c566689d47357270d87cf2938fd4e68ee15ed

SHA256
9c831d9c5e54a9eb56575426f638a75745ccb568f1d4ec6a57c64a4c57c88472

SHA512
13388ee35a89086b1ed1405ac5d9e9abfb352161e924ff688b159c81460c3d4016f5d2a85004e238fa50bec78b411b18551fe2e7b45e68d9c4a49b633e80ad99

Download Submit
C:\Windows\SysWOW64\Eggmge32.exe

Filesize
60KB

MD5
362da9a4c3a81c7436f6d65ca47d2e17

SHA1
3a9aa1945a437d1ecf60e873eda5cc194a7a3585

SHA256
bcd5e5b4a3be7353b8266e22b5c6e1d46ac86b854341937358a551b9015c200f

SHA512
eafc3ef75c3a5a99a53f32a7e6c01256c102ae1b0092d5119b4a774e240af19abd3cbd870beafa709a45bd03ca4bd2f23c79c72c2be267ec53ce1f7dd9d7b147

Download Submit
C:\Windows\SysWOW64\Ejflhm32.exe

Filesize
60KB

MD5
42cd38e428037a54129ce7ad9adc882a

SHA1
74949192ec299e48b72d1656a3d03592b446843b

SHA256
81e52562fa9d3393d08952bed515dbf9dc3d87a1c32db9fdedef081213f18772

SHA512
4534b282ec4bba97d62303420a1c87dbe24af368cac9fc421a734fd1f50bf26ba2e41039df3f506f5872f31bbb157351d0e436552a2dc0e2840f591d6fe942c0

Download Submit
C:\Windows\SysWOW64\Fipbdikp.exe

Filesize
60KB

MD5
380c4c0426f0b4f1050e5795cdfadc60

SHA1
8d655b287221fa0041583c6d01c647dabe1819bf

SHA256
113d12b6e500de97442e85c17446978b05d1c5ed024693f668907106c801aef2

SHA512
c88a624e58f9b8a5781896667d66f1856b0f1a87bc4387ed4dc9e988dae9c48e87baeb93313c06a7a212ddaca2a6c41ad654b90329dabdcdcc68a246db24e12e

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
60KB

MD5
c0352fcbb5c3f3f674a8081e0f631436

SHA1
965c7783e8299307f30fec02e1dd3e87759e78be

SHA256
725de9f21fca71e4128afa4d9b70902b0e0ea860580a015833936b570ae4d178

SHA512
b14dbc1080442dace1369aa81205f2e33e14220487ceb82f049b3ffd0390d935bf2b6976a30be95a843359f92067e0aa7f0ac7cacf86289bd3f2e0bb2ad9a1ad

Download Submit
C:\Windows\SysWOW64\Gempgj32.exe

Filesize
60KB

MD5
0efa687b6987a77e4ad16f621e1b84b6

SHA1
72cbf6a24e82e46c428825ccce0a47829f088a40

SHA256
9eb6cf5d11dd9326914d9bb27a8ec193719fdc702563cd9660a37c7e2952a1c3

SHA512
2c451e8989e3a919989bfefbb679e6a35ffac526d5ea2faf40412fbfd6e322186a40ec2f5d983c2c027abb1389be390db60fb4cbafa7ea21d2d9e012f08cd617

Download Submit
C:\Windows\SysWOW64\Ggpbjkpl.exe

Filesize
60KB

MD5
bd0d6be13d57eeaa9d4428cb4efbb212

SHA1
4fd077e022e5782eeecce51b291608659556e54f

SHA256
fba08f2f546f1bb6055969d511741e5f3573fe3a2316947aa17994b3a342bded

SHA512
880dab3b7eeca45756ba920432b73fe0a8288b0f24186183d748fad63017656116fed0fd7407cef930e4fcd7d4f8c3ef6b5b755ba60984a078559254fe927a90

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
60KB

MD5
3f12e219da986f960d2b378cddb4b095

SHA1
f85bd0f9eeb56de33090c4a0982ae4e069e10dc6

SHA256
03593352e730678b5ee082b8019b6b31708bd94f03ee9ab1bbe96994f6f1c88b

SHA512
a97da0a6745c693edf25c2be9f579121f7112be1f45153a49eceda36cde04e97287817f0f849374df21b4c6b379ec8d5d85030c0495bb6388a606d0730110438

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
60KB

MD5
468b65a8f9830f39868eb93e775c51e7

SHA1
6ad38c12abfce3df83dc79c7b42f10e8b125c8da

SHA256
02404e0e7d2db882d574c6901ed494a4e32163a6d47cdf56e2fa1cc483357915

SHA512
74b37989404708aac4e57d73a0979d1b87aad68e1311cdf85920817b9d6c045fc7a6c99957809ea7de1b6d1444cb832c06dffc70fa44e41b332d0d7fc74626a4

Download Submit
C:\Windows\SysWOW64\Hammhcij.exe

Filesize
60KB

MD5
307e0a8ebc68ce620a88ed4c5b7541e1

SHA1
9adc63ff91794ed93185a1b50cf531c50ca4c9ec

SHA256
34501e38ed30ac010d1baaa34b04c0c21947462f518edb22d349ea1dceab0430

SHA512
fb68ac68aa892fc7a1d30710a40b4fc2dbcb045596f3e499df14b3b0133cb1367243df1d44e522210ca7e978997b2ae92cac45c046bd3142a0342e423ea56390

Download Submit
C:\Windows\SysWOW64\Hbbmmi32.exe

Filesize
60KB

MD5
503489c7a0faa49aa1177efa2a3f105c

SHA1
40d178524444ca3767c117503fb4bee0b5df82ac

SHA256
e4f5cc9d6c9fdabc1c9d7eee71082a39d18f72b51ec4cf16072249ff66a3b6c1

SHA512
34da91fe14ed001ef1d8bb8c01c6e50cf5f939d29ed2589ae7c70ce3acacefb9a1bb6a2c633606c2925cede4793beb842563e800620189c24adc7d9a0a67b3b5

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
60KB

MD5
d83b21e1217bb22125f36d0af1e76704

SHA1
15d3f759b405765b7acc13dd480f94d486c0560c

SHA256
19bc3c2795c5d9158f627a5dd93202c843b653a0527f2b5fe80c327434605c24

SHA512
dffe15aaad1ea5bc0ef86168642daf54d12cc40730ffb2b3390d74f1c3d7670829adc7cbf36673f59e6a5cff6165e8c08ecb7191fba37d2c32d049514b5b6677

Download Submit
C:\Windows\SysWOW64\Hnodaecc.exe

Filesize
60KB

MD5
b9e97c64f0480bdc2d23d849376239d1

SHA1
2048d05554a6059189b70f42ef8020411ca9fd01

SHA256
d9cb2fa77317a6a21ee686f4ccd1745cb043728057049c73a687c1fff34b523c

SHA512
312d799af1d1283ef12c17a7143920d309f03b1e20bb9db4b1c706467c60b6fcd5b357ed66711534788bedcf24a0e812f2b68a4a1d0797c5f448866f274d618a

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
60KB

MD5
4b1bc140cc12d33cfec2d41a20a274af

SHA1
90bc47f4ef79fac3f60c9a71e0634b2af0981b12

SHA256
202ae068e4bda09b77b344f950daafbde7952201a88e1c186a4b47d18d1e7ae1

SHA512
7d646fc4820be59ea57c271d13f751787e0f2bd4979a0f6735730a72e41efae74097a91897d766a3eca797fbe3685c4f4a277e980a1294df454a4023d8019057

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
60KB

MD5
f598641cbd947d1fb04807d426a2a821

SHA1
052184ff9885fbb068367a8d601862716003458d

SHA256
a03ff711aaedb4d409fa27d53937195ea652c3b68896f88b04679fc0e883303b

SHA512
80168ef873b5246c0e9e3d631182795c32d4c280349d922f209909b8a60ff8edd4e381e8ded342ee39a93409240cb7e0f3feb7b8e7fef473a92124615b323b50

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
60KB

MD5
7d4dc01278a9d272292c5a477fa56acc

SHA1
d4b5adde6f570ed2f62a2daaffbceb993ab707a2

SHA256
71f511092028272d86a10f543c1074b6e5cea14d6b43551db6c591284e06f4e6

SHA512
0ea55c44d58651cec20346ec2fde9b2c2a6df34a3486967ee9eb7df2de312de450ee358e171650385ce2d8572b1f2436f4ce8a108e4bef495236a414a4f20e10

Download Submit
C:\Windows\SysWOW64\Iklgah32.exe

Filesize
60KB

MD5
96188aa63790df0657b40852c9e5aa04

SHA1
e92f56e01a78fe1166b8747fe0e47c97d912ae3c

SHA256
77d719a4a06b4f9da80da3ab0391667a94829a8949f3bcadbb73938d2803453a

SHA512
8bcc8578be7334bec6b33d5d472b65c92c1746a29163583e288273b00a181b5566f05d3ac8f2376d12fc6ef4896a3bf5ac5f31329d3bc371c138f20a1d8a9c21

Download Submit
C:\Windows\SysWOW64\Jbfheo32.exe

Filesize
60KB

MD5
d3871f26a953292b1d55e487eb1b7cd9

SHA1
2c13a6bc2fab03a339aa25e344faa18527f564de

SHA256
9408b52bee289c328f97aa52e88a7662064fcd4354e7820adf37e41c69c15cd9

SHA512
400dca14ff0ae2dd881752367cba076893e9f172d48cbddbf9c7079c5945a3299b1fd8d9e88e614fbf1d8260a4cedc3fcbae36025dcebb8d5892b7ddc0c1819e

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
60KB

MD5
5d0a1a738fc95789bca86a12185910ef

SHA1
3924c8a00b5c5a4b25a8b2b7d83161fb1dc0a3af

SHA256
c3f882de34e18f0b0bb6856166b632a9f0fa2c356046f6c796f0cd1e99d7329b

SHA512
cbdac5bfc42989edaae27a1e324341e23cba4186091f91c1c50487efe371ee6614493db35657e8235f6ee0b27a065f560e778fc7f2a2c7d1393c080e76eb6310

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
60KB

MD5
badc2980e48be98899dfb16845492e4e

SHA1
2f1062927e8c787e201f67956b74020b2c6712d8

SHA256
8f0059c2ecb1c8c169745eb7886693824cd915e969ebf07952d021c8024f51e3

SHA512
95954677be2eccb2c05d5fafdec6c09b427c5e14b9a38d4628e772a2ed2fc5802acbc1702556097ec358e4cc795fecedb234ff0d3d881a7ebdc78497649d9422

Download Submit
C:\Windows\SysWOW64\Jnkcogno.exe

Filesize
60KB

MD5
c80b764481e3c8ad2e680b08b8723729

SHA1
08100b859e5da1c25503f090fedd4e366f728bbb

SHA256
ce7b0961daa91f72fdd651c94d9497cbd42a422c8b83744f8ca6131afc7413b0

SHA512
4f3795f3bf714e2656859e0a100523553381b14a569cb290d42188c0e4c0375339678ef9f61a8199e55e5b89f0c3cb51156b65f6762e5281da5773a720fcb828

Download Submit
C:\Windows\SysWOW64\Kbbhqn32.exe

Filesize
60KB

MD5
47085e7d28d89b844c52f87ae565ccdc

SHA1
d7b557df8319fea16719bf8d3c7d1407d4265eb6

SHA256
fcda6d6093803eb8fffc44213ad63b9b58948a54f83b6d0a5432c64098639895

SHA512
0fa5a3153925e71242b892c352697e81918f8e46b3dd5f6f549db0ce99e3928aa21f88ad49821ea60f14927b930c890948c4c9a128bfee142aefa10dec2885f3

Download Submit
C:\Windows\SysWOW64\Kenggi32.exe

Filesize
60KB

MD5
c5f77a7c07df8a388dea2481f18b4e03

SHA1
e2c78823886e0944c2183fb86d12b47bfd190f8b

SHA256
2a86f73d2cc9bf79a3a1a2eab9e0cbcfd92c48be75cb645378b65be39b557829

SHA512
e672f28d31c57d868ddc011d356ddedb07dc382aaf8fd14882de343d0a8e784a4adff9cafd5761122518f25325018d26e5ab5780dd366b1012ddfc8eaafcee4b

Download Submit
C:\Windows\SysWOW64\Klmpiiai.exe

Filesize
60KB

MD5
60f23d14ebf8bc56313e75249b0b3841

SHA1
51f12d55a8617bfeb1a43d52e2f552849afbbb99

SHA256
7c8961ff4e8e4ff49f24213ebbda93e39892226754f0ac694087d21d8f2efc6b

SHA512
17e95496d85258bd707f58c295be803d0796e6dd02c1f52793a82335f92fdc371ae94cd0d503cf3b6aa8afbb208978793340dcd6a572e92d1a525ae94bf39d14

Download Submit
C:\Windows\SysWOW64\Knippe32.exe

Filesize
60KB

MD5
6b228d728106d132e58be3cfa4544c45

SHA1
73b907b1c06dc997892cf7c4c882aab754abebc6

SHA256
3f78c06640b9db4351ee763a3b5b201a136167798fef7cdaacd23c4dc9f8e5ff

SHA512
db68a6e100c39c39c6e6eb0607520ed10347c78c4d9730cf44ba588d18dd595926583838e8c4474933ed4f86cc624d86a6dbd75461b55c1444d7ca9ea8f24fb4

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
60KB

MD5
6f5e2e50fb55ddeb4fcb53949216836f

SHA1
366e280836a0cd3d6001095ed7bbdfe2700ac459

SHA256
95710e9a67c7e99dd7ab46586b02e00f69c8bb0429e7124d03fe5739e386f400

SHA512
4cb2444fe5fa1f942bdee2fc13bcb1e37ecac53cd252efacd82449425ce47a049cbc43b1f1bf5a15e6ac17a7fcad4eb0187e1ca4c3c4737fc59f2d4347fdc6fc

Download Submit
C:\Windows\SysWOW64\Lbgalmej.exe

Filesize
60KB

MD5
e48bdb554c572e5e51aef8d83bc950fb

SHA1
cbffe42ebc6e82dcc2c5d30d58113d334788bfd9

SHA256
996203004ab7332d8d8ffef7a4663be4ca9fff72419a0be8a232bc72d488cf89

SHA512
d6edebcac8982273cbbc0cc1e21a1ee465511be2a71ee7d83dcbcba1f8c445a1cf699240379dc5175324209792b7fee2b4fe975d5a33d3652a2feeb6d59d128e

Download Submit
C:\Windows\SysWOW64\Lhfmdj32.exe

Filesize
60KB

MD5
0ee3ca1a5bc4da97671ebe9f9001a237

SHA1
4c88b6187419dfe8b63e51b604963f0133bc54ec

SHA256
2fccb523106e5bf6e175f2ac8e17d3e90fd66eef53ea3fa02af54ac5c141f78c

SHA512
6caf43d20ceb9f00b331a951d44d3b0ed930c30fe50f90a56a5477f051b7b2a3089706eafcecdc7a9681d348046fb17b4a47a2c64e30a604335203501f285e53

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
60KB

MD5
32a8adce8056ccd566e13a607d6067dd

SHA1
b70d4c79157f50aee0086337097c01124afa9d3d

SHA256
df12740c8798807748b7db7a1b7a44ec137dca0c2645a683a28854978e345e13

SHA512
a7cef7e24088538d30b60780059df9a9e284b1907c72a7e30a837c30f8c4cf3dcb49fa2abbacb3b8547895ca397a4052420871d517c4881c5e537570bbc914c3

Download Submit
C:\Windows\SysWOW64\Mahnhhod.exe

Filesize
60KB

MD5
41612916f504789cb024e96ac71ea7b8

SHA1
91dc84df202f02df15722951c9d7cb1b49142487

SHA256
c5d3e556e21464c7bdd0d13cecb85fe46168a53b2d863dc6149ba471810553cd

SHA512
92301ea2a78a907e0bb1a7cdc7241a96bf1eb25180caadcf46c4c99faa5f0ff935a953863f0ffdf51dcf717104e56f9c9cf55a68f14a6b0ccc2db17e080a53ee

Download Submit
C:\Windows\SysWOW64\Mnnkgl32.exe

Filesize
60KB

MD5
e3aa8c23c74be32514970f216014546b

SHA1
7447cd3925fcc24535cc90a76d9bb62cf43a3cd7

SHA256
d33c1fb32c8c9b761a7a9e53649700b307e500616c17ef98029fcb4f2eef85ce

SHA512
5edb755c672def8d3424ea6fb5a0a8cee140297e65065dc488706829200f8f3a8c8703d7be0ea440d09328fa72ebe5e0f8151afca8a7be8134d2e2fb401cad03

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
60KB

MD5
280399ba6e5a99692bb7d8ef0b5048f9

SHA1
cce960f38e2b9b3a4c38ab568c6874e09c861824

SHA256
b3cf48323164d5aa0612c887da67f9c63df5167a431f9bef556b18fd63a6e914

SHA512
9eda837cf96b2c3a12d1b1f5ed398b0e39be477b9d2c0d3b4307dd6289d5faf5baac0be185feb70e608916625fc01328a5e2f0742f0936d28ad8a4f547f99829

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
60KB

MD5
d66c540f613b86c8be6555a00ddc9519

SHA1
26bc1e1cabb97b09d47b5530eefe3b5bbf85938b

SHA256
def74ae1c65a5171a1f6bc81f26baa5d12ab6847a033703636d377d39278a42d

SHA512
bcea682b4fc93b97bf75dcb3cedc85cdde3483c9a24bb0b5304272b935a105ca6a72f4a195ad9fe0a63b14a2d50572ffea3d1bfc15f36575d2f27afd6e925884

Download Submit
C:\Windows\SysWOW64\Nefped32.exe

Filesize
60KB

MD5
f407ade99fc2784c5899d998296e1ad7

SHA1
9828fa6cc17181548f5c9302ee6f26e3c1f032a2

SHA256
65d36e99d0c801bbaba84b3482c3a525c78b2592e09b09ce9b1fbcd51d7373d7

SHA512
77c41fb382dd5dc71fca8af8345712761898b1d2d0e6af0d2b0e3c181d8a55612e3e6de115060afcdbd01efe569c8352f1a97388b41a3adff1fa64e94d392565

Download Submit
C:\Windows\SysWOW64\Nhmeapmd.exe

Filesize
60KB

MD5
e449696b5c88eba21c3aa0cf97979768

SHA1
a8de3a338ef34021c2d59e7bd96381ff97dc570a

SHA256
392a7c5e0b1e3ec60db4d198c51bfc312a273fbb0b35f9c879e5176d55668c2e

SHA512
3d9f1daa3d21fa2b66aeae553f58da395c8e209425f4450c48b098bd5aa59c69e50277ee5b2dc1946ef6af0ab2e3d00912022d2e83658b813e4587ee4cc29a92

Download Submit
C:\Windows\SysWOW64\Nplkmckj.exe

Filesize
60KB

MD5
9b95489588820b69a46726f2748c255a

SHA1
8c5f612070f7b59ae48e1909f20dc8cf28da3eb7

SHA256
5be3e0bbf215356520f38f96ca81707e5545d8030958daec3aaf597be6c988d8

SHA512
39028413a3c3955b71ea78f7d7553a1df4189cc140e8bc938d691a01c337e0243d573361417b64a4a9cb2c085b862b8d51a532b2511e1ce7be049083feb31843

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
60KB

MD5
e48058e9ee34dbba05c03d8f07edafed

SHA1
26531d71c0c45b3cf3a18315d5fa060299d4068a

SHA256
78f1aec6be0bfa0062b7f5c36848126e12c2efb6578a8c5429335b3b7e32d4a1

SHA512
732318bf1ebf0b902365941244938a728795685c9df5eadc8b83e59c5a553ba1210bd0821a4b48756aa55df58fa345f6007805b4d1ac8d2c97446a592eb3b19f

Download Submit
C:\Windows\SysWOW64\Oeaoab32.exe

Filesize
60KB

MD5
fb07ad0873cbdd9e9ad3b2ecd0966f50

SHA1
626a90b2957b78ed16167b5ad8a495273d7c91fe

SHA256
fa57d0f206dd25b90396d94418a6c5c9ccaffa1a443881c7ad2fecde8833efd6

SHA512
eb7f78144f16110f087dc3e5ef9e755c696230619a74884971e16d5e0777625ad51f7bb9d956b373a6ffc6284c6d0aaa91e60e21dd3f69ec937958ec840ea629

Download Submit
C:\Windows\SysWOW64\Oemefcap.exe

Filesize
60KB

MD5
8c569d266ee85b20ad5f20166292ea9e

SHA1
6fd94eed44cab021ff9a3d6fd675eb01f8434bae

SHA256
2e9d8005e6266186549b693cbecf808ba61b5d97c79149ed3d4e9cd04bfbbc9e

SHA512
bf9e7fcdc6942da0d8dd4adf7cd20da5fe7e5da7d17d62521f8dab6e91f5aa936c97aa31089cf16f14738082bd9589a0217a5c560c736f2dfbfc341a998ee11c

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
60KB

MD5
5d77a00671848572d5164987cde45501

SHA1
761a1c7726a576fcbd4af75ad54a17788f7707ba

SHA256
e481c9915e3a52e9e6e1407e2cc2eaf57ea8803a640dabf72ee81f2dbe68b034

SHA512
775dabcd4094d04fb0aeb2447b87bfc1ad6061290218ed218dadd9f776c7ccaede90947ee8892a4f1f4880845940b7d8ecf018165d08c0d9bf3daf3922b7cfc9

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
60KB

MD5
8a1b0073e2556f96ef884bced4e367c4

SHA1
d37bbb0eea14ee5a6e1dd04cd596bcb1965c06f7

SHA256
a285b450cb93edad3774b6ac6a1a7da6a798b9721f151190ad62cd6744f835d0

SHA512
cf270f1bb073d60fa96a3fdade3a9200618a923ae70aeeb208f8996189c52c3364032b821c6a7d8ca411a2355159b37d1042eeab844f574f85d726071e89d25e

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
60KB

MD5
5d9dc8cff51574a6ef3fce7e337580f2

SHA1
e7466ad9f1d2eade4650d1209bbeea995a6beacc

SHA256
3e3c017f4a6a2454c85b27078355deca7e5c1b0a9b65453902b26c4c57b730e1

SHA512
9ab5539ad4e2f44327f0bdfa1f5c31b54c886db6af179dec7df9291ad4343c15879a6a378db5d9ac410c01fb70256ca273f0dc4d1654fe6dbabe0e4094690f2d

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
60KB

MD5
077d62ffb3b7a221d35c412a18596fb5

SHA1
319a24a6cd820dd5000fa548b5b9c2aeff37fa5c

SHA256
cbf6ecc0661d04c78703d8a46aec8d256276961aafaed30e4ac37bb74933b34b

SHA512
61de07ea51dc71a496d2f680879c066ca67e101f74b1db542348563435467a3f25fc48d1e2050119c15ef5f80e7767c4d2ecbd89802faa66cd6953073442add7

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
60KB

MD5
fb6145f5a059c744451b63dfe4aaeb12

SHA1
adb9b12241a830134cd9f02352cf7293cf670783

SHA256
97bb4a5c57c7bd7479dafc5387384ffc0c2b2365b0e6741354f76f30ddfd74d9

SHA512
c81de46c01b03a97ab571f6a92604a866733e928c5ffbab89d92143e9b73e43700a0815b4107c1207b8a9cb21302aa0466490fb7306da52f03dbdeaa3c9f97a1

Download Submit
C:\Windows\SysWOW64\Pclneicb.exe

Filesize
60KB

MD5
d6829d69b27ad41fae5c6aa7bb57fd4a

SHA1
a8051c38adb10a7089e0eb91c7309462c5ed7d07

SHA256
ecb1ea2292135577c60291b0b4454332378b0c7525c80cdb39c87636c7be1e37

SHA512
32f10e42c0f4c21e180184b6cc2df4358ae7788ca4736628cdeb3fb83a177cdea8c5effefdcc8b079f3f59037b34b526b4a9b441316f3225c733aa0c2e068085

Download Submit
C:\Windows\SysWOW64\Peljol32.exe

Filesize
60KB

MD5
cb42494544cd8315e1c85fd356971d4e

SHA1
967f42d75b1e1cb4411e181aa5b34f349a281b1e

SHA256
419c732f35f23ae40f3e99112241981c6529f7ca02a4106b6dccfde205413eda

SHA512
ff290d39e04702b80b25962d78c951d10c7dbb3e5aacf503beb35670939a470afd98aed11814f7ce60424014f3b68a0a677567b66e89077a4327c156584ad9a2

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
60KB

MD5
9f79cf1e4b9c56b1d0393351eed5c904

SHA1
841f95ee953582ff4f0d163cc622a5817db094e1

SHA256
d9023986273740673b94336c1a40bd7a45c82628289d847fbcd1e3d3dab270ab

SHA512
74ae3ade27a37ac8e4650594290fb47229d9880359fc214bc37c3c6f86d6c0c9b3aa7d23990e94b190549cd38afbcc703f85a1d6873bd766d659a33fd9df9c80

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
60KB

MD5
1b19c51d9428ba3616cbdef139ea5ad8

SHA1
e5844964d0aeaa31361c00bd96da8e407750366f

SHA256
f6c62219c2eae5658c60c5d1c443b479cd0091652a6d765909d74dd6f0545e4c

SHA512
dd8299dc08fe91714e646cda9580ea19bc21351b63e012a3dbd6d29d5cde471e70f4a60bef5b48f47d0788cf4cc1e0ffa74231e08e76a39e55a10a5ec95383b0

Download Submit
C:\Windows\SysWOW64\Pgbbek32.exe

Filesize
60KB

MD5
d8d150fb1f4206663e002ce5840da433

SHA1
62035084526f8bbd2691c672610f419d95bbab0d

SHA256
513550b4c5bb798a49206169d333f5f4acd65c096b1d914f577322ed4e9c016a

SHA512
654b777b516d5ae8f16d6fe165665b4c11a36dde0f445f08dcfad52a8c8c11507ecd44b765ba46edb9dff51015e449b616c73932dc3f1a190369939b913663d3

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
60KB

MD5
664026803596c1afb30b676bd68320ab

SHA1
1127d53c1f606178ed67d0e86236a6c91cfe3767

SHA256
8cec944d4439a949b6ae8eac48456788467db7df6d5119520eb2cde704e1820f

SHA512
c25364791dc03620b6d678b7714048fdbb3183845623ed9e09eb926c86046367a8410629012be0b560f31b87b6719eb9be24fb1c84937479f2423ccea60985dc

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
60KB

MD5
ff352d3b930fa169b4ffb38644cc6640

SHA1
d3abab32e0f464f98f1352bed391ad0e6b896912

SHA256
e7d1584294ac4507969eeac72a06bac63a0e29eb2c9118a54aaf70cb6aa154a7

SHA512
9c0fd54f43e8374086a10a10e5269da85e8394ecb3a1fae92411198015b260a38fa4247b11ec00649e2af5d3f4c66a7ed505eec40c4dcaa2c3a5a0f64bc8bbeb

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
60KB

MD5
84086d491e33817e3eb600b2641b36ec

SHA1
32ba5f87bb36b19ccdf26305aaabde5ea77ae021

SHA256
8c5bc3769561f471bc0376358ded690ea9d2a8211316dded31ab71aac12959b5

SHA512
039fc8e1c6c9605dd185599915e8b6f78417a8529f33b8461d7d5a790366b0ba34b53138fb5568e77afb2279c834f14d4b6b62427d90cab46c1c2a5dc643ed55

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
60KB

MD5
f71855ebdff7ecfa442080393eb9af4a

SHA1
b4ea9dfdf88fe5399e1c28115216053cfde476d8

SHA256
ce00fda3c91af61b4d11fa428b191f248fc29a99a38f05663713d2c651cbf5af

SHA512
612b8bcbb849b1d8738265bdbe11379a12a52fd97310ce01f297b9adf2bdc0a637e32ed9bf1c52e8a5d66ec01a9fb76cfb988272b3a21c30073fef47b0e5bab5

Download Submit
C:\Windows\SysWOW64\Pkhoae32.exe

Filesize
60KB

MD5
eefc1dffe46d392e854b1fd7b87f46a4

SHA1
64c2723f56d98e163498bfaeba22a209743c9dad

SHA256
4ef92ad8a3be943a88c07431e713910847dc3521f6f7888828864544ac8008b7

SHA512
c653c69cf0bf53d5a91b6f3b4f045c08289aef34296c4d4cf8044aa7271e8dfe0677c06982d7c2ceb95cc56bf7693a11b179983a216706eeb01ea2265d2fd1ea

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
60KB

MD5
585fa01fe523aaa84ad6fc6a94ed3777

SHA1
64ee984fe669f4959ab303ca443c6648d265ea90

SHA256
8d868c39364c69de79ddbb9eaf9d0f777e57ae0521a2d12bc0b902f7b112b819

SHA512
d2fc7bea0e0fa02df3e4c815bad8f44d5a1518ad8f8e3c0add26462fbde1752b3e2d9b0ba6ecadcebb149b3d6c170b140810da01fb4876b1be5ae48b05ea9b0d

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
60KB

MD5
15ed7a8c614522e255ed0417c2edff6b

SHA1
82904fa89568910a893535ee1ebade5338552362

SHA256
f5f12accff8753fed8cc7026cbad0e69c6139f091c6bdbfc9d8e4f2a59a1fa42

SHA512
433282d07b2a64b30cf2c3409cb7f9411c56a92d1e1ad80390511aa755832f7e7b76fa16433755b54b07b862a98fb86ca1e29e2038aaee58bc8d80a03e504421

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
60KB

MD5
391364ba9322a6a4f5b602408f670674

SHA1
67083e7384f66b7b563fc3ad924b91eec7d01f93

SHA256
c5b4a13a54bf9bba1b7d41280beb61229bf0e6b48a50483d7e59b5288f7eb282

SHA512
6e9cad01654ecd1abcb3df330d7f9cbe367260f532d59218b13d39ff08f8676e5b66871fa8f9acc22048a4775e8a0aa0f381cae4401718ef35e7fbcb66703b66

Download Submit
C:\Windows\SysWOW64\Qjbena32.exe

Filesize
60KB

MD5
686ca2f0c0bbd7f46e9fef8f3f095359

SHA1
50a3c9ce2883abc592b090a71c61fd158ae72af4

SHA256
9d968a91f35c11846728e6068a4f92d1b2de6b13b0b08d6ab722f5043389a1f3

SHA512
4f22e7bde4e13d603d8ae9204182f629a739df73bfef33d5345e55c190711f8e4e29cb4c3e4f7a520f0711b3b216413d30cd95746fbdcdfa56af375fce593553

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
60KB

MD5
14310e65039dba9405720a09d35d97dc

SHA1
c103a730ff2699dc00c4e71002b7e1f5df401211

SHA256
503c55874696c9155f8a89c944d8b811441a2968cc9b30654a0609ff19c5d8e1

SHA512
e699511be75b36d7a95b84ad9edf54578f1b49d3f6cb94e66769c054f8155fbb2ad261bf346a7c729e9609e088cfdc68395c5c9de954f6f3800149a685fa08b8

Download Submit
C:\Windows\SysWOW64\Qnkdhpjn.exe

Filesize
60KB

MD5
02b12da858b87bba2fa3c4a1344ca5cf

SHA1
31d354a42b651fc66d0114bc7ab564c78bff26ac

SHA256
c2d073bff0383070c586d1aabbdd96dd00a803bbd7bbbdc380b7507340239809

SHA512
e87347099f2b504bb3cc54e9b463409a359bec27be9b041896f0d0663995151b93f065770d88306d89a01f8236a78e87313ff4bd662fcdc07d9967af69fd8091

Download Submit
memory/448-279-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/448-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/916-175-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1020-73-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1296-97-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1532-156-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1532-49-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1564-284-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1564-360-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1600-229-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1600-337-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1896-65-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1896-166-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1936-300-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1944-236-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1944-338-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2256-318-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2256-198-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2296-294-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2296-372-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2368-306-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2584-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2584-240-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2636-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2636-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2636-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2636-82-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2804-324-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3028-111-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3028-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3040-144-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3040-272-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3128-113-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3128-215-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3188-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3188-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3228-312-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3640-123-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3640-221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3652-157-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3712-168-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3756-359-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3756-293-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3956-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3956-248-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3964-366-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3964-287-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3968-106-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3968-207-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4004-199-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4036-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4036-165-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4104-25-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4104-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4272-331-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4316-325-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4412-140-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4412-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4500-339-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4556-345-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4964-149-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4964-41-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5012-285-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5012-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads