81f1056ddfcfd2df885def8ac5a2485b57660f540a2eb2a11ce2b89ccfa07bcc

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe
Size

81KB
MD5

4ceca75b67fd547463e5c4a569a5d7d4
SHA1

4e9a6f0098b891cc7a772e63db5c88c48fca85de
SHA256

81f1056ddfcfd2df885def8ac5a2485b57660f540a2eb2a11ce2b89ccfa07bcc
SHA512

ca575825f1ee674ebf8fbea0a2a21aec61735f33f6cd61fc5aca5961c0ef6923ca5469338e356b0d83283fe1d2d69c80ef18a446ed6f91c18f5ca4c6bf6ffa0d
SSDEEP

1536:BkMLzTVM0+nqVnFXt5sfFv56T7m4LO++/+1m6KadhYxU33HX0L:+MLvyFnqVn1IFv5S/LrCimBaH8UH30L

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkhdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdhfhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkjlge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemlmgnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhpjkojk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcfqfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdolhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hodgkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcepkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahhblemi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboigi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcckif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcbom32.exe

Executes dropped EXE 64 IoCs

pid	Process
4740	Kdopod32.exe
1584	Kkihknfg.exe
1764	Kmgdgjek.exe
5060	Kdaldd32.exe
2784	Kkkdan32.exe
4380	Kmjqmi32.exe
3356	Kphmie32.exe
1744	Kgbefoji.exe
1512	Kipabjil.exe
2764	Kagichjo.exe
2928	Kdffocib.exe
836	Kgdbkohf.exe
688	Kibnhjgj.exe
1968	Kpmfddnf.exe
2312	Kckbqpnj.exe
4204	Liekmj32.exe
3760	Lalcng32.exe
1964	Ldkojb32.exe
4972	Lkdggmlj.exe
2024	Lmccchkn.exe
4732	Ldmlpbbj.exe
2632	Lgkhlnbn.exe
2952	Lkgdml32.exe
5068	Laalifad.exe
3920	Ldohebqh.exe
4532	Lcbiao32.exe
3268	Lilanioo.exe
3292	Laciofpa.exe
888	Ldaeka32.exe
3748	Lklnhlfb.exe
4496	Lnjjdgee.exe
4560	Lddbqa32.exe
4144	Mjqjih32.exe
868	Mahbje32.exe
3916	Mciobn32.exe
3360	Mjcgohig.exe
2996	Majopeii.exe
2440	Mdiklqhm.exe
4548	Mgghhlhq.exe
2664	Mjeddggd.exe
1488	Mnapdf32.exe
1552	Mcnhmm32.exe
3416	Mkepnjng.exe
3584	Mjhqjg32.exe
3940	Maohkd32.exe
3056	Mdmegp32.exe
5076	Mkgmcjld.exe
2248	Mnfipekh.exe
556	Maaepd32.exe
4776	Mdpalp32.exe
1768	Mcbahlip.exe
4720	Nkjjij32.exe
4656	Nnhfee32.exe
3388	Nqfbaq32.exe
2616	Nceonl32.exe
4636	Ngpjnkpf.exe
3272	Njogjfoj.exe
2912	Nafokcol.exe
4804	Nddkgonp.exe
436	Ncgkcl32.exe
468	Njacpf32.exe
3744	Nqklmpdd.exe
4444	Ndghmo32.exe
920	Ngedij32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hipnbb32.dll	Nqpego32.exe
File created	C:\Windows\SysWOW64\Jcfhgi32.dll	Pengdk32.exe
File created	C:\Windows\SysWOW64\Acocaf32.exe	Aelcfilb.exe
File created	C:\Windows\SysWOW64\Imdhga32.dll	Cbcilkjg.exe
File created	C:\Windows\SysWOW64\Mlcadgkl.dll	Dboigi32.exe
File opened for modification	C:\Windows\SysWOW64\Himldi32.exe	Hbbdholl.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Pnpemb32.exe	Pkaiqf32.exe
File created	C:\Windows\SysWOW64\Debheb32.dll	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Mnkhmbin.dll	Miemjaci.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Oqihnn32.exe	Onklabip.exe
File opened for modification	C:\Windows\SysWOW64\Bbnpqk32.exe	Bjghpn32.exe
File opened for modification	C:\Windows\SysWOW64\Foabofnn.exe	Fkffog32.exe
File opened for modification	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Iaheeaan.dll	Jedeph32.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Lbmhlihl.exe
File opened for modification	C:\Windows\SysWOW64\Gicinj32.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Lmdina32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Qnkdhpjn.exe	Qjpiha32.exe
File created	C:\Windows\SysWOW64\Lebkhc32.exe	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Bhikcb32.exe	Bdmpcdfm.exe
File created	C:\Windows\SysWOW64\Jihdea32.dll	Ehedfo32.exe
File created	C:\Windows\SysWOW64\Gkkojgao.exe	Glhonj32.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kmijbcpl.exe
File opened for modification	C:\Windows\SysWOW64\Lbmhlihl.exe	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Okjbpglo.exe	Occkojkm.exe
File created	C:\Windows\SysWOW64\Klqmnp32.dll	Pkjlge32.exe
File opened for modification	C:\Windows\SysWOW64\Flnlhk32.exe	Fdgdgnbm.exe
File created	C:\Windows\SysWOW64\Hkdbpe32.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Hfifmnij.exe	Hbnjmp32.exe
File created	C:\Windows\SysWOW64\Okokppbk.dll	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Opdghh32.exe	Oneklm32.exe
File opened for modification	C:\Windows\SysWOW64\Pjmehkqk.exe	Pfaigm32.exe
File created	C:\Windows\SysWOW64\Pjkombfj.exe	Pkhoae32.exe
File created	C:\Windows\SysWOW64\Qnkdhpjn.exe	Qjpiha32.exe
File opened for modification	C:\Windows\SysWOW64\Daaicfgd.exe	Dboigi32.exe
File opened for modification	C:\Windows\SysWOW64\Dohfbj32.exe	Dkljak32.exe
File created	C:\Windows\SysWOW64\Ijmanlfp.dll	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Gcimkc32.exe	Gomakdcp.exe
File opened for modification	C:\Windows\SysWOW64\Gblngpbd.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Pgemphmn.exe	Obidhaog.exe
File created	C:\Windows\SysWOW64\Pkhoae32.exe	Pcagphom.exe
File created	C:\Windows\SysWOW64\Eekaebcm.exe	Eapedd32.exe
File opened for modification	C:\Windows\SysWOW64\Eekaebcm.exe	Eapedd32.exe
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gfngap32.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Pbmncp32.exe	Pjffbc32.exe
File created	C:\Windows\SysWOW64\Chpada32.exe	Ceaehfjj.exe
File created	C:\Windows\SysWOW64\Dkjmlk32.exe	Dlgmpogj.exe
File opened for modification	C:\Windows\SysWOW64\Dkljak32.exe	Dhnnep32.exe
File opened for modification	C:\Windows\SysWOW64\Eocenh32.exe	Ehimanbq.exe
File created	C:\Windows\SysWOW64\Gmjlcj32.exe	Gdcdbl32.exe
File created	C:\Windows\SysWOW64\Ondeac32.exe	Ncnadk32.exe
File opened for modification	C:\Windows\SysWOW64\Chmeobkq.exe	Cacmah32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11368	12264	WerFault.exe	573

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbcilkjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhcbhjlp.dll"	Dkgqfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdihjfbe.dll"	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okjbpglo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bopgjmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlncan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Peqcjkfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odocigqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnaela32.dll"	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eamhodmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnpemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glhonj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qalnjkgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfifebhe.dll"	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiaefcan.dll"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echmafdm.dll"	Occkojkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjipjg32.dll"	Qeemej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdhga32.dll"	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fooeif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fogjfmfe.dll"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfldb32.dll"	Cecbmf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 4740	776	4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe	84
PID 776 wrote to memory of 4740	776	4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe	84
PID 776 wrote to memory of 4740	776	4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe	84
PID 4740 wrote to memory of 1584	4740	Kdopod32.exe	85
PID 4740 wrote to memory of 1584	4740	Kdopod32.exe	85
PID 4740 wrote to memory of 1584	4740	Kdopod32.exe	85
PID 1584 wrote to memory of 1764	1584	Kkihknfg.exe	86
PID 1584 wrote to memory of 1764	1584	Kkihknfg.exe	86
PID 1584 wrote to memory of 1764	1584	Kkihknfg.exe	86
PID 1764 wrote to memory of 5060	1764	Kmgdgjek.exe	87
PID 1764 wrote to memory of 5060	1764	Kmgdgjek.exe	87
PID 1764 wrote to memory of 5060	1764	Kmgdgjek.exe	87
PID 5060 wrote to memory of 2784	5060	Kdaldd32.exe	88
PID 5060 wrote to memory of 2784	5060	Kdaldd32.exe	88
PID 5060 wrote to memory of 2784	5060	Kdaldd32.exe	88
PID 2784 wrote to memory of 4380	2784	Kkkdan32.exe	89
PID 2784 wrote to memory of 4380	2784	Kkkdan32.exe	89
PID 2784 wrote to memory of 4380	2784	Kkkdan32.exe	89
PID 4380 wrote to memory of 3356	4380	Kmjqmi32.exe	90
PID 4380 wrote to memory of 3356	4380	Kmjqmi32.exe	90
PID 4380 wrote to memory of 3356	4380	Kmjqmi32.exe	90
PID 3356 wrote to memory of 1744	3356	Kphmie32.exe	91
PID 3356 wrote to memory of 1744	3356	Kphmie32.exe	91
PID 3356 wrote to memory of 1744	3356	Kphmie32.exe	91
PID 1744 wrote to memory of 1512	1744	Kgbefoji.exe	92
PID 1744 wrote to memory of 1512	1744	Kgbefoji.exe	92
PID 1744 wrote to memory of 1512	1744	Kgbefoji.exe	92
PID 1512 wrote to memory of 2764	1512	Kipabjil.exe	93
PID 1512 wrote to memory of 2764	1512	Kipabjil.exe	93
PID 1512 wrote to memory of 2764	1512	Kipabjil.exe	93
PID 2764 wrote to memory of 2928	2764	Kagichjo.exe	94
PID 2764 wrote to memory of 2928	2764	Kagichjo.exe	94
PID 2764 wrote to memory of 2928	2764	Kagichjo.exe	94
PID 2928 wrote to memory of 836	2928	Kdffocib.exe	95
PID 2928 wrote to memory of 836	2928	Kdffocib.exe	95
PID 2928 wrote to memory of 836	2928	Kdffocib.exe	95
PID 836 wrote to memory of 688	836	Kgdbkohf.exe	96
PID 836 wrote to memory of 688	836	Kgdbkohf.exe	96
PID 836 wrote to memory of 688	836	Kgdbkohf.exe	96
PID 688 wrote to memory of 1968	688	Kibnhjgj.exe	97
PID 688 wrote to memory of 1968	688	Kibnhjgj.exe	97
PID 688 wrote to memory of 1968	688	Kibnhjgj.exe	97
PID 1968 wrote to memory of 2312	1968	Kpmfddnf.exe	98
PID 1968 wrote to memory of 2312	1968	Kpmfddnf.exe	98
PID 1968 wrote to memory of 2312	1968	Kpmfddnf.exe	98
PID 2312 wrote to memory of 4204	2312	Kckbqpnj.exe	100
PID 2312 wrote to memory of 4204	2312	Kckbqpnj.exe	100
PID 2312 wrote to memory of 4204	2312	Kckbqpnj.exe	100
PID 4204 wrote to memory of 3760	4204	Liekmj32.exe	101
PID 4204 wrote to memory of 3760	4204	Liekmj32.exe	101
PID 4204 wrote to memory of 3760	4204	Liekmj32.exe	101
PID 3760 wrote to memory of 1964	3760	Lalcng32.exe	102
PID 3760 wrote to memory of 1964	3760	Lalcng32.exe	102
PID 3760 wrote to memory of 1964	3760	Lalcng32.exe	102
PID 1964 wrote to memory of 4972	1964	Ldkojb32.exe	103
PID 1964 wrote to memory of 4972	1964	Ldkojb32.exe	103
PID 1964 wrote to memory of 4972	1964	Ldkojb32.exe	103
PID 4972 wrote to memory of 2024	4972	Lkdggmlj.exe	104
PID 4972 wrote to memory of 2024	4972	Lkdggmlj.exe	104
PID 4972 wrote to memory of 2024	4972	Lkdggmlj.exe	104
PID 2024 wrote to memory of 4732	2024	Lmccchkn.exe	105
PID 2024 wrote to memory of 4732	2024	Lmccchkn.exe	105
PID 2024 wrote to memory of 4732	2024	Lmccchkn.exe	105
PID 4732 wrote to memory of 2632	4732	Ldmlpbbj.exe	107

C:\Users\Admin\AppData\Local\Temp\4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ceca75b67fd547463e5c4a569a5d7d4_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\Kdopod32.exe
  C:\Windows\system32\Kdopod32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\Kkihknfg.exe
    C:\Windows\system32\Kkihknfg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\SysWOW64\Kmgdgjek.exe
      C:\Windows\system32\Kmgdgjek.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
      - C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        23⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        24⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        25⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        26⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        27⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        28⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        30⤵
        Executes dropped EXE
        
        PID:888
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        31⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        32⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        33⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        34⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        35⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        38⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        39⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        40⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        41⤵
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        42⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        43⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        47⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        49⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        50⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        51⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        53⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        56⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        57⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        58⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        59⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        60⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:436
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:468
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        63⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        65⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        66⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        67⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        68⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        69⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        70⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        71⤵
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        72⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        73⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        74⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        75⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        76⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        77⤵
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        78⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4932
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3596
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        81⤵
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        82⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        83⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        84⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        85⤵
        Drops file in System32 directory
        
        PID:1244
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        86⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        87⤵
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        88⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        89⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        90⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        92⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        93⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        94⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        95⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        97⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        98⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        99⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        100⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        101⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        102⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        103⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        104⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        106⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        108⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        109⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        110⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        111⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        112⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        114⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        115⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        116⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        117⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        119⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        121⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        122⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        123⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        124⤵
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        125⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        126⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        127⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        128⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        129⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        130⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        131⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        132⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        133⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        135⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        137⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        138⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        139⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        140⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        141⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        142⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        144⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        145⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        146⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        148⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        149⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        150⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        151⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        152⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        153⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        156⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        157⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        158⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        159⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        160⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        161⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        162⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        164⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        167⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        168⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        170⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        173⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        174⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        175⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        176⤵
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        177⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        178⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        179⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        180⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        182⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        183⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        184⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        186⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        187⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        188⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        189⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        190⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        191⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        192⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        194⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        195⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        196⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        197⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        198⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        199⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        200⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        201⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        202⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        203⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        205⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        206⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        207⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        208⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        210⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        211⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        212⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        213⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        214⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        215⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        216⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        217⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        219⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        220⤵
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        221⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        222⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        223⤵
        Modifies registry class
        
        PID:8068
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        224⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        225⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        227⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        229⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        230⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        231⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        232⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        233⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        234⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        235⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        236⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        237⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        238⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        239⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7540
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        243⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        244⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        245⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        246⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        247⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        248⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        249⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        250⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        251⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        253⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        254⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        255⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        256⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        257⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        258⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        259⤵
        Modifies registry class
        
        PID:7952
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        260⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        261⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        262⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        263⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        265⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        266⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        267⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        268⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        269⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        270⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        271⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        272⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        273⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        275⤵
        Drops file in System32 directory
        
        PID:8732
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        277⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        279⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        280⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        282⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        283⤵
        Modifies registry class
        
        PID:9064
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        284⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        285⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        286⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8196
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        288⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        289⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        290⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        292⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        293⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        294⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        296⤵
        Drops file in System32 directory
        
        PID:8756
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        297⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        298⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        300⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        302⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        303⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        304⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        305⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        306⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        308⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        309⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        310⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        311⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        312⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        314⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3088
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        317⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        318⤵
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        319⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        320⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        321⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        322⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        324⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2372
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        326⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        327⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        328⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        329⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        330⤵
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        331⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        332⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        333⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        334⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        335⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        336⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9640
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9688
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        339⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        340⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        341⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        342⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9920
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        344⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        345⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        346⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        347⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        348⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        349⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        350⤵
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        351⤵
        Drops file in System32 directory
        
        PID:9356
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        352⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        353⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        354⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        355⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        356⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        357⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        358⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        359⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        360⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        361⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        363⤵
        Drops file in System32 directory
        
        PID:10232
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        364⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        365⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        367⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        368⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        370⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        371⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        372⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        374⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        375⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        376⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        377⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        378⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        379⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        380⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        381⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        383⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        384⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10108
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        386⤵
        Modifies registry class
        
        PID:9580
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        387⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        388⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        389⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        390⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        391⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        392⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        393⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        394⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        395⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        396⤵
        Modifies registry class
        
        PID:10588
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        397⤵
        Modifies registry class
        
        PID:10632
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10672
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        399⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        400⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        402⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        403⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        404⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        405⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        406⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        407⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        408⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        409⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11196
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11240
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        412⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        413⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        414⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        415⤵
        Modifies registry class
        
        PID:10464
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        416⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        417⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        419⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        421⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        422⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        423⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        424⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        425⤵
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        426⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        427⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        428⤵
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        429⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        430⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        431⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        432⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        433⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        434⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        435⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        436⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        437⤵
        Modifies registry class
        
        PID:11152
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        438⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        439⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        440⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        441⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        442⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        443⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        444⤵
        Modifies registry class
        
        PID:11076
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11260
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        446⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        447⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        448⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        449⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        450⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        451⤵
        Drops file in System32 directory
        
        PID:10988
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        452⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        453⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        454⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        456⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        457⤵
        Modifies registry class
        
        PID:11320
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        458⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        459⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        460⤵
        Modifies registry class
        
        PID:11444
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        461⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11528
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        463⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        464⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        465⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        466⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        467⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        468⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        469⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        470⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        471⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11968
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        473⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        474⤵
        Drops file in System32 directory
        
        PID:12052
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        475⤵
        Modifies registry class
        
        PID:12096
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        476⤵
        Modifies registry class
        
        PID:12140
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12184
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12224
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        479⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12264 -s 228
        480⤵
        Program crash
        
        PID:11368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12264 -ip 12264
1⤵
PID:11328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aepefb32.exe

Filesize
81KB

MD5
56795976a6980e2f08252cdc0ff42ac0

SHA1
d79478f73e1dfd7682a518567292206d3cbbc9d7

SHA256
6877f4535b75d09731af8a33a19073a86adc3bc1abf136b79f4a553e9b22a199

SHA512
91bc6be7179a977d6722fc4970f645d15249d75c31f358021c67acaed6d07017ba914f5c05b29ff7fb786a3b6d75750b9090178ccde8b8073cf687a9fad2a874

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
81KB

MD5
4c21dba428034bf6d0ed1e2c0e660b72

SHA1
9ccf6fab82e5c72109e2b86f992653c9f9572699

SHA256
d47fac3e6f1ed55078721a29da6cb834f32d2be9b277e6791f2eab8f65e78305

SHA512
1f0ae4e1d208221f4d12f35dbaeb9423333a93f5f219b11dcae6eb4946da486c667f5beae64d557f63ea1c9a555f0e7466abbebcabbdfb1a44cd8c4d6549aa76

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
81KB

MD5
0861f25db9739fa8c7e3e09455ba45d1

SHA1
b74fe74a9cb329051e767edef6d8f86f24bf487c

SHA256
db20734bc3c314e8b989623f261005f0e617f62cc4f9c760faab0a2fa7ff942d

SHA512
f647cbca03c623fc9771953817d08002df4515f9a2830e29d2f77411563c61879459d397d1e87ad45d8aeae03bd7fcd37c22812fca285ea27b84bf5b4dfa79d1

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
81KB

MD5
32e15f9285e1143b48440148b767a137

SHA1
fe96484ca69cd0b457c6bb2c3de83c844b6de590

SHA256
abc2744911908caf4c2ec96e4f799f26a47676d3d71f55d5fdcadf8855ae91bb

SHA512
ef3c6bfd802570584b30a60b97be3d6058982df3b7060a91eeebbd76bee81cd207bb7d730cbb442ebf81d92ffb357fe242345ec6e374b2998b17059758cdcec9

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
81KB

MD5
28a2a175e4fe3ff56bce15d6d7c55522

SHA1
214c3486a8a66cd57d3aabe7bd40f2e6a340c28f

SHA256
0d28066aa85f63994b0ad820d6d296546174448b89413ee51b31c6a7ce7f4c34

SHA512
124a520912f36631bce76c7dc7cf8a1ed3aec8d4e538e8f83aca72f9eefa10d1b01cf0fd2c96a2c4ea10d2555b8d354f32f64bab12bf039e364f74c8b32287e5

Download Submit
C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
81KB

MD5
d74e6b1aa6d102574a81927b4dc34d35

SHA1
d172874c6278e678486dd5c102c648a76128cca5

SHA256
d453de5ea8813e5409a383bf6176baa3a03c00f707a5a56ca04b7381f66e3ab0

SHA512
304ba87b8c780d36416424ad852621c9e9bcd8384f5d9a8f5b741581ff9faa5384b9b25ff01396d6c2382042b7d8e1d41965a984c0d9f0c0b42cdb296bf0ac80

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
81KB

MD5
1a40e9133ef7378754129049f36bc259

SHA1
220dcb5bccd3f39311a8974902dcb791637b40f8

SHA256
e7907aca9f848b30d7739ff8c84e922c6d7ff9ce81df591fefeef9799b3c6532

SHA512
178fef78c23f2dcd949451b8de0f81b0f1ec9821687a361f403ab3214555a971e12210599d03db3732ba1e136bc2024c6f585a8e76ae6ced61d9fa8656b8aef8

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
81KB

MD5
d3cce0cc69bd9f1f7b7a7ef56f16a18e

SHA1
40c33878d6e10be73583059304367e28331ab1aa

SHA256
e9d26d49d1bf190053020bb7caa828e30af69f62252d41274fb7e1a5eda644d3

SHA512
b00c71c4e6d930ce1ce2985bb2e4fc3008d8dd4edd40450265fbe14967edf2d7596e86c5c8efd4afc2d69c3d74b4c9a501f82706d42fb47a81466795d1c5d36c

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
81KB

MD5
83318050e497739aec65311c2e8329a4

SHA1
86e06436b6767cf50a6ca580adb4cc3edf04101b

SHA256
f029071382bf1c9b329e1925087fc2b1673e033eeee2ecb5eacc58a036d85310

SHA512
0b02b395a27eb3d32219a51433f329892e4793d61ec64ad4c1a76b4794062ed2ed98f544505d10eb522f5305b03acc817478b4c8c512b515d74df235f6d1f719

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
81KB

MD5
d1c508217d2e7c2e5f31a3dab09faa28

SHA1
190138d6c6995122af0ce1b1bbb0a812aafdfd4d

SHA256
2a362fee5d2f849a3758abad5c25b72da3520aadd3baa4350d103e4ef2f9c0f0

SHA512
725c574ecddbffb3d9625d11d9a4c9fe0246e1d13a13997408052779769f7bad6aa4cebe2fc39ca472bcf38c9e53c9ba7f085886e7912dd8e2aa2a7554cd7f18

Download Submit
C:\Windows\SysWOW64\Cbcilkjg.exe

Filesize
81KB

MD5
c29c4b93e1da14f2d8404e517d994d67

SHA1
9a3c8544b67383cdf6ce8e1dd6a2024ec811b66b

SHA256
003b17f91436445a9cfd069aee8e20fc7b04e0f60a41005f7f6266ff9795efc5

SHA512
2a21ebab81e5889b160970d99227e9986c96ba9258efea04e07d79d99de9e33cba6fdee82c10d53dd5ff1ed7b6495a258cdd7cc7106993dfec27fff398248e96

Download Submit
C:\Windows\SysWOW64\Cbgbgj32.exe

Filesize
81KB

MD5
ce64e1742938b8925f69793ee3742c4f

SHA1
af527ab7d8237f35f175d96ea059b220b6ae8ada

SHA256
a2136ace1331e7afe0fd82bfcd3459339f3002d6a5d85660d7fda1136c36a0da

SHA512
54500a5072574cf4edb5de318b29e2e4757d721df62a42e333e9760ea8ffea3ba61b4c5deb69c609c71d979bf72ebe8e3d9607149642383dad5ce56402bb10cd

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
81KB

MD5
200e6e4d0183971f0e8c326fd3a2cd75

SHA1
fa6105c2cd237fa51e52e10ecca289208e0d6cfc

SHA256
2eb1cfa284a39b5e05ef6320c177c1beeacc0700aa172f973a6b9e231e4e2fe7

SHA512
a82315447945f0adbf49b44c43e182f35bbc4f63dfac913560c6b48e91636740a3086ce185f2d441db9236ac5316313cdfc9a4c43af55223be4e8a57e2f59cc1

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
81KB

MD5
56b040c891334f0d85d5ed1e0a383ce2

SHA1
f7c9f99474025d4112d43b1a3558b0afa5ec4226

SHA256
4f6e7fc0f2897fe1a15d6569c7ce84af9800e234dcc23668daef7e6cc44a237a

SHA512
e46d93934e18422866701fe28f92c519df760a2e422e2ed016102decceba466b86dbe12874ca4016c3d1e1d79f6635f1417871972ec178bd59bab4cec6446e5d

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
81KB

MD5
ffe4ad2700ee8bc69047a0d950c22e85

SHA1
1e42220d0b98b15df2dd25369ee75e7e1b69090b

SHA256
4134474f2553dce0969674a1e347251ae7d9202abc5c61aad8bb8c46bc4d5d43

SHA512
433648c717acf50c1fcf5096e2b07274f5632ca4e0d83cccc304f6426530f4f1b967b2c28027a600d36d42e18d23e6a985068cd3fd32d061046776ec8bb030f7

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
81KB

MD5
b6e53ec09d805ea4f01042592a75dc85

SHA1
cb296250a91f975ebdb596cd53de8c040e2ab227

SHA256
1d5eecc33b131d2fd790ef4021038192f4ca5f3ce02d5df87b6bd5117128eaa0

SHA512
f7686676afdb59d10f12ba197bcd08179e8fed47b413e4d22e069a95cf6094c4033122c05952999b8836326a7d291cea610f79af701127077b322b97e50ed033

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
81KB

MD5
61521d7f95dbfaf22ca6d205779c803b

SHA1
c49d830e49ee845dbbb6234dfcb8b0c57022f746

SHA256
4c0d6265f0dba213a681b142ba09a20a82c7bc8df4306b7a802ed39a00767587

SHA512
46fdc6963530e8eb55bcb7f1bf7971fd3a43c81ad135c548d3ac28174928583c0f800b5b253bdc5c4ec10e1f807eb8f5277d94b5273c1c025099aabf4071c6ea

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
81KB

MD5
8467caf2660c53a4ada5139f81692094

SHA1
1305df7b09045de615ae0fb1c7ca979538cb55ab

SHA256
439d312d8ce9cef602ada259c1dee675881455d57e17e2764b6aad310db47c29

SHA512
f73ae19f230abf626cb88f187bae3a98bbc3453bfda2999b349ee1e11f9f3639802b58714671c47b2c653376e3573caac7166f06589d5e5e66f6e3fe2e7e39c9

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
81KB

MD5
7dd1991a9f5e2d4dd3b1a369ca6baba6

SHA1
f102044c6a18249696a56c7ac0eb664937091547

SHA256
59a8ab1d75aa81eaabcadcd16624e236e13cde214ad8774673efd69053ccb732

SHA512
358617bca6c2c7fd5efadc639eb4bad0bceaae0a894c857e5d50864dccc0aa04f282754ce0090c9a03a7c7d5790e7d103f51447e353bf25865f87f14b55e086e

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
81KB

MD5
b36351d6bfbd4fcecc53d121dffe196e

SHA1
ec6a93bb91a80a487d9d35bb62156644bebb1150

SHA256
f410a45c37eb03596b22f1c1a6402d37d45496975bbb872e9092e8135315754f

SHA512
50f890d67a2dd9fed565e59de50a0d9c7bdd8615ab6a5cea59c8e338567ef52844051af93313816471dd46b9c130adf9f881bbbd994b39f34afa963103a5e958

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
81KB

MD5
2e579f6466c547f23f5fb786f51dca18

SHA1
8d78d008e317fa7e519a40b330c671f6591e99ef

SHA256
df6d2c3448d569a9acdff10cb91607ca3dddd1691b070c53fd2891bd0c8f6ef7

SHA512
11c2ccae2da9ab16f11cecade0612d509a4ea44f09095bce2cf015d4c8992a71dc903fe859d95a2be4fd593b97d87c311c9dfa0f935b3a5817db28c205098adc

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
81KB

MD5
6b15acdbca894232484abd698dcde5c0

SHA1
8a86774b9697be9b381bcc02cd44105fa076eede

SHA256
7c4fcde4482bf7ffeb6d30ec97e1bcaf70bc4b6e2d977c364713689e261c1bcb

SHA512
3af0a5452b9250a9db680313cb219db79e09e857f7f93a7eb2bdd058ce92860742ef9384ea1b375378d61b2980514f2217a621ead512cb2830b7478a6d96ba13

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
81KB

MD5
45b0fb73c8e4299442e57018e378f21a

SHA1
0e06f69604e01d0faa48c3aead391291a0a8bcdd

SHA256
33c9b28b1061b32658bc824ab20322d144cf0250393eba2c6228dd894cdf35c2

SHA512
ecb5c6146c50058b6175657cf1c4732594aaaed74c74c665d017ffa4924c68676db8b95de678de01357e3d8b0b82c2a8080a5407f15c87b1bf5595730a17b480

Download Submit
C:\Windows\SysWOW64\Elgfgl32.exe

Filesize
81KB

MD5
4dd484e6a771e7495b68f8c4acb77c47

SHA1
61540ecb51cd332a9cbb818829997dec1a393412

SHA256
9d49036c7ee07aab6a26808c3610e8662ed59a2bd1aee0cc0fb21ed5ee4e5f8b

SHA512
4c18213d7baf87922dca745e8a29c5f5ee3fe716a0a9bc4aa7d1515794445acb27c7dc83ad528f319f50f598b214e5e0c96c730eca8f1a353446299732c67e68

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
81KB

MD5
5da7a889a099b9196934a50f729f4fde

SHA1
37c23efcc67b85cb644cb90aa079bc7c6888c3ac

SHA256
2db82a44dec7b0e7b6a60d6736106e5a59b23ae1585ed8b68d4d3b5d4a3950c8

SHA512
1fcf0295200a520de539155fbccec9a57c7d39f9718b25c0e7ab3837bea20afcec303644d3b4b1231cfa8eb857a5fd33289a10debab1bfb0441362bb06659682

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
81KB

MD5
70d710cb85f6fa07d52e5f1cb2fadf0c

SHA1
83de82a0c2c9a0c40c9a73cc0489b739dd550c2b

SHA256
917972d9f1f3b16fc4c4fc979ec701c429344a9341d46435b1d7d828083f0ed0

SHA512
a2d6bc1e839e23f71a7a0bd60f63a5ec7478fc82dc30d946c315c2be4affc30b0595da837c855e5ae304caa080e88f7d3b7800eef8d49c66c25c584558d2097b

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
81KB

MD5
7eb110d3acd40916ef686c5cc466ecc2

SHA1
1d1e57e0cc21676cf029f5f9bfb360ab28a54b76

SHA256
92f4453429f91d7253c5078ff96dcac3d7be8d62dcd53ad67210e96c56d72103

SHA512
091da9504f7cb5f2bc7d919e881a9aca62eb011e9f234a81561be7b02e3095ab08af5dbe288607981641f02ed0f07682fc243160f1456241f2bd28cc4159862c

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
81KB

MD5
e50a2aa9891f8c818b8539f0bd4fd3ca

SHA1
8c4ed242d25ef9a784c893acc65452d83421a792

SHA256
1e14cdbf8c1d3663d94c8d4a99613cfca044e76f78d78ff373bdb40a7e948852

SHA512
ccaa10cc946cd186a56a0f714a8b9898d2bfbef37abcb222bf1976cfe4a1e552f6a8cb6da7cde734d8e119011778e3f02bde3b1abfc0933570026ae3d68ada08

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
81KB

MD5
704d84e156c21780356cbdc769c2b7d4

SHA1
fcff7e50c3b54c512a45b82e50dd2ad4c44671f0

SHA256
579c05d0b7c9e30f22e5721620a03723599db908e2881e7b55c5cb46c6399520

SHA512
7d7186fa4023e78efdce393690cf273f6631774b2b258b06cb25537d1ae703a5df75bd7ff10464f6884e51d06ca2da5117f519e2d47a34f809cff5e710004357

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
81KB

MD5
c32e9083f2b32edb4bb42039e7d32fc9

SHA1
a286dd0b798426ccdbc5df35d25ce778d39dc063

SHA256
1150f57bf94eba5b5edf844eadfb66c43b27f533b1dca9148ae6f9fd3f9a2097

SHA512
3d97a0526a851d2b4eb995dace953acd2139f7eb94eb2e97d79d34f7f8496a4b8dde94c2f2764c2e0d08a38a44bddaa50f75c2ea5144dba35e6694e18c4122a0

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
81KB

MD5
44ea83fbd49579ebf6735fc32c35757c

SHA1
9dbd009d8b50c1a4083fde1d26b1985cc56a0b4b

SHA256
52cc2b639b233642336d1eee3c75f8c87a4b12ea90e4ec610fb1d8e6a37618a8

SHA512
aea3610c52d581ca5f03f66571d7eac31e517f73683e132175a2dd9e520591c1cd58a88e391bf61acca6ec643794dbeffcb2508c1f278b6e102c163e6a463347

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
81KB

MD5
eb9eb55626888bc220f41095ca73c64a

SHA1
3bdd2b5f49765f4a88bb43cb7589163982397d75

SHA256
89c2aa341c0a88c0eb0a8af435b2a820a81bc95124fbc3629ea6b81725a1ef50

SHA512
fa80975a27745ccec42e648157ce5bdc2311b26fb7dd36deedfc474aa205050d0d2aac0ddb2723bb63eb05fc51be8365b92b7cd8fe3ed60388b08220fc7a9d0d

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
81KB

MD5
7e438d418afa670d2b2b1b888b5f260f

SHA1
8045cc507641333262e450615063312fb98ae8ef

SHA256
5af26c2d7fede8821350458990b3cbc1b918fffaeba6c54741b73fb97edaf0b5

SHA512
4c3b5858ff9c7d94cf3eca80d9b0a3fe04199b65074252c58e46ca7c7795297591b335613257284e928b1029b094409a8a9778ed09991b93ac793c1f1ab77120

Download Submit
C:\Windows\SysWOW64\Kdffocib.exe

Filesize
81KB

MD5
9673c7f9763de73377410bb93447e0d6

SHA1
3047294cb8983deef5d0d97161549be9464e1c48

SHA256
2ba8a69e74ef45b82cbd05662dce1bf6b7f0f944f5e3c863b18035f72a1660fc

SHA512
9cb39b8233d2f8582966fc6645e5b48194067ca2dbda791ef577ae10680e6b80947d4612725ffe18243d8440a6d65a2016b9b54c5f147839a389d7d09165e33b

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
81KB

MD5
6cd187e55fc451a6825ccab3900605d0

SHA1
f50db2a5e6ff65f83225d2a3e3c79d8582db1c9d

SHA256
b1190ca26bfabcada88074db1d3beacc3f2594f44533b6ef7986524f9b7ba624

SHA512
88eba1c505c96dca39becd1c20d42a8876722d1435b14cb8dad997e293a5ce553137411e79ec74735db3bc653aac1cd1270f2a21809e52e3f0a9abbd824de117

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
81KB

MD5
139afeb96807df017c5cbde6ec540122

SHA1
373aa36ea00945e277c708cbbb82f20513cc8196

SHA256
b8b9d55158c30eea931fabc1e508e62f998bbbfefd636520260039d4894ee01b

SHA512
8bc1e193d52ab9230d0ae8c46b3d454cc066a26932002af66ec0f6cc281605d117ea9f1fccff825f63ef4d837db7a8f350c50fc6e535d16c8deef39c65ef7c2b

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
81KB

MD5
8c099bb7b04b4c90ffafd1f38e3165fc

SHA1
c9d2f943d23aa383cb733ae02d99415cdfcc8ba0

SHA256
2dfb161f442cb2092a54aa3c1e5afb6d7147ef46c63a70d1b308e13c417bb0c3

SHA512
73a3efa622c8bc40e3e9ca192aaefe86dfb260a330770e235a1301435c37b70e7c0472629add199254f4d284b4ee16f99626372f5c7fb9cababc647f1dd30ffc

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
81KB

MD5
df4905a65c940954276bdcf5c52b6471

SHA1
f8fb3166a19bed65f7e411527bd15b53b54a7f48

SHA256
d3b66810ed27f8b68d980662961b4ff29eb9ad161d62ab6d9438e9a65d9fd964

SHA512
8c5377eff21260a306149aab445fdb19b061494a80c6a52b99aa28d3db50bc64c0e029df85b57aa38ae5445945c4e628ecb6b1d5aadf20820e75e53a6fb77be2

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
81KB

MD5
d94d74044cfc2a5ec964b9f7a728a3d6

SHA1
bb4121aff55e28e4a0d7a2e42272c60e796d7b9e

SHA256
a48b66d8e4902ea69541f2a3d8e89addfca10751f4083a85c1451baf32d8a463

SHA512
346e04b5e492dc215a49d58b6a5d5aab549970b823a5b2fb67dc7be7aa16f97870903b58ae0a8c29da3b25dddf5f6cbc1dc228cfaa1bdbd8c9e0789f596bcac3

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
81KB

MD5
747cc35fafd0b130370a36c6ee50057a

SHA1
f953a51125cdfdd09eecff810b980731ccafa0e5

SHA256
05f1873f2bdea3a9801bbda221410724a2efacf888faa80ab9fe9bf339088e85

SHA512
628a366169ea42ab54a75fae2603c7100c1f76a5b05ad5fb182b07dfa84fd9e91f4bcd94059c83e919fad948306db475a8cdc96de44a7ca7371b8a52577aa3a5

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
81KB

MD5
376c1651e614ec73c761c1bac1f260b3

SHA1
2e0c94a465047698d7fc810c57512060544552bc

SHA256
d706afe449ec4dd7836da951a8db52f072ad59caccfc4d37f1ef78cc8da0bcfd

SHA512
160cc257540ed5557a298123c3b4b798fa545d9fc643278af1271c9066a728ce61d66a70ea2d612ec38c80c3940ead901c312b7773632dd9bd79d71c033418f6

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
81KB

MD5
560aaae832660652e14ac160b80587fa

SHA1
7023872383c75fe7a1ee406f0d2090094637f7db

SHA256
790d73c5d248707bdecd2e22cc648cc5dc70dbf03adec46e4c6198666c3fa834

SHA512
a0f021e31898633a4faafe4de02eacb892c8281fe768b661ab997c554761d15ccdc074ecdee41182b76bfee871a18e7c6328bf6b01ef16d9b8f234ace9e4e118

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
81KB

MD5
b7dff9e475336f800499a5b7275a97c2

SHA1
bd99838d9aa854c41e94e4ae3506a6164e31b8e3

SHA256
f079c98cca806c6efccbfe21c3389c2aac81cdaf751df9cd0f5e30f121c0b8d5

SHA512
4914b5aa5ee875f0d7e64469f3fcb4b118e7175f9aca5f72a03a6a193c812c4f4f2bb62760258697259a9a7e1060c162ed050559eeaab4b2ae388684178022eb

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
81KB

MD5
8c815981fef8a8a7da3d1c51f02fd4b6

SHA1
aa37377f71d4295a11746eb589d7d4010e242d71

SHA256
89837638b6ee196b6864dd24a2d201a925f50606d8a7cd91e5f6253a8581ba1f

SHA512
3301ee8e0858e3dc6095441cc95044d9e44d289cf0d42b916730d709247241ffb482fc1be52e2e9c1f54fd188a36c050049480550fe30a1b71d3db1a379be56d

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
81KB

MD5
7dac55af1ab9d4a2cb531a7341101f8a

SHA1
e6e4ed1f7d99da605e3673a616dcbafd512232c2

SHA256
c601a29c8101de7b3e4694994b75bb4a547ccd79722e4382f114eb618b7a7165

SHA512
84ff329f14a3e4f7ee608897a5b1939119e279a2951a5a3a8467dd3444e568f43d6f207f3cdd9c66882a3ce730e61c7505305f4556b232db51f645a55ba47518

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
81KB

MD5
b80367a1dacdda577756d5639a954ece

SHA1
7ae08fa46066baf99d040a034c7678a575945386

SHA256
18c666725263e3963e9bb74576fd807e0215bdc688fb68fd2bf28f018669a528

SHA512
1b2a0b99a255dfdc84ab19344b04426e3ac73a04a8405b20f8092d450e2c8231a69fe6c148caec171c4b58b721dba6a9c8366b84a080557d384149ceeffbb180

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
81KB

MD5
245596eaca103c3160dd9830b770ef88

SHA1
f8f7f7bd481fff9ab158ab095f509388e193b487

SHA256
ce9a2c431d20fa76a6722d9fe9cd2d2c2856492587ee0d5fb7abb4eb59eb08e1

SHA512
5da67dc94419b28d3d8940febd23db2c024934669b424b53eac362a676e2a5b97f3454a73c58d46aeeb4c8622a495f85f02bae797de27fc69c448f34d1942fe8

Download Submit
C:\Windows\SysWOW64\Kphmie32.exe

Filesize
81KB

MD5
5da690827d2eef5eb2d183c284e9b01b

SHA1
e88f285e55d680db0fba27b96fd31647386c98aa

SHA256
3ed0b7289113ea1f85e71177e71ae70d7234e07f1e2dfd159af58628da7dc7d1

SHA512
db3314a149305e27c53cfe52fb3ecee30c38274c6c2195a24dd4d9007f3a1e4b85ce54ac342e484a445f911768232c367ffb676a69241a2f22089327adebd562

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
81KB

MD5
25e764fdca374501068bad7271b75afd

SHA1
35048181da3d3e9fc6437bf6a5358afd10e54e02

SHA256
76e37e856af1dca355870f1cfe081354d7059f5d5a6b4e8bd2de393bea99cf7d

SHA512
fcc5915a6844ff0853654c9d4f9bc78c3c8159560b9c802f871324b3dea7e7c24417b4363db31712aa9ded4af09fb7193dd4287cd83d4c0f0e15a090bf7ef29a

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
81KB

MD5
aed0fcbd3d9d5714af63fd18dcef7049

SHA1
bc3b052dbed08a9042799b733c94fd541e8c9550

SHA256
d14fbdca7ac32617602de3aaaad18d1ad49faad54cc2fd00631f514f0c6177e3

SHA512
7acd055a9b486369f6d524ae80e58a374be06fc18adba8a353972a6984dc54dcbbd0ff9d1976269d05a0e4c68165f993f75f1a62545024d553a8e2d40d259da4

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
81KB

MD5
e8aab80b87b30e368b916fa56d1c7c5f

SHA1
ed67ba22932e7cb4011bd23ee5f72b7dd26dd927

SHA256
9b8990d76f25ab4f7f13f4134e1443019abaaa604589ed056026f1b64958708e

SHA512
97335106493e2256277bf66dd5902381a01b5f86e9461e31ed72bb56ac0daf9ba0132a7357e7620b58a6b21bb341a4c6c061e3fb8883b8e1f2199a2f41865303

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
81KB

MD5
21a3a6d14d1180114d2f6afd901b5a69

SHA1
4f778c15622d4ba6ad5a61d5952ce2c512193f1b

SHA256
8cd2facc1634662ffb572e9cf40b18dd163bde44b4e3c504468d3bb721327bd7

SHA512
9662e66eb64f8295e8f88afa2824b7689edf41030efb987c8f03a709048dbe1d0ccbd179e1a800b2d73720de61f36706632b006e108f3f1091c04f24b2c6cf6f

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
81KB

MD5
05407b2142c4ac7edddee4ad8406c75b

SHA1
444004b54ac98578c9fafb83e865dfacb828315b

SHA256
5a0531efa26e45a9862962f905323f2edd11e00604313f1a821cdcad85f07341

SHA512
0a3f6e4d277aac1c41e2f8808ef90f004c9b54e0a99a9d51467dc6e916b79fdbb08d8dd0fc37093d177c03a14776a5ae5ed0039e409690fa9634687d8186de85

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
81KB

MD5
c8fca190ad257d2ee280253c15a6c2f1

SHA1
37e6f6a625b1584f69f45c5152384972410c0eea

SHA256
8c815ea6c41f90b7bfb9bce68f9bc7073fb72b50bc0ab6451a7857c54e4752bf

SHA512
a755f9ff7c441211297d420373c77e217081ecf89672361d0cd2c9938bb07d5138a73d05b1b59c5cd86987bb841a8763c27b293e1c573f56e7fb370b12a28198

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
81KB

MD5
f3d4d3891451741f8c07a1971d1bee09

SHA1
b4634b4c7d057b2f5233171ae74874327818994d

SHA256
03c6871a82df79f8a824e9b897cad08e70954a138455bf616ac32719d3f644a7

SHA512
a91a4a14538cdec5240f89faf9281cccf9474fe666060eef829c4b1771d82467572ab5dda26a3d277322be7fcdf44f800795fcbd7cb2b8d5dfbac56fab24cf9d

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
81KB

MD5
6f3022a40f43f79ca21e8561bcf0d79f

SHA1
47d8c7b2cc75623623a36a202f35ecd5cfafbbca

SHA256
43e97abb8993589a9dbbd4937b8b140036c9223e76a5371a48a2a009920e4a65

SHA512
1b2299c19e7f940cccbc630cdcda292a0e2973dcdeb5ba94b7e4add77a461f4ce61a8376a64f22c7b048ff81d42a8ba20014963ca6e6f1afaab202afd75e1d6a

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
81KB

MD5
56403d58ab649fc972cc8d3ac3303787

SHA1
a07abcf1feb0ecc1b1defbe6022810b50c708497

SHA256
be2bcaa09c19ff19c74c8d5e5e4a6b769c986af5c854c7ee68faa2f969a796c8

SHA512
a63421723fbfa62fab0a441dc98fa6165caef747f58d1180810b7b4da168096d7418db03c4e6f61586c983bd316bd46652ddf75044799d6bfde9990fd6951c20

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
81KB

MD5
bb22cfe3bc4ffaeb3041b8e8d2c3b50e

SHA1
4de103a2f26593e09f0e9affbc2aca0e725444ef

SHA256
51d562458306dd7f6860a174214b10644599ef19d9a5efb0e800b4a52835a565

SHA512
e9d7215bb692a6a7198f8d0dd001101100d898a036daafd3f898cd476ee3cfe36a3f8d77b86a1c3e0e9f4e1e4eed5691a7f424f461f3d16d24da85f060f64060

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
81KB

MD5
8f0abc70e46901c8894d6c28b3d0b911

SHA1
a18afeb77806fc2130e8202f87fda87d78921f77

SHA256
d1e946d8722b263c5a21fd8cd028d7fffcf6b4107063ab918f55bc522b4e0b35

SHA512
881ec65925bc854101a2f00debde3de58e29500104851b420d4bc0f02d83f8b81f3a685aa3d32afc1d0a870068675379df17d5762c8433447c3766d5c2efbcdb

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
81KB

MD5
a7cb9cc7bb582676a7a3c59baf853e14

SHA1
dcf6bd302dba173ffe209ad2378d8c40b776f49b

SHA256
bb225f523c23757a3d1f1ce80c7b46a9625ec34db2270c1f98e30b4c64d00931

SHA512
0be3e31a5bff4321e528f3d2fe2e7a4474b38d215e78684e0531072ecf5ecebbf49c44a7f3937ce3858c3c1cc9df1bb878fb85cb3af2db5e005559824770fe55

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
81KB

MD5
c0e4d9adb27f1e5cefd94ad220b4faff

SHA1
f0604ccb8f5583789ec709983f5810b0f6e436ab

SHA256
3b85e92a9b2a439e0ed9f7b70b8e33d643b85d8fa8a258699f4099fc371e91c1

SHA512
32f59f6af76cc325044bf0cc2fbaa5449ca1e7fe3a8b5db305c55cc16a7002f04cff58f6d76c5cef0551659ec79a41bf8c9f343511b85fbb2e2cff0961902712

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
81KB

MD5
083370609c4b3dd9be3e8c58537be440

SHA1
0d0c02d8eb045f58b815f7fa67c03bb0a94311fd

SHA256
d25a9020ebe8443d0bc8382a48fa96a676fee0c4a04746fb3b6b6dbfd437f5ac

SHA512
27e1802611ed4551920a1cb5c405945e6f4fbcf350243de10aab643e549b424205483aad1208f2e54e3e20cb6406efb974ff681cce97b7a2c7ca25174a8191ed

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
81KB

MD5
7960e95842cd1a0516e9bdcb6bb3de65

SHA1
d56f87740a38a3d6ffc5f0f7fbaa59e512737907

SHA256
d333254be5c4f659590871bb5ed08289eb867c2a4e1842965d8056b263ef851e

SHA512
c2d475ba9c4aed573295b4715da983dd349dda016c4f3a40028521d58f542dc8e27a0c36efcc9dfd659cd14d4c9c61b345246e59902f9473fc104d9532b63bcb

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
81KB

MD5
79587186adfd1068fa25c7b45e4a9fd7

SHA1
069a1e5e9b87e87e6d8554e203739ff0a7400eb6

SHA256
a3d690245a102f1cc731a87c775a2ea30139187e87d518d78d62e62ab73b7515

SHA512
b301e645e9702313baa61534acd8ed4a9db88b1f69e585d4f8cf09e20f73727e6def18ae01241774986852c56e4a20b1607d10cd9b327f294466cea696f98b22

Download Submit
C:\Windows\SysWOW64\Lklnhlfb.exe

Filesize
81KB

MD5
903dd4befa8a74b95873a27940b58290

SHA1
f388bd2d1b74127cad489f381057c9a7d105caa1

SHA256
2e9510319f28a94512341d843f1c088bb2e815750c8386092f1534aadde12696

SHA512
f6aab7c97198cac0587840b695d9480d575d46c885192d4f7766d46f4851f3a1ab819ccae7ef0b851fc6c50fa21dfada3b677541c6e0c27e6c744733b9a3b33d

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
81KB

MD5
8f74c396eae2ad4756970efa29b5d7c0

SHA1
35cf95f19ecd1b35da5d5020bae3cc89c1b46075

SHA256
e62f1dfae4b8c3d9fc3066c01559822ccdf30fdd8a7b7c9360cf8281eea62230

SHA512
1e6595bf39ba9bdf3ba042a34b48d247aef5a9b4bd77c9770748344a0b2010c39b883aa1a3c6b5a2bf1cd919ddf64934e093a873a4c92b79fc86acf1db70fe76

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
81KB

MD5
80b4d70ccafe1455073aacfff8b81789

SHA1
e70cb64c951ac0023a87aa976e081356fc4c6e40

SHA256
d1a172aa0a8dfbd41754714872cf4f7697eebe1a1700714ef63d466bdafe2526

SHA512
8f2b15b5c9a8b8650cbf4c819fbe6b33142f4b50a7ff6c9890daef8f1fc8491c3d4fcc9be86154bfb81fe356fb238f818f5ce8c67f8bb26c3ea88edf322fe55c

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
81KB

MD5
a2d79a3c2da05f60be87044f45884580

SHA1
15e72f92976d4f47f67e55f1cf19a07715521c43

SHA256
eca5f48902dd7be95da7156dea5d5f578e3d338afc89858df420c10e34f18233

SHA512
22fe3adcd7202cb2fe96cc7d4544ce0840085968c7dc89bcb4b8b9b190eb5385d7bac450e3f8a9d1629fe2c05c30e6d9913d5e33627ae2dc6835efd1b85d3927

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
81KB

MD5
108e94b9c42581bab12a17d7fff6b7bf

SHA1
8f45789c309b4cb61aa45a2aead2bff4784baec3

SHA256
eff9e57b0b3c798ea562d4db207fc35cb14544f5f5d59ba7c6d0da2ec8df3592

SHA512
dd842469ef908af0638c583ffddb7b914cadd1a928fe0e66504d7b0369960ba22a5d215acc848a98ee1b7425142b4fa43a797f6b35e4be115af8ddc0f6920598

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
81KB

MD5
93110f0efe6ab3b56147a68a2aa4bf96

SHA1
fe5495be3cc9a437a4d855220e9762a3a74e4776

SHA256
5cf4127c39879999901fc5893e2bf1dea096689c554c39921d37feb4ef2c4fbc

SHA512
f00a551518e616fd41894c7b96844059292b51d069eabf65bd9a1bffe8c96a96af8699d22b631646573f5f03b6dcdaeb3c4030340330c5975d5c656dafcbba72

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
81KB

MD5
4fc1e5374b85981993f9722e808bf5f0

SHA1
fe2c75a1f92bdf04302654595275144a89d85cdf

SHA256
3cf03bed3c139aa2e9df2b241dc0e59dd519a7e87bb2253442e22aafd01beca3

SHA512
bb6882f5ac156423922ddc66cd588d6eaa80aacfc31b29c257184367d653a27759439db2c2ec29b080e1af311d588b013c11355d87f70c7b6edd00ba9196f4f8

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
81KB

MD5
0a552e2541ddc66f12e33e45854fca9b

SHA1
b0c50f1a7a5edd1b7bd74ae50bda615dedd054a3

SHA256
b1f3336287735e81cfa9b68d3ea82ade39e5e89e377c849267ff4ff9387034a7

SHA512
74b279501c845540565568e2ad88a1aff0aac79d10a074ec0ebb80c1a707703a907c4d24ac3a0a677a0a69b30f3b8cbcdbfabff0ab4edaaf55334781f0a00042

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
81KB

MD5
cf7a8453fd9a51c33b8494822f598dfe

SHA1
bbeec2fcc8ff6e7bbdb715d8e082b6d12cdf112c

SHA256
5592168f7b7f8339dfabadcfe720cbcb2df7a13ed4f1a16e5b713d88edce2926

SHA512
1b77d464299abb18d22dfc2da1193273c2f82b7b477bd5285a800feeef4d9c8506153f8738743f6faa75417fd868f5638bb8021cfc32e8f1ba9737c6bb9aa534

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
81KB

MD5
b415312436a25a68ec64003e6ce188c4

SHA1
69ea04d7392aece1c1b1d5c1d7b0b28d09d928d3

SHA256
1d1f0c1a023bbc20afbbec968e0b3eb609f7eaa93cb8a5f4720f2383da21eb73

SHA512
c74bf54e046cf91792528709d422f13bc6394ae6154c5bd834508858460d0fa00653cf2712468cffb34cd0bf3df03b6c0df8c998abeb73f7e7e9c7f4439fcf22

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
81KB

MD5
b1617dd9dd54c820c4cc7a70b442256a

SHA1
6494193c864e2d1f6d8e91d7e9d8df5807cdedf3

SHA256
8450f5337c4bf76c96934007a12cb045f16cd31e5d74cb20852f6f545d9187b1

SHA512
5b6aaaf9d87a9d796ecd9014f104f16bc501081f682f9be3531faf2aa1e93406aa267f30922c117926e3d24d806a8c9b48ca437a8b7de85445c75d8d5a5d0107

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
81KB

MD5
2290c06f5ac5c054147f99333ad689de

SHA1
60ddff98152fb7479035fcbe918b1a37b448f093

SHA256
04b89e2055a458c136aee390640acf90b41ae5389a249968eac223d4378452f5

SHA512
53574346e0ba04814d9bc4dcfb42ccf93d105e9a9b111ae1dbe1d361b67ff8241beeee4962e0825aff91314d2e87c29ed843a12d81a0972aeee5f6a31acf7ca6

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
81KB

MD5
32ac1e7c62e75e527be74913533777c2

SHA1
0aec0ab228b7ad177b6ae9ca19e84d0c4284696e

SHA256
b153213bbbe1caa7916f250d1e7089cf333ef15aff5f9119a57e7cdbafe5cd15

SHA512
4184b1ee3dcdd408859225b824d6f2c9a4df7c3f24a041b733e006574f457c4537f49e9814cf699ff0abc1ccb5ca072bab68dc6929bd7c5f101b3b371c66f37d

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
81KB

MD5
1699b3fa3765417244942631a0c3356f

SHA1
a30939f5d9e36afd567c689e71d77544172bd57d

SHA256
e42c48e506ffa40fdfa2a46e5961ad6368bfd0c0ec584334036d490ffc9bfcdf

SHA512
e542af55151edbe4871411b22926d04f86a732c5643619a51e655072302c99c2ace2b63abeeb3820f5da05ab55c862d793560b2ba7693755c938becdbcca94f9

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
81KB

MD5
4a3a246d7a4fd2b9a4b81e4d48e7f23b

SHA1
8dcbac9924d5b4989a51c49b396282f262dc1e69

SHA256
26f56f93c38c1fc8611a764abf7cfbf8ba85122769b34bde1308062334cc4299

SHA512
75211e16659c7992803ef225169d7d655ea9c42f8ba81d6d9d99c908b9319c02e123a1c582e452aa056c83a7523b4e38ec0b4103c56a185a0cff8f9fdd83a71f

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
81KB

MD5
1806452b0168b9a1bff3485de4db8cae

SHA1
e8e90cda0db02808718a6fd13877fd78629039e4

SHA256
14a398b066d6ac49afaf771cdf0e928476a26714d9e3cd6d713c9092b1eb520f

SHA512
607da59d29f8a2681cc1d6db129e5fceda9d57cc528f10f1b666b3ba47edc4879b3f6511c36b090d31d383533d5462fa1ec39331436a132eb8569d66effecdda

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
81KB

MD5
d2972d7748a942cc23d9f1bc7f27f818

SHA1
24d920132003f3fb568a165bca78da6c4ca49e00

SHA256
e3dca051f171e607792a2db88cefca1b250a49cb34037f36a2dd55f9de65be9c

SHA512
7bef1aac508161dd21c88ce5b0a1bc4c322b93e7950b38e9378e9bf1da02831d66375e7a89ac741c0c6c956cae7371c798000fd2eb9775c9d2ea0fc2cae434fb

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
81KB

MD5
88444ad781176122523cba70475ffb55

SHA1
66a24ea5454361a0d9f5b409bcc4432d55f2ac5b

SHA256
5f568ca46b5c19b6caa1abae9ceef6ae668792b637cc602dc7578cbf00ac82a9

SHA512
087acba0b7519c939a9a4d3d42dd3d97f6eb205442a4590220581edd0c01c36013f096cb37e721257e6b433ac026ee5289e036fd50424ee061de639851a155c3

Download Submit
memory/436-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/468-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/556-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/688-105-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/776-539-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/776-5-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/776-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/836-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/868-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/888-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/920-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-513-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1244-574-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1560-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-563-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1764-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1764-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1768-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1848-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1968-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1996-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2024-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2248-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2312-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-531-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2440-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-399-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2628-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2632-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2664-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2740-547-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2784-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2784-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2872-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2912-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2928-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2952-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3024-467-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3056-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3064-473-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3084-567-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3268-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3300-553-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3324-491-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3360-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3416-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3584-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3596-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3744-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3748-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3916-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3920-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3940-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4144-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4204-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-485-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4444-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-254-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4560-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4656-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4724-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4732-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4740-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4740-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-423-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4932-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4956-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4972-157-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-521-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5088-480-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11660-3283-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads