75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8

Analysis

max time kernel
140s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe
Size

111KB
MD5

08a81f15c635deb970f505ee13296660
SHA1

60eaff43df8b2282483c6360e1e4bced4a85a92a
SHA256

75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8
SHA512

ae9396199d81fbcf976e19c507b5263ab02839930a4f2e9e6e332b2ebf13a18d8e4e4e79b904ff984b3662954ab6063d09a9f4f4c3df5e62219fc7387e4fed4b
SSDEEP

3072:mSRsKnmV+m9JtDUUJeBw0v0wnJcefSXQHPTTAkvB5Ddj:mSRtmV1JtoTtnJfKXqPTX7DB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Pbmncp32.exeBlfdia32.exeEcmeig32.exeIejcji32.exeJpgmha32.exeLlcpoo32.exePmoahijl.exeOkjbpglo.exeIfgbnlmj.exeLffhfh32.exeGdqgmmjb.exeOponmilc.exeOqhacgdh.exeAnmjcieo.exeAjkaii32.exeDmcibama.exeDbllbibl.exeDkoggkjo.exeMlampmdo.exeDknpmdfc.exeAqppkd32.exeFcfhof32.exeNnqbanmo.exeJpppnp32.exeQnkdhpjn.exeGofkje32.exeJmknaell.exeCmgjgcgo.exeQnhahj32.exeBchomn32.exeBmpcfdmg.exeDceohhja.exeFkmchi32.exeNpmagine.exe75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exeCbjoljdo.exeLdoaklml.exeOnjegled.exeCjbpaf32.exeFkopnh32.exeNlmllkja.exeOncofm32.exePmfhig32.exeFfkjlp32.exeKlqcioba.exeKdgljmcd.exePgioqq32.exeQqijje32.exeAcnlgp32.exeAegikj32.exeBbnpqk32.exeHobkfd32.exePjjhbl32.exeQffbbldm.exeBagflcje.exeDmjocp32.exePfjcgn32.exeEkhjmiad.exeKikame32.exePgnilpah.exeKipkhdeq.exePnfdcjkg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbmncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Blfdia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iejcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgmha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Okjbpglo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fcfhof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnkdhpjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dceohhja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmchi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbnpqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekhjmiad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kikame32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnfdcjkg.exe

Executes dropped EXE 64 IoCs

Processes:

Ndghmo32.exeNkqpjidj.exeNqmhbpba.exeNggqoj32.exeNnaikd32.exeNbmelbid.exeNdkahnhh.exeOndeac32.exeOboaabga.exeOkhfjh32.exeOqdoboli.exeOcckojkm.exeOkjbpglo.exeOqgkhnjf.exeOcegdjij.exeOjopad32.exeObfhba32.exeOcgdji32.exeOjalgcnd.exeObidhaog.exePcjapi32.exePjdilcla.exePeimil32.exePjffbc32.exePbmncp32.exePcojkhap.exePkfblfab.exePabkdmpi.exePcagphom.exePjkombfj.exePaegjl32.exePcccfh32.exePjmlbbdg.exePbddcoei.exeQecppkdm.exeQgallfcq.exeQnkdhpjn.exeQeemej32.exeQchmagie.exeQnnanphk.exeAegikj32.exeAgffge32.exeAbkjdnoa.exeAejfpjne.exeAcmflf32.exeAldomc32.exeAbngjnmo.exeAcocaf32.exeAjiknpjj.exeAbpcon32.exeAeopki32.exeAlhhhcal.exeAngddopp.exeAaepqjpd.exeAhoimd32.exeAbemjmgg.exeBdfibe32.exeBnlnon32.exeBbgipldd.exeBdhfhe32.exeBlpnib32.exeBbifelba.exeBehbag32.exeBjdkjo32.exe

pid	process
2916	Ndghmo32.exe
2664	Nkqpjidj.exe
756	Nqmhbpba.exe
2808	Nggqoj32.exe
4084	Nnaikd32.exe
1264	Nbmelbid.exe
1160	Ndkahnhh.exe
2912	Ondeac32.exe
2848	Oboaabga.exe
676	Okhfjh32.exe
2940	Oqdoboli.exe
3852	Occkojkm.exe
4204	Okjbpglo.exe
3968	Oqgkhnjf.exe
856	Ocegdjij.exe
4508	Ojopad32.exe
4928	Obfhba32.exe
2668	Ocgdji32.exe
2544	Ojalgcnd.exe
1244	Obidhaog.exe
2044	Pcjapi32.exe
232	Pjdilcla.exe
3256	Peimil32.exe
3564	Pjffbc32.exe
5036	Pbmncp32.exe
3348	Pcojkhap.exe
3240	Pkfblfab.exe
1948	Pabkdmpi.exe
2236	Pcagphom.exe
1884	Pjkombfj.exe
2448	Paegjl32.exe
4148	Pcccfh32.exe
3740	Pjmlbbdg.exe
752	Pbddcoei.exe
1852	Qecppkdm.exe
2724	Qgallfcq.exe
4544	Qnkdhpjn.exe
2372	Qeemej32.exe
4976	Qchmagie.exe
2404	Qnnanphk.exe
3316	Aegikj32.exe
3456	Agffge32.exe
2932	Abkjdnoa.exe
2004	Aejfpjne.exe
4628	Acmflf32.exe
1916	Aldomc32.exe
1544	Abngjnmo.exe
4932	Acocaf32.exe
3552	Ajiknpjj.exe
4964	Abpcon32.exe
2484	Aeopki32.exe
3284	Alhhhcal.exe
4332	Angddopp.exe
1532	Aaepqjpd.exe
3872	Ahoimd32.exe
4760	Abemjmgg.exe
2752	Bdfibe32.exe
3308	Bnlnon32.exe
4484	Bbgipldd.exe
4956	Bdhfhe32.exe
4380	Blpnib32.exe
4640	Bbifelba.exe
1268	Behbag32.exe
5020	Bjdkjo32.exe

Drops file in System32 directory 64 IoCs

Processes:

Aldomc32.exeDceohhja.exeIfefimom.exeJpgmha32.exeGblngpbd.exeLdjhpl32.exeNgdmod32.exeAgoabn32.exeBebblb32.exeEkemhj32.exeJioaqfcc.exeNdghmo32.exeOcegdjij.exeOdmgcgbi.exeNcfdie32.exeAgffge32.exeBaocghgi.exeCefoce32.exeIcplcpgo.exeKfmepi32.exeCaebma32.exeCfbkeh32.exePjdilcla.exeCbjoljdo.exeFcfhof32.exeGmjlcj32.exeLboeaifi.exeEadopc32.exeHofdacke.exeJidklf32.exeCjbpaf32.exeFkmchi32.exeMpablkhc.exeDeagdn32.exeKikame32.exeLiddbc32.exeNepgjaeg.exe75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exeBjghpn32.exeBbnpqk32.exeAgeolo32.exeQchmagie.exeEamhodmf.exeKlljnp32.exeKdcbom32.exeOcgdji32.exeAeopki32.exeMcpnhfhf.exeBjmnoi32.exeBffkij32.exeBbgipldd.exeBlpnib32.exeCeaehfjj.exeIejcji32.exeOdkjng32.exeGkoiefmj.exeMigjoaaf.exeMlhbal32.exeNeeqea32.exePcjapi32.exeAcmflf32.exeIiaephpc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Ifbbmf32.dll	Aldomc32.exe
File created	C:\Windows\SysWOW64\Dlncan32.exe	Dceohhja.exe
File created	C:\Windows\SysWOW64\Njohbh32.dll	Ifefimom.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Chdfonda.dll	Gblngpbd.exe
File created	C:\Windows\SysWOW64\Lbmhlihl.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Ocljjj32.dll	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Jgmbieme.dll	Ekemhj32.exe
File opened for modification	C:\Windows\SysWOW64\Jmknaell.exe	Jioaqfcc.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Ojopad32.exe	Ocegdjij.exe
File created	C:\Windows\SysWOW64\Ogkcpbam.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Lcfcfldc.dll	Agffge32.exe
File created	C:\Windows\SysWOW64\Dpqdba32.dll	Baocghgi.exe
File created	C:\Windows\SysWOW64\Cbjoljdo.exe	Cefoce32.exe
File opened for modification	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Fbnkjc32.dll	Kfmepi32.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Peimil32.exe	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Gdqfah32.dll	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Heomgj32.dll	Fcfhof32.exe
File created	C:\Windows\SysWOW64\Jhondp32.dll	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Lboeaifi.exe
File created	C:\Windows\SysWOW64\Fgfkkboc.dll	Eadopc32.exe
File opened for modification	C:\Windows\SysWOW64\Hbeqmoji.exe	Hofdacke.exe
File created	C:\Windows\SysWOW64\Jlbgha32.exe	Jidklf32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Fcckif32.exe	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mpablkhc.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kikame32.exe
File opened for modification	C:\Windows\SysWOW64\Llcpoo32.exe	Liddbc32.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe
File opened for modification	C:\Windows\SysWOW64\Bbnpqk32.exe	Bjghpn32.exe
File created	C:\Windows\SysWOW64\Eicplccq.dll	Bbnpqk32.exe
File opened for modification	C:\Windows\SysWOW64\Lbmhlihl.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Qnnanphk.exe	Qchmagie.exe
File created	C:\Windows\SysWOW64\Fhglla32.dll	Eamhodmf.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Kfankifm.exe	Kdcbom32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Ojalgcnd.exe	Ocgdji32.exe
File created	C:\Windows\SysWOW64\Alhhhcal.exe	Aeopki32.exe
File created	C:\Windows\SysWOW64\Bchdhnom.dll	Mcpnhfhf.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bdhfhe32.exe	Bbgipldd.exe
File created	C:\Windows\SysWOW64\Bbifelba.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Cknnpm32.exe	Ceaehfjj.exe
File created	C:\Windows\SysWOW64\Hjakkfbf.dll	Iejcji32.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Pnfeqknj.dll	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Iemkcl32.dll	Pcjapi32.exe
File created	C:\Windows\SysWOW64\Aldomc32.exe	Acmflf32.exe
File created	C:\Windows\SysWOW64\Ikpaldog.exe	Iiaephpc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

10940 10852 WerFault.exe Dmllipeg.exe

pid	pid_target	process	target process
10940	10852	WerFault.exe	Dmllipeg.exe

Modifies registry class 64 IoCs

Processes:

Gcddpdpo.exeGokdeeec.exeIiaephpc.exeIbqpimpl.exeNcfdie32.exePclgkb32.exeCahfmgoo.exeFkopnh32.exeOdmgcgbi.exeBfhhoi32.exeHoiafcic.exeLenamdem.exeQnhahj32.exeDejacond.exeDfknkg32.exeLffhfh32.exePgioqq32.exeKfmepi32.exeKibgmdcn.exeCaebma32.exeChagok32.exeDelnin32.exeIbnccmbo.exeGododflk.exeJidklf32.exePgnilpah.exeCefoce32.exeDaaicfgd.exeKipkhdeq.exeMcpnhfhf.exeMenjdbgj.exeAejfpjne.exeLmbmibhb.exeAdgbpc32.exeIckchq32.exeKiidgeki.exeOcegdjij.exeGlebhjlg.exeKikame32.exeAjckij32.exeBfkedibe.exeEofbch32.exeJcioiood.exeFkmchi32.exeImoneg32.exeKdcbom32.exeNpcoakfp.exeNilcjp32.exeQffbbldm.exeOndeac32.exeDafbne32.exeFlceckoj.exeJmknaell.exeMgddhf32.exeNpmagine.exePjkombfj.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Gcddpdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngndc32.dll"	Gokdeeec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfldb32.dll"	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghjpm32.dll"	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijhkffjm.dll"	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdmaef32.dll"	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iihqganf.dll"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debheb32.dll"	Aejfpjne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jidklf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kiidgeki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eofbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijmanlfp.dll"	Fkmchi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ondeac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dafbne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oalnaifk.dll"	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npmagine.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjkombfj.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exeNdghmo32.exeNkqpjidj.exeNqmhbpba.exeNggqoj32.exeNnaikd32.exeNbmelbid.exeNdkahnhh.exeOndeac32.exeOboaabga.exeOkhfjh32.exeOqdoboli.exeOcckojkm.exeOkjbpglo.exeOqgkhnjf.exeOcegdjij.exeOjopad32.exeObfhba32.exeOcgdji32.exeOjalgcnd.exeObidhaog.exePcjapi32.exe

description	pid	process	target process
PID 804 wrote to memory of 2916	804	75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe	Ndghmo32.exe
PID 804 wrote to memory of 2916	804	75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe	Ndghmo32.exe
PID 804 wrote to memory of 2916	804	75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe	Ndghmo32.exe
PID 2916 wrote to memory of 2664	2916	Ndghmo32.exe	Nkqpjidj.exe
PID 2916 wrote to memory of 2664	2916	Ndghmo32.exe	Nkqpjidj.exe
PID 2916 wrote to memory of 2664	2916	Ndghmo32.exe	Nkqpjidj.exe
PID 2664 wrote to memory of 756	2664	Nkqpjidj.exe	Nqmhbpba.exe
PID 2664 wrote to memory of 756	2664	Nkqpjidj.exe	Nqmhbpba.exe
PID 2664 wrote to memory of 756	2664	Nkqpjidj.exe	Nqmhbpba.exe
PID 756 wrote to memory of 2808	756	Nqmhbpba.exe	Nggqoj32.exe
PID 756 wrote to memory of 2808	756	Nqmhbpba.exe	Nggqoj32.exe
PID 756 wrote to memory of 2808	756	Nqmhbpba.exe	Nggqoj32.exe
PID 2808 wrote to memory of 4084	2808	Nggqoj32.exe	Nnaikd32.exe
PID 2808 wrote to memory of 4084	2808	Nggqoj32.exe	Nnaikd32.exe
PID 2808 wrote to memory of 4084	2808	Nggqoj32.exe	Nnaikd32.exe
PID 4084 wrote to memory of 1264	4084	Nnaikd32.exe	Nbmelbid.exe
PID 4084 wrote to memory of 1264	4084	Nnaikd32.exe	Nbmelbid.exe
PID 4084 wrote to memory of 1264	4084	Nnaikd32.exe	Nbmelbid.exe
PID 1264 wrote to memory of 1160	1264	Nbmelbid.exe	Ndkahnhh.exe
PID 1264 wrote to memory of 1160	1264	Nbmelbid.exe	Ndkahnhh.exe
PID 1264 wrote to memory of 1160	1264	Nbmelbid.exe	Ndkahnhh.exe
PID 1160 wrote to memory of 2912	1160	Ndkahnhh.exe	Ondeac32.exe
PID 1160 wrote to memory of 2912	1160	Ndkahnhh.exe	Ondeac32.exe
PID 1160 wrote to memory of 2912	1160	Ndkahnhh.exe	Ondeac32.exe
PID 2912 wrote to memory of 2848	2912	Ondeac32.exe	Oboaabga.exe
PID 2912 wrote to memory of 2848	2912	Ondeac32.exe	Oboaabga.exe
PID 2912 wrote to memory of 2848	2912	Ondeac32.exe	Oboaabga.exe
PID 2848 wrote to memory of 676	2848	Oboaabga.exe	Okhfjh32.exe
PID 2848 wrote to memory of 676	2848	Oboaabga.exe	Okhfjh32.exe
PID 2848 wrote to memory of 676	2848	Oboaabga.exe	Okhfjh32.exe
PID 676 wrote to memory of 2940	676	Okhfjh32.exe	Oqdoboli.exe
PID 676 wrote to memory of 2940	676	Okhfjh32.exe	Oqdoboli.exe
PID 676 wrote to memory of 2940	676	Okhfjh32.exe	Oqdoboli.exe
PID 2940 wrote to memory of 3852	2940	Oqdoboli.exe	Occkojkm.exe
PID 2940 wrote to memory of 3852	2940	Oqdoboli.exe	Occkojkm.exe
PID 2940 wrote to memory of 3852	2940	Oqdoboli.exe	Occkojkm.exe
PID 3852 wrote to memory of 4204	3852	Occkojkm.exe	Okjbpglo.exe
PID 3852 wrote to memory of 4204	3852	Occkojkm.exe	Okjbpglo.exe
PID 3852 wrote to memory of 4204	3852	Occkojkm.exe	Okjbpglo.exe
PID 4204 wrote to memory of 3968	4204	Okjbpglo.exe	Oqgkhnjf.exe
PID 4204 wrote to memory of 3968	4204	Okjbpglo.exe	Oqgkhnjf.exe
PID 4204 wrote to memory of 3968	4204	Okjbpglo.exe	Oqgkhnjf.exe
PID 3968 wrote to memory of 856	3968	Oqgkhnjf.exe	Ocegdjij.exe
PID 3968 wrote to memory of 856	3968	Oqgkhnjf.exe	Ocegdjij.exe
PID 3968 wrote to memory of 856	3968	Oqgkhnjf.exe	Ocegdjij.exe
PID 856 wrote to memory of 4508	856	Ocegdjij.exe	Ojopad32.exe
PID 856 wrote to memory of 4508	856	Ocegdjij.exe	Ojopad32.exe
PID 856 wrote to memory of 4508	856	Ocegdjij.exe	Ojopad32.exe
PID 4508 wrote to memory of 4928	4508	Ojopad32.exe	Obfhba32.exe
PID 4508 wrote to memory of 4928	4508	Ojopad32.exe	Obfhba32.exe
PID 4508 wrote to memory of 4928	4508	Ojopad32.exe	Obfhba32.exe
PID 4928 wrote to memory of 2668	4928	Obfhba32.exe	Ocgdji32.exe
PID 4928 wrote to memory of 2668	4928	Obfhba32.exe	Ocgdji32.exe
PID 4928 wrote to memory of 2668	4928	Obfhba32.exe	Ocgdji32.exe
PID 2668 wrote to memory of 2544	2668	Ocgdji32.exe	Ojalgcnd.exe
PID 2668 wrote to memory of 2544	2668	Ocgdji32.exe	Ojalgcnd.exe
PID 2668 wrote to memory of 2544	2668	Ocgdji32.exe	Ojalgcnd.exe
PID 2544 wrote to memory of 1244	2544	Ojalgcnd.exe	Obidhaog.exe
PID 2544 wrote to memory of 1244	2544	Ojalgcnd.exe	Obidhaog.exe
PID 2544 wrote to memory of 1244	2544	Ojalgcnd.exe	Obidhaog.exe
PID 1244 wrote to memory of 2044	1244	Obidhaog.exe	Pcjapi32.exe
PID 1244 wrote to memory of 2044	1244	Obidhaog.exe	Pcjapi32.exe
PID 1244 wrote to memory of 2044	1244	Obidhaog.exe	Pcjapi32.exe
PID 2044 wrote to memory of 232	2044	Pcjapi32.exe	Pjdilcla.exe

C:\Users\Admin\AppData\Local\Temp\75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe
"C:\Users\Admin\AppData\Local\Temp\75b5351496d3c84cb7136f5a018872f264397488cac97acfac7191cba6e2f3d8.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\Ndghmo32.exe
  C:\Windows\system32\Ndghmo32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\Nkqpjidj.exe
    C:\Windows\system32\Nkqpjidj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\Nqmhbpba.exe
      C:\Windows\system32\Nqmhbpba.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:232
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        24⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        25⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        27⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        28⤵
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        29⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        30⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1884
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        32⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        33⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        34⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        35⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        36⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        37⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        39⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        41⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        44⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1916
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        48⤵
        Executes dropped EXE
        
        PID:1544
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        49⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        50⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        51⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        53⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        54⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        55⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        56⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        57⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        58⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        59⤵
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        60⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        62⤵
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4380
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        64⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        65⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        66⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        67⤵
        Drops file in System32 directory
        
        PID:536
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        68⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4308
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:436
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        71⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        72⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        73⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        74⤵
        Drops file in System32 directory
        
        PID:4636
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        75⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        76⤵
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        77⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        78⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        81⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:316
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        83⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        84⤵
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        85⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        86⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        87⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        88⤵
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2096
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        91⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        92⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        93⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        94⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        95⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        96⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        97⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        98⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        99⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        102⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        103⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        105⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        106⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        107⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        108⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        109⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        110⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        111⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        113⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        114⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        117⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        118⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        119⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        120⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        121⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        122⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        123⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        124⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        125⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        126⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        128⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        129⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        130⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        132⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        134⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        136⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        137⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        138⤵
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        139⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        140⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        141⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        142⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        143⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        144⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        146⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        147⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        148⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        149⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        150⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        151⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        152⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        153⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        154⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        155⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        156⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        157⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        158⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        160⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        161⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        162⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        163⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        164⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        165⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        166⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        169⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        170⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        171⤵
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        172⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        173⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        174⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        175⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        176⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        177⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        178⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        179⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        180⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        181⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        183⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        184⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        186⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        187⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        188⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        189⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        190⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        191⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        193⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        194⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        195⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        196⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        198⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        199⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        202⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        203⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        204⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        205⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        207⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        208⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        210⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        211⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        212⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        213⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        219⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        220⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        221⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        222⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        223⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        224⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        225⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        226⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        228⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        229⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        230⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        231⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        232⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        233⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        234⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        235⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        236⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        237⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        238⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        239⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7376
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        241⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        242⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        243⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        244⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        245⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        246⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        247⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        248⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        249⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        250⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        251⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        252⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        253⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        254⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        255⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        256⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        257⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        258⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        259⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        260⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        261⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        262⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8284
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        264⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        266⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        267⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        268⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        269⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        271⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        272⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        274⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        278⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        280⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        281⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        282⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        283⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        284⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        285⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        286⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        287⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        288⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        289⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        292⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        293⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        295⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        296⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        297⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        298⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        299⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        300⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        302⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        303⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9072
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        305⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        307⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        308⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9116
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        311⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8576
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        313⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        315⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        316⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        317⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        318⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        319⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        321⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9348
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9384
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        324⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        325⤵
        Modifies registry class
        
        PID:9468
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        326⤵
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        327⤵
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        328⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        329⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        330⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        331⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        332⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9808
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9852
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        335⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        336⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        337⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        338⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        340⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        341⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        342⤵
        Drops file in System32 directory
        
        PID:10196
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        343⤵
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        344⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9376
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        347⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        348⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        349⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9720
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        353⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        354⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        355⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        356⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        357⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        358⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        359⤵
        Modifies registry class
        
        PID:9236
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        360⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        361⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        362⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        363⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9804
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        365⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        366⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        367⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10100
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        368⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        369⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        370⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        371⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        372⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        373⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        374⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        375⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        376⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        378⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        379⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        380⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10020
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        382⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        383⤵
        Modifies registry class
        
        PID:10268
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        384⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        385⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        386⤵
        Modifies registry class
        
        PID:10392
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        387⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        388⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        389⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        390⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        391⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        392⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10660
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10700
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        395⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        396⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10816
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        398⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 408
        399⤵
        Program crash
        
        PID:10940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10852 -ip 10852
1⤵
PID:10908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaiapmca.dll

Filesize
7KB

MD5
9b0946a30fb9f757febc573fe1ccdf55

SHA1
a55a43e3d298b7f000d3f4488603805f61453f20

SHA256
a06b4ee1bb05df58409cd0acef0bfd5b8d11d0033423b69359e744ad9c159d95

SHA512
23344a7ef7a4e4796c5b0bdfd3532e823addae29f56fe61a66df23eee479e947b6a2c48432b8b25a8e45df8ce39951cf239a12940b5391b5d5217bd1e6cccf2f

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
111KB

MD5
b0907c5e28dbbad45616f685b4ea3cc8

SHA1
0646f02c264f3d4bb51daa2b623bad986e9f8755

SHA256
b62cbca24528019f520e4343c1512043b968b6f68398f581bc57f9ddc7ee99aa

SHA512
0b26c4af456c3373218fd5adcf611f79d07d08e2aecb727e91519406c962814e4a14ea4ad8be841f1b835574200b9d94f645c18d7e271597ef20b4311654c2a8

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
111KB

MD5
40bc0eadd3bf304596ca41a3bdc40c99

SHA1
f8017c21648b8494336733b43e66c6467c967225

SHA256
1027d6d30ab1afef8dc23ea1b7aa79ed73c1d16d4e9186b197973aa71f09e1d3

SHA512
172852cd0196edc27887cce9b0f2ca40adb391dfaaa2054e17537394d8b2596a09ae14b772ce9a1215f8fc21608f8793c779653204c43a30435e0f7ddf793371

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
111KB

MD5
db626f766ab8c69a44c13fe6ee047421

SHA1
4fbaaf73baab98ee6ee96ad88cc4f89f74ec3d9b

SHA256
5615c255a281453e8db169ea72ee89ee5ddbc283f2890fc77206effbefc3681a

SHA512
7278f54bfbd050a0f17cc81b7beab12677146579ba8e8c80770b002bf9f38c76e1b33aa8aa601ed51dad1537ecdff5e36568f2ec46c0173737ef068350f0f78a

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
111KB

MD5
6ca13818ea9497ccaa3d002f6202d71a

SHA1
a2b7325f168d19b5e73dee8bcf8f4aff189e4a37

SHA256
c711fc95d6fb10d4ea8f50cd1ee097a439b10c3d37ea01c62d41994f2e5834e8

SHA512
0b6b7f2a82728b0021442fc268d6c49782bc1129f51c2b9674613bf01a6906a14f554f1c0b8fb90c0404fb34b309006fafb6deb7ee26d962f4e155ed536492b5

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
111KB

MD5
d52137ebe6444203aac2075ec54f521e

SHA1
87218d406b747d0f916acf4b80a50dbfb4dce361

SHA256
0cd1fe06a4331b2739374d4ca88b78f88372e586605bb0300edf426f623fe5ea

SHA512
873087e7dcd0b0b6d8f6f8cc1dd27474e9cb451861a3643aad5053c4d08a7b3b01a16f16ddfd368438b91cd1510a4158980fe24614cd19e2ba1610d270ce8c6f

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
111KB

MD5
29285a6731d820f693760aac8f40937c

SHA1
dfd9ede81a7c343033e4c22de1bad4ff26ec9317

SHA256
e64ab81248e775535391866cac2be6555236b273662c4aed43b831ef0bf7b92e

SHA512
01ed0ef71110534b947ade145d23aa0aa6bd19f133372577a5955a9566e9a15f02eaf27fa3e0845def6fa1a41533b84d90c05acb054f307c0c4b7719b6f337d6

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
111KB

MD5
b4b6e18227930494d13ae705eeee781b

SHA1
82f07ac819afae8025b4607a49ed08e4ad33ad4f

SHA256
c41873a98fac3b2a796a39405369225a917c0e2a7875a2020557b0659bccaad3

SHA512
8064147f6b9a9b43b9bd1b7340c03f06e02d0c67416179c561b54276107c921a7d032dfbd2245bf45362cc755f2a0bd9189168a2b0c2354b3e16f60f6ead7308

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
111KB

MD5
e0cab26c4a1eda3ace87fc98ca77f19f

SHA1
e618e03035052d3fab9166e58a9579cf84c2ac1c

SHA256
0a96bc86d31247fb6bd8a146270d5867e5901ed32aee6709f5a80a582f73f2ed

SHA512
6385ba7709b6bc73e19e7528deab38b921b36313125e460ce2cadf264fa040719f0161efc462492689cad964cc276651afe357855c96e182290537e3283d3d45

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
111KB

MD5
4760e22a11d6b5335fc52b45ae67d55f

SHA1
394d9ef3c9549a484a7eb0c91229f98fc065aa7e

SHA256
3a37188cb1f40bcdc7414e28c7d0a4e662a4f450fead60910d6976ec6fefa8d3

SHA512
db6605a05c8506dceef01edf6b8a3fecb95dc6ece9f57825827022a8bf24a2fa6aca78e4f9c0ffad41528add961be7120dbfe5f89819c785bf9ef520ef1ca21d

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
111KB

MD5
b664c07ac665362c48b42e91670eb605

SHA1
f2d7b4879be019ebd4202d3300bae72460ea0f1b

SHA256
1d1655c2724da69ff0ad13e29dc0dda866be49da5df4c5f09789ec88157407b2

SHA512
4ed088d05cedb1c7e8548da6cec2bb32cc3ff45a3a835cc3160b43b615125b8cfa2239f660b495a381981cb761a45fc00fa66892cbda0f0725042d41629b95b1

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
111KB

MD5
32bca79767d0f536ecb278e13d9e09ea

SHA1
6a3942cf237970051bc844b9403e560d84388207

SHA256
24e8cac16283d9105ec948076baebaefa3ad1d90fe61fd724c42ba0b7a2b2bd9

SHA512
455de3f034d967fc55ba5025150ff7538958155da4256fb6db474b862f947e1840824ed591087a23ddd6bbcddc91f7434122b3223953aca71b4dfc9fcb9f35df

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
111KB

MD5
d1ddc5f63f7bd88205c6edf019e65521

SHA1
267643d22418e8bc45b223d3aab925107f56e3bf

SHA256
03ce5158d78f4258dedc4c67a301691358756cb67fe66cf1874dc61c0ce3a570

SHA512
be80012e2cc83a4ed1512102c9f5216e7599431736d77c32910fe7a5830f6f1e4748464bd6598c287cdd71355613987062e9b72cb036bd0a7e339752a0b9b9d8

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
111KB

MD5
83a2db6b30f84eabcc32cbbd7ef08edb

SHA1
ed75857b2de94588f33d0d33c673189439d1e2ae

SHA256
9218cd9b73366920cf225a062aa0d034cfa349c2949ba95555edae3431685c7b

SHA512
d93eb1fae4a9f3d18d9e3b9e3cd5d799b56e1c59bbd5f80c17268fce0f16360c9cbb9746b09d9f7b9473b705ff34ea0b781eaf22a45decfa7047c66c4e9773cd

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
111KB

MD5
38bed1039038450e1a24a18e7fe7af86

SHA1
23360a21728fcd3a499af1226f26149097b07a93

SHA256
d5e9c8f43e6febfe5349758d191e1ee870c13884b2d28aa99be80e752e693309

SHA512
4295cea71d035a6dc36a5d76bf963d2e4a75cc03c548de57073978a8d4c68e8f9c528498b1ba22428150c3c8e617bd442022c2f5eba3a7a1ff3cebe6ad5e8e58

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
111KB

MD5
140d4bd32477e79ace0bd1c4c17b2427

SHA1
101e53e25ae9fa5c2a839f407cd6bb480992cad9

SHA256
94a3377eaf8cf8d979f4aa4f6531de7350f23fc1d971029be7ad48cea30b2df2

SHA512
6040937f8c70933539c93273952a55def5fff324ffae740a37f398887eb81554e29892a90419ae7856da28f194da9c57065052580165df57b6095183ce838834

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
111KB

MD5
a51403e65060355d1eee036ab5b78496

SHA1
6b43e7914745dcba292c955e87873e24dfa46945

SHA256
cc023dee4a9f8a0fb953941c53bd7b73aea380c4d3dbb5bffe3e0b3d91fba3f6

SHA512
966e062ad6e8e4d22c2af0e3c69b095cef6703403510bdd52c38e64296b0633ff452ae152b654165c376e6b89cc19868f93e963a12182ada43e215783b5b5773

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
111KB

MD5
3ac14bc64d9abbe424f60a84315e2807

SHA1
96e5f4b5e4920a60149ea0cbae9bf3866a555385

SHA256
2582e5f32c7921b297bdfd784446faeac5876bef52d75f42918032c0c7c0089b

SHA512
3604ab48d36fd36b4577191e4b4d536e012094a31786673a08f1fab045381acec1b7ecf49620b5f912dff9b54a4a49b7ab8d5f457316383344fc9059e715a45a

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
111KB

MD5
05512ed74ce48fddbb9b71413e5f10ef

SHA1
4020ce3824ddc717b704a09dda33ff344d4db70a

SHA256
096e7dc1662922a88bb3d71c5597861e3e53bc09906542802a7cfde03443e5e4

SHA512
14509ee1a5a0096caccc58f55b8204e0cf024b01ae8831d2b60d4b933ab0be7fc16fde8ba3c35567b93993ef367a007f2e11d62ba2a5ed02decb2d908d26b1a5

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
111KB

MD5
e6eeff8681aa88c36a2a3ae2ac97b6d9

SHA1
def3d018e3fa167c780b2bd431cf8704b8e8bc85

SHA256
19e82a63f76e907607a9a25478a9184c7889b11a95c9e9db6917ba2e7be4ab86

SHA512
5831afc25373d8bc295883821cee74d39120d27bd1a1f66891fb36820054dd9e95c6d9399cb29058f403832f2185d1aabfe3278a12e0801dd63bc5b790459e9a

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
111KB

MD5
ea2578acbc22d42c412a45ae5e901216

SHA1
306365bc2e2d401876a5a827112e58f6c7236b93

SHA256
5cff11870a20294c521997f7c7dc3d654df106dce6e76cf18fa1b57766ef5dd4

SHA512
fda053ff0262d76b712f6318db1fc7129451f3b5bc6c5b9254ce319a2226eba72d6ed09c6643f978b37f60c73de8ba997cefe2f6e56d5a1eae73825c9183a448

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
111KB

MD5
eeb9c87d2a0dd976233adf0803923990

SHA1
b24f192b4013b24f9c683de9205c0aedf3ac1621

SHA256
ab761701a9c5ddac5208aeca94ca0f5c4c91d129f9c10198be55d63cdf351624

SHA512
f1b5a213e06501675141cfa36f3087fe39d83d469498e9abcab5c507fa4c3ce5dc06475cd2a8b8bc1ea111f257ee92bf233a45a4d127548f2a2f0654f67941dc

Download Submit
C:\Windows\SysWOW64\Ndkahnhh.exe

Filesize
111KB

MD5
d36e353bc37c8e339ad15178331c59fb

SHA1
688ecbfee645dc54a01ac650d428cd3e1ef0a855

SHA256
c2949afcfe4e555c251f6b1665b3fd087e481661daf5a0297ed3b241e21c9fd6

SHA512
68c1ce3b63158f3200bb08607c2c8b8f77d28ffd21857a023f55dc18a68c863ccf7458069b521a0c2e56b93fd7a555d9a3c6386ca9abf31fabec020ee645f5b1

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
64KB

MD5
fae3b6a094d10327865a4ec0eb211572

SHA1
c82936568b336edd61da0a7de5309e85084162a2

SHA256
0a109fc0ce355fe46a96ea661eabf48473418e569b2073c6a6d3c69f25458217

SHA512
fed089282b41b67c091f6a7a5975e91c305e6cd623204cf22e485656e83a955f13f720de8819431de2991d948b3d5d941ac9f9a68fe76183e176601c7055d069

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
111KB

MD5
bd64e71b187bb756fd3ff39f1a8ebd20

SHA1
c683712699a8694316a45b9350df1cc28ffb2183

SHA256
9db2127f6b2d5cbe44547fc7bcd56615ea087a9db7c3013158c98ae08320db0c

SHA512
fe6f85d7680dfdaaf60ebbaff04853de80fdc4dc3e66fad9e4f93fd49d99ea7a703df7615ff716305ebe26730155d2fd1cc716bc40c3c7f6000b485f79800187

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
111KB

MD5
b294e6d068c463f28a8b2c654f350fee

SHA1
ec0a17a11f794bc3780cd5513e95e0d5fbdd7487

SHA256
027a2a0b1074c5d46de31847f1a3038e7d419e0730aeeb83096f51702115ba72

SHA512
9bdb927de6b828ffc67764c94473264ce26537c3a12426ba151d1c7c9e038cdcf084e79b1b97a5cb04bc11927dae9ded87942994fd4f13b2d92f80619628127e

Download Submit
C:\Windows\SysWOW64\Nnaikd32.exe

Filesize
111KB

MD5
002002aba735039aa38f090bc48c52ef

SHA1
5b4aca00d3abf5c0d6840ac120e885ca50b91f86

SHA256
86f21cddf2d6638fbdb2f8260779d808b15a354d32c98edc3aa8eb3cfe41cd3d

SHA512
51ae5d29b88559b28c98f6edef876628b8e376e836e82f43f4fe8d451297e9082f29775a673608285abcabfb44a10cfc4b734f94db6c016574c6d852b46da184

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
111KB

MD5
3c439fe01ff3f5910b71be673f49bd1d

SHA1
ab23513369be5165cdd00f3fe2ad70325b9bdd30

SHA256
89a3016af731f99f1ba0f87aed9f85c8d8b712d408a7defa21567fb9c1fb48c2

SHA512
ef67774c65d3608e240b2eddfc07a1d26e8a8852256d4405223daa7ea7d7f01aaec4e2a82249921d125f540efcdeb50efd3da1d0ac430c14de24874f61c8ac9d

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
111KB

MD5
bd584596b2e0a94909000028d0117315

SHA1
460992023e24c19fe6c037e737d88fc00ce70d04

SHA256
4a3e79526629ea69302155853cb4f97927ae8bafd64d3e42e1e3564512bc594d

SHA512
19a569c5530e706983dadd56c131888e9b9a5f269b888ad994217809ba429b89d2b6f85fc644c14657cff7f4505ed5c510733c6182cf2bcc7d56efd532e062e9

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
111KB

MD5
394edad0f5a6d8da6c71a80cb1845d4c

SHA1
231bb71c766546517e7722f934769277fb92ec86

SHA256
72764e276d10ceb1e65edf1c5eda4bd20ebf0415353981df7fb2ef6cc080d4f0

SHA512
c3c8040201b194be3657594f1135ba8fb21064baf9f89c62c282d44b4edbdd7ac97aca76dcd400be4c0f365dc791caa84eef3ca82877af0597b479477d210487

Download Submit
C:\Windows\SysWOW64\Obidhaog.exe

Filesize
111KB

MD5
604f43aa910f285ec5eba350fa9688bc

SHA1
6c0ff9f5872dc26b9a979da2a1f7485bdf53c0fb

SHA256
caab15b1ba075d303f284d2e5b73d73ba1f80759fd1d81a247f13ccd2541d30a

SHA512
fc0864872da139c21c55f1903195a43e5c8f002a5a18a841e4b665f148f8f9f777e79fe9c36d4a19db12b6f98077294efbe8727c2f3c98a0a7597f4b8f1b33e1

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
111KB

MD5
aad6354014e9c7abb668317e60e24939

SHA1
646327f5c828d6494c32f531114180f778411a3f

SHA256
49b1bf5e0739ece25fc07cef09adb2f2cb1391300494afd54e928d3f47bf8df3

SHA512
595ac5f5c07c3d03360d4ed5ac65e02687a9fd5535c5fa46d4b103d9e5de615d11290ba4e70615a620ea628c7e29a7bff448719f3d9f76169dea334da694fccb

Download Submit
C:\Windows\SysWOW64\Occkojkm.exe

Filesize
111KB

MD5
855ede8a67adebc8e3dc03495cbb54a8

SHA1
28b43d0fb44127e59159f4ce666944624331d51b

SHA256
221014dde662ded598d6bdd4ead56718b22fd07be48620e5b9993412e0e4a287

SHA512
9250168058c5d037e40d2b0c19336112f0a3e78c50574fdd9aacbdafb50776f011d458bc79932c709e4ffa4bb332ba14a2b0e938f625b15e3f24569593292f4a

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
111KB

MD5
ee5cfdc5012e8b34aa86ac2035186917

SHA1
450ac30998950c4753a28b3f9aba64beb8bdd850

SHA256
b48051db924ea73419cf060fb54a614f98728a217d1a1928f4096521d8f3959a

SHA512
41a8157d5ce6b27992c55dd7aa7effac5fd9651769895295cdf3b5aa00f57b77773e3a14a71f803073a43a45ff3ebb5610e18a83aa1450f43864917a21855ac9

Download Submit
C:\Windows\SysWOW64\Ocgdji32.exe

Filesize
111KB

MD5
d9e26077109c801c47b3d87cfb568d18

SHA1
cf7e6abe7349ab0e0d1499c9254c2d6fc7bbca31

SHA256
d2285df1ed23cf2f71f0eb824e1709452510bb82a2c0263032b4606630d7a5f9

SHA512
afe86cb372f588956c6ff5132e9f3220a0ac0af125e67f1ad608da00957ea0b1875384448268733e74d067f27b116a5aa869ef282961c5956216cd11972f96cc

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
111KB

MD5
87fff88dae658e0282e2de467b5013bb

SHA1
cb7478f9ebc2810ad5ec7dd7dd94300706f9e077

SHA256
0019052183ecf4e4160be8d7bbb5a35d95bbb56da77d6ea3daedda7011825dca

SHA512
672a487134472f20befc1cb1e3cd1f64250c18564ec379ee0d63280cabffeaee838829b76c922b88e6b2ea9f63fac3ef923ee82eaca784a73c184d816fa6d2ca

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
111KB

MD5
98cdb57497ddecbc50b69870aed93275

SHA1
001550058485dfa9744aeb6f8a122353cfa7bfae

SHA256
7d9d184dc4a869c7c603099740d5313f8aacc16063760368344d1f39175627bd

SHA512
802d7b6c3cf80e360611ec428afa26f3546248d5d92c79d06493734adadf1761cfa89b1942c347fd56048d094ae1101d36f1ceccc67852d67bcf3c3c47fe75c0

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
111KB

MD5
a4cb60a94578734b3a143994ed913b33

SHA1
6e6d9b02e894915c981e9dbd3268fa11078bfc6d

SHA256
4ff1e31fd7457c33da9b4ad6d1c4b0d0f251b4f36b88f768a2e16c71eb8d326a

SHA512
9cff42f3b111b709fbca89238b3aad7763439b24e7e36c2cde0e0122b3dba03794a565811b171abd51e9dd1213f6cd6b46415f44d083264d6d00075a475dc32e

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
111KB

MD5
e615a9424e6d40c3a17fccb7f875cd6c

SHA1
f213663ac73477ab3b262978c162c0599e82b135

SHA256
90ab5554a703cb5055bd5226849addc597d36f4722d0c8b66b1547adb6ca5029

SHA512
ead4d4c6f19741ae9c73c018ac67bbbba38e5998e72068942b69c5eda5b59c0258bd81a66fb281c688a9568a6718b455de9e506542c6f932f8bfd4860bdfcb2c

Download Submit
C:\Windows\SysWOW64\Ondeac32.exe

Filesize
111KB

MD5
435ae7aeba8c483f0610088f07135f55

SHA1
6888e55701c699c140e753f14882b1f5a7ae491d

SHA256
d27a5ed958dbd6a68b104d551927501745e20f49496a9564ce4c6b9c32b597ae

SHA512
f5925474e97e9d55514c1530b1cc6b82bb7c14c5e3ee55f6f61abcc942dec546d2193d1968467f88bf78abbc365427cad84f35d4de3aa6ae487a43f831307711

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
111KB

MD5
cc5d04f1d873110450f9de02606673c9

SHA1
1ae9d8be24ae393ad24d767ae8390c41cb8f9b94

SHA256
563184c12287d36fdbec63bc47d67b3a705eccd9213d27b5675da923eda18212

SHA512
f6eff5b44646b34e408baa86d5eb4d830af6efab8c9625bf0338911d4e166811e7548ea0e0f3491d1dc66f5e9ce979cea94dff29471c23e02b0263462b0301d8

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
111KB

MD5
22dda3da389eb2f5276aef8ebcda37a0

SHA1
6a0852aeece02cadb0bfaee0e3df901b48b2b874

SHA256
a6839b57176c03da5d99393693f81c05aa87c15efac335502254782e02b0d4c6

SHA512
115657f18c3c26a2d6a6b8584d269ebef06aeeedda4c5a90ef567f9cf209c5b8fed1e8927ed656c70289ff1efb18419a5daa14c0b8f42d7f67ad24a993e29dca

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
111KB

MD5
9e27e8dbfcd6c9a49532936b4f8a92b9

SHA1
2ca2685270b7f05cbbb357af95ade12ac51ca677

SHA256
8f417a426d2c5c1e81f7465721618add52a9f7dca734d55c7182dd826ad407be

SHA512
ebfb06d733f6a5eada415d16e551c052ea71979677db5064f0b440e6d46fbb924ab930690ac07ed44d824df09ed0d2128aa09029cc8b93df5323fad90d9e4cd1

Download Submit
C:\Windows\SysWOW64\Paegjl32.exe

Filesize
111KB

MD5
83e25ae42a528980bb719625d3c841e3

SHA1
77a6e5c6de4f8139940a5aa1d42c4439c37cb890

SHA256
43c50df6301d167db2ba2acf55dc62f1b30287e3e9ef411faa6bb5b653efd48e

SHA512
0f8ee70ae9a3acf084c524f1d9f2461340bef3ac8a39c7be0157b23a9e4e466befd69e41a341d4e7b8f7a31b3825196d9f01c6a1afba9994cfa8430f1779dcab

Download Submit
C:\Windows\SysWOW64\Pbmncp32.exe

Filesize
111KB

MD5
a20a31a020981f86fa9927b37605175b

SHA1
09a73d8fb7e90795ee32c4f132dca33d02b79e05

SHA256
441a91cf337b1eb7e56f7483421227afcd6467268ed8f52f6b0abbb342f33ebd

SHA512
1bea52e7903a7e9ad339ee9b81d5ec9545239e7b35c7a6b515064b9f6abf264b867dc3c17ab0a11dd30f58a8777e7e07a183ef2fba21eb352e8c7b8a64b0853e

Download Submit
C:\Windows\SysWOW64\Pcagphom.exe

Filesize
111KB

MD5
a6c1b74f69f8f6c4dfc77ada9467f57c

SHA1
3b6fcf704ba95cfc775061e59bb2ea08f1f5960d

SHA256
e040c19a3b8ba71f6c2f3a426c77bd913c31f85425aaa8c7e97cc3458b6ccb4a

SHA512
14b2fc230c567452620dfa6bfc182f15796e22b1161072153f609d473cec152ec1a8bc2fb9b8a1643ebffa8ddec4ca76c5b37993c16111b9f33e5ae2f710c867

Download Submit
C:\Windows\SysWOW64\Pcccfh32.exe

Filesize
111KB

MD5
f2d01a61e14cad8b199c8189f1c43a2b

SHA1
87aab118017d9b9055c0e4233d85e632e3cc2aff

SHA256
02cde4d4184d7e52eba1df4e8dd6203c0d8dd8778bc05afd1befcc43c3d7a519

SHA512
4b3704d378ca3fe4ae717b3c80afc9781c417df0cfbfda5d3e0db04a88181289c03958ba27d991cc67c616b57dc651342dd20ae0d883048084de1caef03bcfa6

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
111KB

MD5
38933054bcde5dcc9b6eec74ec424281

SHA1
0496bf785b512c8e34cec5c7ea380fb3dac4394a

SHA256
ee5243bc0ab2128d7eafd9278e0dbff949a823aec3dd25f196c16f9e996efbd2

SHA512
42a41e9968f2016b8d18a6b8fbce69fe297bf62396479fe32711426acf509f9a933825b278e530388f8e8c3f87129d0f66333cb162c3e06877cf3d26407190a4

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
111KB

MD5
430a0ccdcfe16134737dceb7bdc6e34d

SHA1
54a863fccceed1c251142b7082913a71babc4b63

SHA256
3f74e69552efe76b8bfd0f40d818124d10f6e56ad5949377e500fa8effd4caf9

SHA512
59ba313651e5433ec39989405df23addf59895c4463a83ba4c8b77d98e9524f1d084664995a5e8fd2eaee7098e3325deb7d80e961440dc6974e17f600ef9fcfe

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
111KB

MD5
f6dd3b125acc6e823299a8edaa2ada48

SHA1
82088beb05f5c08a4b1757f433623ece6c0096f3

SHA256
d86099e10578ba9c39f1cc1accb19215e2bf822d513afeef62c95e345170b195

SHA512
3655f52dceeb693ad88e4808e250e307cdf43ba518ad70b751bd9a93a11d7a19677258957a4cf1650c922541f2e16a02d5fdffb47a29d876958a95b98e2b3365

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
111KB

MD5
3e2b5079927711ddfa5825fcdf107c59

SHA1
9502c3440b7fdb2485acb16de91e3f7e408393be

SHA256
5f4329a9677ceeed0d2d01c494f93cc7e225066b01b348031a3bac7acdc99d23

SHA512
2d6c46f4c180174c3d56645b73107d62a7ab63c07966a94eb40c7abaafd758449a25376e3a90461ddfabb96730accfbce057557a7368d544ac614dbe656b016b

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
111KB

MD5
297cf2d55720dcc8b534a673860d64b7

SHA1
9c9c5b008f51cf8ee7e2eceecb2e9d3835c226d4

SHA256
9672038d834b7b2ee3e4adb1b13c2d9a81df791282451178b4257c73362267d9

SHA512
6d7a2f556e43873abe4541f0b914c48653dff639648c7dec8f74230fa850a260733a2d89feea185dd101bde2a3d513b87704471b9a47f6aec91417723c834f41

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
111KB

MD5
c7753be99f05239c4941d901ecdde23a

SHA1
845f8dd931a056ffb389679f5320e4cbfbd182f6

SHA256
2c674b314d11623bbcc8a026637f57381a98441ec7a6ace74a1f2878c14ba5e7

SHA512
758caa44a9654204c36c8dda5d489bc5a037133bb23e0a2cc797d21fbeda6b27f1089b59659f20d9dcc3d8e74e9f5f84424c9a90fc4fe63e8aff8fac46f71a54

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
111KB

MD5
e08f86f68b87d2b854584aadca3254e5

SHA1
f7ee2ed84d31df061448111ea83651421a49ba4f

SHA256
41c4bf8220bce2eaef57364f5e19dc71a82c96705aaaa7b57f3941cf1b7966c0

SHA512
7379e954d26024348bda72d88e3c745e1aad77941c084400e2e7abf8e002320523592ddeb6e548ceae8686836989dd5512f238ef67ddca21b483780597817d43

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
111KB

MD5
e56d42ed657b34349c9323bd126835b5

SHA1
cb7247034c3945d46d6ce298132b4177fb3b57d5

SHA256
4a01ca85d2ca20bd8cb54a1e340cf723a45251efcedf10b41a833ad6573aea92

SHA512
f0f89c1878d240e32aadcfa419377348b8878b7673640877819173b21f9721358495d703ac9c7b65836acfeaad455c56b81c11285a58557c4e3fb61775e76375

Download Submit
memory/232-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/316-550-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/436-473-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/536-455-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/676-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/752-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/756-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/756-559-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/804-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/804-539-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/856-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-586-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1244-164-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1264-52-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1268-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1544-350-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1556-560-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1852-279-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1884-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1916-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1948-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2004-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2044-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2064-574-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2092-479-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-594-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2236-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2320-587-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2372-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-515-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2448-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2460-553-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2484-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2544-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2620-567-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-503-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2664-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2664-552-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2668-148-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2752-411-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2808-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2808-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2848-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2912-593-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2912-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2916-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2932-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2940-91-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3240-215-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3256-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3284-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3308-417-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3316-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3348-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3456-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3552-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3564-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3720-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3740-267-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3796-533-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3852-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3872-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3968-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3984-491-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4012-584-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4084-573-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4084-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4148-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4180-462-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4204-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4308-471-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4332-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4356-395-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4380-435-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4484-423-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4508-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4544-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4616-485-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4628-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4636-497-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4640-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4760-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4784-509-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4928-140-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4932-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4948-526-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4956-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-368-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4976-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5020-449-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5036-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5060-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download