ca7ed96d6064da5eba5089bd6d3597d32ece34704ec243ae423a8e72287d89cc

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe
Size

77KB
MD5

3d8cccc3f04df170077a088ae8ecd290
SHA1

7b7f4f61de48d18ef9a3e3eeb8b0f7258357dd62
SHA256

ca7ed96d6064da5eba5089bd6d3597d32ece34704ec243ae423a8e72287d89cc
SHA512

3862328a16ef63ed58ccd97beeb6f142d89c6fa617326bbf347f92fd450497d2862247a0a4b322b510bba3b130d1a4fbdcb8ef69323eea460099285dd880422a
SSDEEP

1536:vEF+lXXky59nqjqDcbdn7SvS2Lt/wfi+TjRC/D:v0+JXjDcbd2Xpwf1TjYD

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddgmbpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doaneiop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pehngkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hicpgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nghekkmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inebjihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mapppn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohkkhhmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eokqkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glipgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgninn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emmdom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjmoag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaajhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deqcbpld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fefedmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kekbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likhem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklbdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkipkani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnindhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kolabf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ickglm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieidhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibcaknbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jinboekc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phigif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbhgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alnfpcag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hipmfjee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe

Executes dropped EXE 64 IoCs

pid	Process
628	Jknfcofa.exe
2260	Jnlbojee.exe
3212	Jqknkedi.exe
2624	Jcikgacl.exe
1368	Knooej32.exe
2812	Kqmkae32.exe
4660	Kclgmq32.exe
4124	Kkconn32.exe
4592	Kdkdgchl.exe
2344	Kgipcogp.exe
1684	Kjhloj32.exe
4932	Kmfhkf32.exe
1052	Kcpahpmd.exe
4116	Kkgiimng.exe
1644	Kmieae32.exe
1832	Kdpmbc32.exe
4644	Kgninn32.exe
2724	Knhakh32.exe
3024	Kdbjhbbd.exe
232	Lklbdm32.exe
1100	Lnjnqh32.exe
4308	Lddgmbpb.exe
1628	Lknojl32.exe
3656	Ljaoeini.exe
432	Lmpkadnm.exe
1484	Ldgccb32.exe
3696	Lkalplel.exe
1992	Lmbhgd32.exe
3852	Lclpdncg.exe
4300	Lmdemd32.exe
4176	Lcnmin32.exe
2244	Lmgabcge.exe
3952	Mcqjon32.exe
2936	Mkhapk32.exe
1812	Mnfnlf32.exe
1528	Mepfiq32.exe
4040	Mccfdmmo.exe
3856	Mjmoag32.exe
2644	Maggnali.exe
4684	Mgaokl32.exe
4064	Mjokgg32.exe
3484	Maiccajf.exe
2180	Mchppmij.exe
2440	Mjahlgpf.exe
3536	Mnmdme32.exe
748	Malpia32.exe
4460	Mcjmel32.exe
4244	Mjdebfnd.exe
4936	Mmbanbmg.exe
2988	Meiioonj.exe
2228	Nghekkmn.exe
2492	Njfagf32.exe
4344	Nmenca32.exe
444	Nelfeo32.exe
4092	Ncofplba.exe
2980	Njinmf32.exe
2348	Nmgjia32.exe
5116	Ncabfkqo.exe
2484	Nhmofj32.exe
2188	Nlhkgi32.exe
5124	Neqopnhb.exe
5164	Nhokljge.exe
5204	Nlkgmh32.exe
5252	Nmlddqem.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cammjakm.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Blnoga32.exe	Bdgged32.exe
File created	C:\Windows\SysWOW64\Ahoemi32.dll	Feoodn32.exe
File opened for modification	C:\Windows\SysWOW64\Monjjgkb.exe	Mnmmboed.exe
File created	C:\Windows\SysWOW64\Ondljl32.exe	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Mnpofk32.dll	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Jidinqpb.exe	Ibjqaf32.exe
File created	C:\Windows\SysWOW64\Mlmadjhb.dll	Pcgdhkem.exe
File created	C:\Windows\SysWOW64\Gmafajfi.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Monjjgkb.exe	Mnmmboed.exe
File created	C:\Windows\SysWOW64\Fkhpfbce.exe	Foapaa32.exe
File opened for modification	C:\Windows\SysWOW64\Pehngkcg.exe	Palbgl32.exe
File opened for modification	C:\Windows\SysWOW64\Fefedmil.exe	Ffceip32.exe
File opened for modification	C:\Windows\SysWOW64\Nbbeml32.exe	Nijqcf32.exe
File opened for modification	C:\Windows\SysWOW64\Ohfami32.exe	Omqmop32.exe
File created	C:\Windows\SysWOW64\Iefgbh32.exe	Igdgglfl.exe
File created	C:\Windows\SysWOW64\Omdppiif.exe	Ojfcdnjc.exe
File created	C:\Windows\SysWOW64\Nghekkmn.exe	Meiioonj.exe
File created	C:\Windows\SysWOW64\Cdecba32.dll	Dheibpje.exe
File created	C:\Windows\SysWOW64\Jilfifme.exe	Jgmjmjnb.exe
File created	C:\Windows\SysWOW64\Dmeoam32.dll	Kgninn32.exe
File created	C:\Windows\SysWOW64\Felbnn32.exe	Efjbcakl.exe
File created	C:\Windows\SysWOW64\Dojpmiij.dll	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Chkolm32.dll	Maiccajf.exe
File created	C:\Windows\SysWOW64\Ohfami32.exe	Omqmop32.exe
File opened for modification	C:\Windows\SysWOW64\Gpelhd32.exe	Glipgf32.exe
File created	C:\Windows\SysWOW64\Ocoick32.dll	Gpolbo32.exe
File created	C:\Windows\SysWOW64\Iophkojl.dll	Kqmkae32.exe
File opened for modification	C:\Windows\SysWOW64\Nmlddqem.exe	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Edommp32.dll	Eiahnnph.exe
File opened for modification	C:\Windows\SysWOW64\Ekaapi32.exe	Emoadlfo.exe
File opened for modification	C:\Windows\SysWOW64\Loofnccf.exe	Lchfib32.exe
File created	C:\Windows\SysWOW64\Bldqfd32.dll	Omcjep32.exe
File created	C:\Windows\SysWOW64\Lbpflbpa.dll	Ogcnmc32.exe
File created	C:\Windows\SysWOW64\Ogjdmbil.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Bknlbhhe.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Oifoah32.dll	Eoepebho.exe
File opened for modification	C:\Windows\SysWOW64\Gngeik32.exe	Geoapenf.exe
File created	C:\Windows\SysWOW64\Pkegpb32.exe	Phfjcf32.exe
File created	C:\Windows\SysWOW64\Ldldehjm.dll	Hipmfjee.exe
File opened for modification	C:\Windows\SysWOW64\Ilcldb32.exe	Impliekg.exe
File created	C:\Windows\SysWOW64\Flbfjl32.dll	Ompfej32.exe
File opened for modification	C:\Windows\SysWOW64\Flkdfh32.exe	Fmhdkknd.exe
File created	C:\Windows\SysWOW64\Klbjgbff.dll	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Ojgjndno.exe	Odmbaj32.exe
File created	C:\Windows\SysWOW64\Lqmmmmph.exe	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Hicpgc32.exe
File created	C:\Windows\SysWOW64\Neqopnhb.exe	Nlhkgi32.exe
File created	C:\Windows\SysWOW64\Fofdocoe.dll	Dkhnjk32.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Ogekbb32.exe
File opened for modification	C:\Windows\SysWOW64\Bacjdbch.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Ihkjno32.exe	Hihibbjo.exe
File created	C:\Windows\SysWOW64\Hiacacpg.exe	Hnlodjpa.exe
File opened for modification	C:\Windows\SysWOW64\Odmbaj32.exe	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Fkpiopih.dll	Qachgk32.exe
File created	C:\Windows\SysWOW64\Nnafno32.exe	Nfjola32.exe
File created	C:\Windows\SysWOW64\Bdfpkm32.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Qlimed32.exe	Qdbdcg32.exe
File opened for modification	C:\Windows\SysWOW64\Opeiadfg.exe	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Kcjjhdjb.exe	Kplmliko.exe
File created	C:\Windows\SysWOW64\Pmmlla32.exe	Pbhgoh32.exe
File created	C:\Windows\SysWOW64\Bdcebook.dll	Aaohcj32.exe
File opened for modification	C:\Windows\SysWOW64\Eokqkh32.exe	Emmdom32.exe
File created	C:\Windows\SysWOW64\Ckbaokim.dll	Hlnjbedi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13600	13604	WerFault.exe	716

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoideh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egaejeej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efjbcakl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjpefo32.dll"	Ojdnid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebimgcfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikgbdnie.dll"	Iedjmioj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjgeopm.dll"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll"	Joahqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eanmnefk.dll"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll"	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcneqod.dll"	Felbnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imiehfao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Linhgilm.dll"	Ffqhcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnlmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Haodle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Likhem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaioi32.dll"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojncj32.dll"	Efjbcakl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjblje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lphdhn32.dll"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjiffif.dll"	Ibjqaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmfgek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajlbmed.dll"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmnqjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Peahgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpaqbf32.dll"	Hnnljj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeccjdie.dll"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohfami32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbofpe32.dll"	Nmkmjjaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnkfmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmdemd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnmdme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iojmqe32.dll"	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddjmo32.dll"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdbjhbbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dflfac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcmfjll.dll"	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keoaokpd.dll"	Ihkjno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajgdm32.dll"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcjdoc32.dll"	Kdbjhbbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcjeh32.dll"	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gppcmeem.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 628	4560	3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe	91
PID 4560 wrote to memory of 628	4560	3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe	91
PID 4560 wrote to memory of 628	4560	3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe	91
PID 628 wrote to memory of 2260	628	Jknfcofa.exe	92
PID 628 wrote to memory of 2260	628	Jknfcofa.exe	92
PID 628 wrote to memory of 2260	628	Jknfcofa.exe	92
PID 2260 wrote to memory of 3212	2260	Jnlbojee.exe	93
PID 2260 wrote to memory of 3212	2260	Jnlbojee.exe	93
PID 2260 wrote to memory of 3212	2260	Jnlbojee.exe	93
PID 3212 wrote to memory of 2624	3212	Jqknkedi.exe	94
PID 3212 wrote to memory of 2624	3212	Jqknkedi.exe	94
PID 3212 wrote to memory of 2624	3212	Jqknkedi.exe	94
PID 2624 wrote to memory of 1368	2624	Jcikgacl.exe	95
PID 2624 wrote to memory of 1368	2624	Jcikgacl.exe	95
PID 2624 wrote to memory of 1368	2624	Jcikgacl.exe	95
PID 1368 wrote to memory of 2812	1368	Knooej32.exe	96
PID 1368 wrote to memory of 2812	1368	Knooej32.exe	96
PID 1368 wrote to memory of 2812	1368	Knooej32.exe	96
PID 2812 wrote to memory of 4660	2812	Kqmkae32.exe	97
PID 2812 wrote to memory of 4660	2812	Kqmkae32.exe	97
PID 2812 wrote to memory of 4660	2812	Kqmkae32.exe	97
PID 4660 wrote to memory of 4124	4660	Kclgmq32.exe	98
PID 4660 wrote to memory of 4124	4660	Kclgmq32.exe	98
PID 4660 wrote to memory of 4124	4660	Kclgmq32.exe	98
PID 4124 wrote to memory of 4592	4124	Kkconn32.exe	99
PID 4124 wrote to memory of 4592	4124	Kkconn32.exe	99
PID 4124 wrote to memory of 4592	4124	Kkconn32.exe	99
PID 4592 wrote to memory of 2344	4592	Kdkdgchl.exe	100
PID 4592 wrote to memory of 2344	4592	Kdkdgchl.exe	100
PID 4592 wrote to memory of 2344	4592	Kdkdgchl.exe	100
PID 2344 wrote to memory of 1684	2344	Kgipcogp.exe	101
PID 2344 wrote to memory of 1684	2344	Kgipcogp.exe	101
PID 2344 wrote to memory of 1684	2344	Kgipcogp.exe	101
PID 1684 wrote to memory of 4932	1684	Kjhloj32.exe	102
PID 1684 wrote to memory of 4932	1684	Kjhloj32.exe	102
PID 1684 wrote to memory of 4932	1684	Kjhloj32.exe	102
PID 4932 wrote to memory of 1052	4932	Kmfhkf32.exe	103
PID 4932 wrote to memory of 1052	4932	Kmfhkf32.exe	103
PID 4932 wrote to memory of 1052	4932	Kmfhkf32.exe	103
PID 1052 wrote to memory of 4116	1052	Kcpahpmd.exe	104
PID 1052 wrote to memory of 4116	1052	Kcpahpmd.exe	104
PID 1052 wrote to memory of 4116	1052	Kcpahpmd.exe	104
PID 4116 wrote to memory of 1644	4116	Kkgiimng.exe	105
PID 4116 wrote to memory of 1644	4116	Kkgiimng.exe	105
PID 4116 wrote to memory of 1644	4116	Kkgiimng.exe	105
PID 1644 wrote to memory of 1832	1644	Kmieae32.exe	106
PID 1644 wrote to memory of 1832	1644	Kmieae32.exe	106
PID 1644 wrote to memory of 1832	1644	Kmieae32.exe	106
PID 1832 wrote to memory of 4644	1832	Kdpmbc32.exe	107
PID 1832 wrote to memory of 4644	1832	Kdpmbc32.exe	107
PID 1832 wrote to memory of 4644	1832	Kdpmbc32.exe	107
PID 4644 wrote to memory of 2724	4644	Kgninn32.exe	108
PID 4644 wrote to memory of 2724	4644	Kgninn32.exe	108
PID 4644 wrote to memory of 2724	4644	Kgninn32.exe	108
PID 2724 wrote to memory of 3024	2724	Knhakh32.exe	109
PID 2724 wrote to memory of 3024	2724	Knhakh32.exe	109
PID 2724 wrote to memory of 3024	2724	Knhakh32.exe	109
PID 3024 wrote to memory of 232	3024	Kdbjhbbd.exe	110
PID 3024 wrote to memory of 232	3024	Kdbjhbbd.exe	110
PID 3024 wrote to memory of 232	3024	Kdbjhbbd.exe	110
PID 232 wrote to memory of 1100	232	Lklbdm32.exe	111
PID 232 wrote to memory of 1100	232	Lklbdm32.exe	111
PID 232 wrote to memory of 1100	232	Lklbdm32.exe	111
PID 1100 wrote to memory of 4308	1100	Lnjnqh32.exe	112

C:\Users\Admin\AppData\Local\Temp\3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3d8cccc3f04df170077a088ae8ecd290_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\Jknfcofa.exe
  C:\Windows\system32\Jknfcofa.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\Jnlbojee.exe
    C:\Windows\system32\Jnlbojee.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\Jqknkedi.exe
      C:\Windows\system32\Jqknkedi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        24⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        25⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        26⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        28⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        30⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        33⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        34⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        35⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        36⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        37⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        38⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        40⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        41⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        42⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        44⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        45⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        47⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        48⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        49⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        50⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        53⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        54⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        55⤵
        Executes dropped EXE
        
        PID:444
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        56⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        57⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        58⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        59⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        60⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        62⤵
        Executes dropped EXE
        
        PID:5124
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        63⤵
        Executes dropped EXE
        
        PID:5164
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        65⤵
        Executes dropped EXE
        
        PID:5252
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        67⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        68⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        69⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        70⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        72⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        73⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        74⤵
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        76⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        77⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        78⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        80⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        81⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        82⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        83⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        84⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        85⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        86⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        87⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        88⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        89⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        90⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        91⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        92⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        93⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        94⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        98⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        99⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        100⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        102⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        103⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        104⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        105⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        108⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        110⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        111⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        112⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        113⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        114⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        115⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        116⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        117⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        118⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        120⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        121⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        122⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        123⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        124⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        125⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        126⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        127⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        129⤵
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        130⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        131⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        132⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        133⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        134⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        135⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        136⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        137⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        138⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        139⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        140⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        141⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        142⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        144⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        145⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        146⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        147⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        148⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        149⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        150⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        151⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        152⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        153⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        154⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        155⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        156⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        157⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        158⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        159⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        160⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        161⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        162⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        163⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        165⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        166⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        167⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        169⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        170⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        172⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        173⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        174⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        175⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        176⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        177⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        178⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        179⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        180⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        181⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        182⤵
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        183⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        184⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        185⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        186⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        187⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        188⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        189⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        191⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        192⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        193⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        194⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        195⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        196⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        197⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        198⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        200⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        201⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        202⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        203⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        204⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        205⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        206⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        207⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        208⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        209⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        210⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7572
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        213⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        214⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        215⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        216⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        217⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        218⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        219⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        221⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        222⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        223⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        224⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        225⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        226⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        227⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        228⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        229⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        230⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        231⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        232⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        233⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        234⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        235⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        236⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        237⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        238⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        239⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        240⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        241⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        242⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        243⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        244⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        246⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        247⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        248⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        249⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        250⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        251⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        252⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        253⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        254⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        255⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        256⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        257⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        258⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        259⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        260⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        261⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        262⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        263⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        264⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        265⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9156
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        267⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        268⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        269⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        270⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        271⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        272⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        273⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        274⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        275⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        277⤵
        Drops file in System32 directory
        
        PID:8348
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        278⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        279⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        280⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        281⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        282⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        283⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        284⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        285⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        286⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        287⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        288⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        289⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        290⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        291⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        292⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        293⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        294⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        295⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        296⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        297⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        298⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        299⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        300⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        302⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        303⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        304⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        305⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9720
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        307⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        308⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9864
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        310⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        311⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        312⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        313⤵
        Modifies registry class
        
        PID:10028
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        314⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        315⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        316⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        317⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        318⤵
        Drops file in System32 directory
        
        PID:9220
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        319⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        320⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        321⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        322⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9580
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        324⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9716
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        326⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        327⤵
        Modifies registry class
        
        PID:9440
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        328⤵
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        329⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        330⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        331⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        332⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        333⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        334⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        335⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        336⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        337⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        338⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        339⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        340⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        341⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        342⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9712
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        344⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        345⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        346⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        348⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        349⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        350⤵
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        351⤵
        Modifies registry class
        
        PID:10320
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        352⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        353⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        354⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        355⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        356⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        357⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        358⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        359⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        360⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        361⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10784
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        363⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        364⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        365⤵
        Modifies registry class
        
        PID:10900
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        366⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        367⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        368⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        369⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11124
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        371⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11208
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        373⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        374⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        375⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        376⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        377⤵
        Drops file in System32 directory
        
        PID:10464
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        378⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        379⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        380⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        381⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        382⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        383⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        384⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        385⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        386⤵
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        387⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        388⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        389⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        390⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        391⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        392⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        393⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        394⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        395⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        396⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        397⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        398⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        399⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        400⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10272
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10444
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        403⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        404⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        405⤵
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        406⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        407⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        408⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        409⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        411⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        412⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        413⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        414⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11052
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        415⤵
        Drops file in System32 directory
        
        PID:10564
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        416⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        417⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        418⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        419⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        420⤵
        Drops file in System32 directory
        
        PID:11272
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        421⤵
        Drops file in System32 directory
        
        PID:11308
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        422⤵
        Drops file in System32 directory
        
        PID:11344
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        423⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11380
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        424⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        425⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        426⤵
        Modifies registry class
        
        PID:11488
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        427⤵
        Drops file in System32 directory
        
        PID:11528
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        428⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        429⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        430⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        431⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11708
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        433⤵
        Modifies registry class
        
        PID:11744
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        434⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        435⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        436⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        437⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        438⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        439⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        440⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        441⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        442⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        443⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        444⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        445⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12212
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12248
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        448⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        450⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11440
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        452⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        453⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        454⤵
        Drops file in System32 directory
        
        PID:11624
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11696
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        456⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        457⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        458⤵
        Drops file in System32 directory
        
        PID:11896
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11948
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        460⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        461⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        462⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        463⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12208
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        464⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        465⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        466⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11588
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        468⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        469⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        470⤵
        Modifies registry class
        
        PID:11944
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        471⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        472⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        473⤵
        Drops file in System32 directory
        
        PID:10908
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        474⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11668
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        476⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        477⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        478⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        479⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        480⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        481⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        482⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        483⤵
        Modifies registry class
        
        PID:12196
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12076
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        485⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        486⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        487⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        488⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        489⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        490⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        491⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        492⤵
        Drops file in System32 directory
        
        PID:12556
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        493⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        494⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        495⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        496⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        497⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        498⤵
        Modifies registry class
        
        PID:12772
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        499⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        500⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        501⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        502⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        503⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        504⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        505⤵
        Drops file in System32 directory
        
        PID:13036
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        506⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        507⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        508⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        509⤵
        Drops file in System32 directory
        
        PID:13180
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        510⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        511⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        512⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        513⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        514⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12436
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        516⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        517⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        518⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        519⤵
        Modifies registry class
        
        PID:12692
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        520⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        521⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12856
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        523⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        524⤵
        Modifies registry class
        
        PID:12920
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        525⤵
        Modifies registry class
        
        PID:12968
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        526⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        527⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        528⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        529⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        530⤵
        Drops file in System32 directory
        
        PID:13212
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        531⤵
        Modifies registry class
        
        PID:13276
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        532⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12428
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        534⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        535⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        536⤵
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        537⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        538⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        539⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        540⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        541⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        542⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        543⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        544⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1096
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        545⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        546⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        547⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        548⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12796
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        550⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        551⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        552⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        553⤵
        Modifies registry class
        
        PID:13092
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        554⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        555⤵
        Drops file in System32 directory
        
        PID:13320
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        556⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        557⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13428
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        559⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        560⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        561⤵
        Drops file in System32 directory
        
        PID:13536
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        562⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        563⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        564⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13680
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        566⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        567⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        568⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13828
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        570⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        571⤵
        
        PID:13900
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13936
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        573⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        574⤵
        Drops file in System32 directory
        
        PID:14008
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        575⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        576⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14116
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        578⤵
        
        PID:14152
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        579⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        580⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        581⤵
        
        PID:14260
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        582⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        583⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        584⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        585⤵
        
        PID:13416
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        586⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        587⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13640
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        589⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        590⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        591⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        592⤵
        Drops file in System32 directory
        
        PID:13884
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        593⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        594⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        595⤵
        
        PID:14068
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        596⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        597⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        598⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        599⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        600⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        601⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        602⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        603⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        604⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        605⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:14104
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        607⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        608⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        609⤵
        Drops file in System32 directory
        
        PID:13488
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        610⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        611⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13964
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        612⤵
        
        PID:14148
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        613⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        614⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13604 -s 224
        615⤵
        Program crash
        
        PID:13600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13604 -ip 13604
1⤵
PID:14332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aahbbkaq.exe

Filesize
77KB

MD5
9bacfc75ddd1e0df1c2ce54999bd5ea5

SHA1
3ce4cf1d7817ac32b3f7371d5b0e013b044896f0

SHA256
83c42b98b533166ac54f763be041cdfc1899f85b2b74d09236847719994f9242

SHA512
caa5c0022d860f3665c8953232972f1ff79f093d6baa86899d19aca48a5a4427fb3c220b72354165f4d1dc4f41e278bc43cdf2ba3d621d1d8a69a0f863ef8a35

Download Submit
C:\Windows\SysWOW64\Akccap32.exe

Filesize
77KB

MD5
1100ba3c3bfd6ac3cfbdd83203db2f9b

SHA1
4327f28922003f13f3873f04485556977bf4f546

SHA256
060127b033325b4ae1bfd42a6eb65cf799e192996a57bbc8e7b149a1fdb45d9e

SHA512
db2b77392b8678531d15132c810a4df1f952e27c0da579dd8447ad4b4d3bd67c6624928dc170261ec8931afaf532687210e4767f0fa8eced6305011e2b45f104

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
77KB

MD5
05a31f904d167df9cb7a7abf1f1441a6

SHA1
871cee6e413b8d5e9d027e7a2c2d2dbeaca52e0c

SHA256
43e0ac52a417bf4341c24426bfcc5bf941198140f8e06610f507e04f411a872e

SHA512
9b680339c2a34ad8a0f3c0d2eb71ab73cdd189ca133d8e40e336c7afe838a5109833c8d6725076f42c30d4c50e1229c3258371358891498a377640c34cd65cf0

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
77KB

MD5
82e2add7e38dea9391dd6adb44cad067

SHA1
b1c052bd7965ace8557c47c6584779a02263f3fa

SHA256
3d491753465e768dcfa708a5ba670a45f957e214d84c73c1ff6536d8dd51b92e

SHA512
925c948fd73c8eaa79354355a6cd8c093c0562b2b456b123957e136503e24908341c5ee31fd6d1ec9d2c7b9da6deddf83ac5f83c7e19a72ffc226a52724f32d3

Download Submit
C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
77KB

MD5
28e2c7add899355646daa884b7029fff

SHA1
3099221be2374074f588968c34052245687f9a1a

SHA256
e3a5ffebad463bd794d678bc078d08c03971614a15a777278c90c9711bcba461

SHA512
bc381c78e1ade96ffe62aaf6c0576140277fa63befc07140bd764d57731a50fed4b6e4b92dc31cf4678dd6b1c2b21a9437d9806ea2ed7e2776b1ae462ba07007

Download Submit
C:\Windows\SysWOW64\Aoalgn32.exe

Filesize
77KB

MD5
385bd21e8b9a6dc8cfb45bd3191e6183

SHA1
4251eef97bbd07444df8a51eb79258e8ce7dd908

SHA256
89f0dfa63983752174371ad61dc4e9db2cc16952f8e638cf91274bf07ab7b72e

SHA512
ad133e02f534cd612f56eb1e9ac5a88df8fc33d907288265903826a246c560f7675c605cbc6aa31d46394ef90f775a769dbbf3c9ea0811a0eb5748486bfa29f4

Download Submit
C:\Windows\SysWOW64\Apodoq32.exe

Filesize
77KB

MD5
3d2ce1a2edb9dae9e315accf84b77bef

SHA1
4c6f16ddb07bfd299c0666e71f09642ab5ea92b6

SHA256
32f214f3cb412fd6b011a36b29b481839cfd60319a7e42cb296b9ed95c6308f5

SHA512
8f0699d6024a93b2e39775276eed9f67d9b50e36a86a66c478801c639d2fd74a3185ee741a3f6d375f801855008f274df8060d066199bda8773450667e109450

Download Submit
C:\Windows\SysWOW64\Baadiiif.exe

Filesize
77KB

MD5
6387706d7b8c1c5c9227953b6893e1bc

SHA1
62fdb3eb52ffd6c0b17cacf3c563291f0df476d5

SHA256
3260137450b16ca0114771ad6be66a49448eb327643e35b62ddfc2a4a7ced3d9

SHA512
d9aa1c82980440165163d4cb4e43ec55bbe06cfe1b3e4c0c9fbd939b1386b922cfc9fd11985100c339f32d4ec44bc4d4548ec8d9513c3f506d30f20f81303e23

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
77KB

MD5
fe722e786e31ffec262715af6deceed5

SHA1
c82a73902a69f06141800b2311eba2e4ac5371c7

SHA256
f21227e08b20f4e9a4e7b9a490e7a52cd3c3b31bc150e09589465b74dec4c666

SHA512
edf3dc0f93cf2c651f315f6fd4be3c34c4598166d1a9783d38dfe55796009e86a78631f02a9a9062b24e9e3b96a95bc78556140384cb1e21e39d9fc8d3599bbf

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
77KB

MD5
4681c1a263355116c035e0ccbe01cda1

SHA1
fe4265ffd2a836a8a8cef4fa873723cb77dba207

SHA256
65e42bbb28e29f2958130b9d6811c72e37c115ab3d5915c32d6afb677c8d85a0

SHA512
6e46b447b0b7bfcfadf27434454dcd0c5b6a2f685736bc5ae939e8f4dbc5f34742d48709a9f6d9f2874b0b41c34dcedaeeed475ce349ecd3cfb5b2df9fef0d31

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
77KB

MD5
b3a89ca727a53dded84a18ec20a28c41

SHA1
e4f91d14e332ad3fa5de4545a8d3db0336d8bc3d

SHA256
825b4b87735046a37110656f60b950de9d2177841368f94b4be396f2810ae9d6

SHA512
a80b41732f5186bf0a2bddf67fd323081456eccaf7b671b264b6f81fe1b7b6be79b6c4f97d784dea3354caa39c9651f7dd3d8d4bb72da9bcdcf078b4b5e043de

Download Submit
C:\Windows\SysWOW64\Bphgeo32.exe

Filesize
77KB

MD5
3da98d8d9b119cd62d01472e1030e9cc

SHA1
41b28e2492232445f42c8143571cba058e15471d

SHA256
1822a6f62b367aea480ad80a18c1e6930db18bbc8129f92a42697de9bacec41a

SHA512
f1cbbd431088f44855133438910ae2a6221bb0192f8d642f47f0d051e84b20d1ab4a9fdf06115970c3d18d881792b2511d82262a72ea2e823cea1660d2a9ca1a

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
77KB

MD5
bbf0c13f032affefee8ac99b96cd6eec

SHA1
803e393d6003a519a8b66c64618c3270ec44025f

SHA256
c30243f19de34e80458b6609bc37dca72dce7ec96302e556f8959e28d176cb38

SHA512
80648683fe3b251b0fc159a38c32223160697e6424d90db44f04cc3473702148a5d5d0539e8514c3e8b22107022446dc8671fdd0d35402edcf645bacc1f18665

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
77KB

MD5
8e6993225ac215e785d79ff201b2036c

SHA1
4f31ea5745a6233fca1c8becbc5e1ad165410b1b

SHA256
a1d21f3a56fb19e545e026e1cdf879279ac8e2e2f2bbcff698beaf82708abb0a

SHA512
2c2b6f79e0ebbe97da7b0d823793b878233192ea37eca2a6a4d6d81cbcf1567496847f63dd8a48f351f578a83bf9a7d2a379c5ac669bbc85f33e09170136fa94

Download Submit
C:\Windows\SysWOW64\Dggbcf32.exe

Filesize
77KB

MD5
f8edb2b56bd311a87cc3b20724f87f7b

SHA1
41f42679c9a0d1e9e25cb8ad84e32a00ed2fe2b7

SHA256
6d166a5348a3eee45e93f76f9d9c4c39f09abf192eeac64e057b7f94f952c57a

SHA512
d69a68f750f79118fad64a2b5158e867ab8f99de6288482057626799456c7e6236278995b8fbe7331deaf11a6b887cc6fc453eb6be0aa3ff1030f181f894f214

Download Submit
C:\Windows\SysWOW64\Dkhnjk32.exe

Filesize
77KB

MD5
a0c3c741cf39f25c0aa260f90692a813

SHA1
5c66941bed6cfb3853e384de37ba891315bec4b4

SHA256
ba891ba4d7052c4cd285e402c9f1ed675d9315a5a7891429089d1cc89787ffe4

SHA512
1507a997f494f86a27a91202f40488a9ff935cab728ed3b6fb19926a8963fab22f7412ddd9febf9d3eeb65024c5d502d5834c584081fa893eb8cd3a21e2b2c99

Download Submit
C:\Windows\SysWOW64\Eohmkb32.exe

Filesize
77KB

MD5
2a83f3871f7fd1c42e5e11ec7bd7366a

SHA1
e8732e8e722ce21be09f65fa9d57e91467e806ef

SHA256
8c7492643f67ee5df1b11ad6635dffec69f19f661d4458e64b522f2f40445814

SHA512
b8ce2110d4d7dc12ee74b5db84128c91cb63a3d815388c1ebc060a2d566d853006afd1c67adbd5ce762d357641b907733a1730488f2861b312fb12901da7c9ec

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
77KB

MD5
09bb0e81d46db32b9e13cd4dfc6448fe

SHA1
e72fef9ca136c597e24804eb93f7a23e2a790a3c

SHA256
3f2d5f4a627f7a1b18314618cd0a4d6d9c6ca1e28bb129d6f97325d4d9a11942

SHA512
61967fb0f564622d08b33724bdaf13b35b579d1d8b4d0985f2df8bef09247d4c06f0228d8c1e9db27a81402d4af9dea97f93a65a935bdcafd12963a1fa00f69c

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
77KB

MD5
c3c452e7772f6f3e3a0d38fb04c2b460

SHA1
87568b9e44f6ccbc9fe3f81c8d61f92f1e74660a

SHA256
d9549c42147fda709b86c8332d7df687ecb006e22ffe061bc2abec21a48ac56e

SHA512
829cbe7ea5482dfd674cc08d0f42143e1631edef076fc7364864fff99f66b5e2db60fcbcbfae5d6cdd92e00562d4064a74a416b782b9a24c3e67e0930e6302c9

Download Submit
C:\Windows\SysWOW64\Fnbcgn32.exe

Filesize
77KB

MD5
855918acac2e4152a76b551b5d21b59e

SHA1
22fec5c0b8c56cdc09d3b9d339b253a364d1cdfa

SHA256
07bb1101dbc33485ff9928b089acdd2285ef6b99c29952b8a594147adf86a4bc

SHA512
359f358ea1e13901b2e48fffee65336f22afdffe6450c8c7c324108906f72d4de61598e6b9835f94197bb13b41e0052af1c00912968369f2b75c40210c2d98cb

Download Submit
C:\Windows\SysWOW64\Fqgedh32.exe

Filesize
77KB

MD5
9d12a3c1070012a24755424025468e2b

SHA1
908690867172f419e0eed8223394313e606c4cfe

SHA256
4f0f415c0c2054f3849e37a716e759650e8bdc1bf11329c178f7b89c3ce55483

SHA512
bc8de87c6b9463a9f59a7d5753f01f0c7536624b5e8beb7f4162fd5e5796afcc49eeef71535488651c5bf5563199a23a318bf1a97db80daf3c8a90470c210e5e

Download Submit
C:\Windows\SysWOW64\Geanfelc.exe

Filesize
77KB

MD5
0ad36a258b3dbc14de8510fa8c2a6d26

SHA1
64011a41989c278478ee58c8549604c4cefc7904

SHA256
3f8d2318c0c6b982b56fbbfbdbc7f51577cd8c0c4b8e9327b7046c0883721db7

SHA512
e028f325a0c8772f9ef645b3f59c4cf3bf3b72cb57fd88cedb69ec11648c9d099d04e36c9c49676d2a9f52cee0b0d83a3a6d19d042b082813135c714e681e979

Download Submit
C:\Windows\SysWOW64\Geldkfpi.exe

Filesize
77KB

MD5
e4fc3e917338d081569d928269ef3497

SHA1
4caabfda222b1d414112d084a6edd6548b335455

SHA256
7a47dd3172b9b873cf3760c6afc7043794420be9efbd413a21ee0fbd1c955c04

SHA512
c4911a22ae64c5e8240f65025f3185b04d6e4bd5702776c59721cadca3731360e07770e716f1bf65edd2ac9bef43223e2ae76745853d0b32e316f4b876b237f7

Download Submit
C:\Windows\SysWOW64\Gnnccl32.exe

Filesize
77KB

MD5
dbbd7d651e808543c31ca2a0fefee3b3

SHA1
7587cc21b712f71686a048b5fdbd2a8b7e2f8e19

SHA256
3ddf8e1dceb866228a8dfeb03dabf2b13c393459b72b69fb984a4a68cfcbd43f

SHA512
d0bbf3d32f6f502567eca40846fceb2dca36f3b329dacdf8eb313e5f473f87c8a0d95024225c166bfd8ecbbd46e9997ad0280f643470606b14623b013403a902

Download Submit
C:\Windows\SysWOW64\Hehdfdek.exe

Filesize
77KB

MD5
62b33cd0679006be4ef87750f6c4ac1b

SHA1
df9189a0b682b8185973c713e63a4487ef1b7b31

SHA256
0c945762514c4c807247c59cc801792cedc6d0195c3d0b94766a0b65a8d13554

SHA512
bcec1c5bd3c3874a25023d9de6f71c1b2a9068e1e509b286389cb5bb9fcf25d65cb2a4c24aa7d3ceec28b51bd804f7cb9a17738afcc3db61583ba059ce3aeef7

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
77KB

MD5
61a6ef81cfeb454bd53e188ae1097c0d

SHA1
5b8d97acc03196a98be1731c6f27b793d89ecbae

SHA256
8cdd97717ebc27ad63181b6c11f6a784de8a506b53f2cbc7c3bbf98e822b694e

SHA512
001fe3e251c2168e515670c327c6d68e69fd0c6fb0bca5b353817c8b52c917859c80727ba9257f82400ac31e7cdc2704161899a5969a235dcac23f73b998e824

Download Submit
C:\Windows\SysWOW64\Hmpcbhji.exe

Filesize
77KB

MD5
2f5f9b93ec9198d939f1c32b0a13bbb9

SHA1
7e11a563e23e2a30f35c117c1ec6512b2ba2d318

SHA256
1d2493cced57db9b91e105f16129ebcdb9cb30b6d940bd3cddb583e04c4e52d5

SHA512
178d528dc41fefd576e68efe5d8b15b15ea7097531f7cc17d799cf33fc8a89cfd684dcaf2fe0060b9160b3241b6874a64a64db46cdd518ab4937f77bcb8cc8f1

Download Submit
C:\Windows\SysWOW64\Hpmhdmea.exe

Filesize
77KB

MD5
55814d2793b4a62539af69fa91a406bc

SHA1
051f2e9a76ed644fa9fa8e5b98808c35c1867952

SHA256
2563002c8e78c6dd523a57b258fc728bcd6f5ef4029128a8aa89b4b79bb401fb

SHA512
69bd46252c38719d1829f431136580ed34ac83149b81dbfbf420a05a0dd8ec87cd524159fa750ee58d45100d070837788d9a9111989253daddefa449b5c425d7

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
77KB

MD5
da43bc8cdc47982d294f744bb944ea79

SHA1
8e636d57bdb8efa7ad7ae7b3c0241566fe0c17da

SHA256
ff4c493f9d52d7d6884f305d69d1fc945a25bdc4ed9763f4254859939810b51d

SHA512
2d125adce930f56eff48ba4b3ea377a197491c77dd8c692da03c3a26c71238e13a786a7b360b0e0d3dd581e0698005918323a821df98b0a544262f43f9895b92

Download Submit
C:\Windows\SysWOW64\Iijfhbhl.exe

Filesize
77KB

MD5
e4b53325ad82d9cb53c47e9fd42933a5

SHA1
0cf28b68afd1421e3d6774b9ccb05c83178aab6c

SHA256
e1fb970fa966c7aedcbea49b1dbd5d12551f892a85e4eff119a2493faf30f163

SHA512
8aeb150cc7d68611f0e0b55f94fbe8c7db00d6619013991b7ecd503669e9f18c48be3d0c457b57bca1209b73d0dee8b23a1e97a5fce37169ea4cb4f914fccff4

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
77KB

MD5
9641cd1b31ce5b6d720259417ed56d2a

SHA1
70541f93141b54adf961cf3ed3ef6e6238585049

SHA256
235d47e4d79841c1526e06efbe9efded881c2381891cc30bc09ffb06e4999691

SHA512
999bece7e78a45d9b504a7c337254b2bdd389a12ea560e8e61674f2eae61ed892af1b73eed25974af8db5d293e678ddc08aa9ebcf0a39b640e29ba12d244ab20

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
77KB

MD5
b18a5a948beba664fab35caf79abda0b

SHA1
42f25023b80f804ad69c4f0fab2ee4ddce65e564

SHA256
18db60a974d096f378355d6e92cf01473392e53f263a3321fa2781c338ae3d51

SHA512
58c652e8f90ceef6f8fb368c149f5c2c1addefa6dda6b46d46763c038a48c7fcdca68552e18a0076d2dfc7a420d86ed2f2804670f023fa096bfd0ad230a3cd43

Download Submit
C:\Windows\SysWOW64\Jlgepanl.exe

Filesize
77KB

MD5
67dbe0e6c5bbede075a490a04e130619

SHA1
0f8953b00636202ee61517f09b22fc00360056b1

SHA256
40fdde8e072a9f6da40b076f2c785fb579cf0659c757795b936f9105c47a1e1c

SHA512
f80fff0f00a9b46580636d116805e09d3780e94fba516b276c620e5fd728046632178f99029ce2276799342081fccfd457bca35e6eac0095640a513a7033dcc1

Download Submit
C:\Windows\SysWOW64\Jnlbojee.exe

Filesize
77KB

MD5
3bfeea44fe499a15135da2bc1938c8fa

SHA1
8b8bc9d392205f0879b0ab6a9a3f1713f4c21fcc

SHA256
13eaed69a37cf391f4adda0a5455ebcbb04a08dcffc75589728a6ae8186406c7

SHA512
47243bec379faea695dfc2b72f307f1d4059c6773305c761b41521307b30a1cc67c1a10604e66d3a1a76bc8e2b61d11db84f5a58aa099bd6927a411e9473bc74

Download Submit
C:\Windows\SysWOW64\Jpnakk32.exe

Filesize
77KB

MD5
9bd15a309e77821a7b65e445d0e83ace

SHA1
4417d60b72b558765e055c03a9659b0ff541b1c4

SHA256
65b571e2c7067ea37a1ffefa0410e6f4c931292cf2991effd669105c257aff75

SHA512
048341edbc5377db65b60f9d156b6e5caeec39702ae151cbe87024def065c6a24f291c09ff004f79654da6d2921b127f56cbb3938e961d9a2bf5421c7d98f664

Download Submit
C:\Windows\SysWOW64\Jqknkedi.exe

Filesize
77KB

MD5
8ede906af3dd535df5f315d97cecd37d

SHA1
d6bbae0c0fa6434b05ee1e1284835847ae2637a2

SHA256
9ccfea091ca74817b64858bc679fce831bc1b9279067e56296c7177e5382056d

SHA512
48e6aeafbbbf38db586278cb8dafc650656b9ea1307c81bd37f5c94a20a608e0712780fd269b8e8d46170583544ba3788b947c56423575d78a5828cc701237c5

Download Submit
C:\Windows\SysWOW64\Kcjjhdjb.exe

Filesize
77KB

MD5
49f2757cf02a97a1663e9e0a4cc54c55

SHA1
4fc78aecfc27b52e1879b068f16c3caafcec7a32

SHA256
72a1d76ec2c1f40e20cdd6526c439788e61622aa5ee3e85dbf069c8af8e8916c

SHA512
154786f1255670cc898ba3ed023cc301e44bda50023bf9301e454c8f096a8c48f53b2179b627e4c1f7ac81d95a24bd50e06a43a4382761c2d92c303e280c9f14

Download Submit
C:\Windows\SysWOW64\Kclgmq32.exe

Filesize
77KB

MD5
89787f56dc3a78802426c9634396e4dc

SHA1
ec38befc0ca1ebe910a6ec339326c8278b3c2e67

SHA256
b7d63dcbc399699f83983f917f67a3ca64cee002aabc6dc46f14e6dd2a24cc45

SHA512
65d1b5b77da478c2e9c0528cc87fee7ac887384cd8b53354feb5f815d79f0603fd539c16ee328d20c573ca7f2edce762edb583ff16f30d97f0c4cb9c95e07127

Download Submit
C:\Windows\SysWOW64\Kcpahpmd.exe

Filesize
77KB

MD5
4ca192cbf5b7ad70898338b809a3c1d0

SHA1
72d9a427300c2a1819bdb1ca5cd9a34c52cab6f9

SHA256
b8a663a5801e22ee629a49362cb2ea379ce762ba2108d0807da407ad2e40bfd2

SHA512
8fc3a12b4bb1697bee6275bb05321c0cb161ca6376dc7f06d762def2348f20a87458da266caba280a41fe828d3c38e7419b914d6f8c38a6bcbbc67e15a423c25

Download Submit
C:\Windows\SysWOW64\Kdbjhbbd.exe

Filesize
77KB

MD5
c7815160d13d6a5515a2b3d32ec579e7

SHA1
dde3c23758715b43b16b0d1139a240f0643eaf71

SHA256
892c3766313751472921f7bbe96952cc4939b5d9e7817cdb3c49902a5bada501

SHA512
4de714c2e6cd1f6a53247664f6fc74a7f0df5e1b0d9df0739f017317fae279589f3cd8001a1408aa15da0bcaf201dbe534bccfa3d45b5b845d36920ffa03b3a1

Download Submit
C:\Windows\SysWOW64\Kdkdgchl.exe

Filesize
77KB

MD5
519b6634859df73826d1559ffe8ee331

SHA1
45109d3b3e5eaa1b51d4403f8043353faaaf87eb

SHA256
6cf1a8404304c63f50cc5dd4b5a7df1145d0a6582d1dd40c751c6d7c00e6b013

SHA512
8cc002446a59dcc9f8397247b9c3b09da93e3f8cdafe9bfd6c7cd6b3bead88ea76b0d2dd0c731a484487eb19c91daaea151af0d2981766c092ff6403839e1947

Download Submit
C:\Windows\SysWOW64\Kdpmbc32.exe

Filesize
77KB

MD5
f320ea8cdc31d48bc5d1706817cfb53b

SHA1
9fae4f2c06b49580b221e903f08d7f9a42978e00

SHA256
1cd735d086857d2224007d1066f86dd37af01d4ff354acaad4ae2ae076b5ec7e

SHA512
1945bf6f653a28b779b03d37fae60f6fbfdc7762ca7c776c1ebd0103486fc986d9baac8b3790bd6d61f5d12efb64984563a81538f81824db4d3d9814628da0e0

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
77KB

MD5
4d91a17524d9be517989dde874315224

SHA1
f8504f39f12d0afe8a3d25a9ea2f036088f63deb

SHA256
88727f8a7ab9f7d67a9606f6f7a0ae7fd2612e9669da2cb18f56c7b7fb4fcb50

SHA512
a6ef9b02399a678bba83fc6c6c55ea70b2443d4d370143569ad7cbbee1654f6936f338e355124f2409775b6bbbfcb046fe63ef56fdecee4bdd33f819fb21f353

Download Submit
C:\Windows\SysWOW64\Kgipcogp.exe

Filesize
77KB

MD5
0728c16e1850edf06f229379d169a522

SHA1
d29953fb32207557fc9ee2e5f013bfd22dd5624b

SHA256
a7d45b834ceef45fe70a8067f9e0598f705a9906172f638ac2d714ea0d1298d9

SHA512
af4c7bdff3e6c063dc10f474e167b58404e81f372d344ac9a6c1b6868dc8f46ebe459b4d843f4e37a938f502f73eec8ba9b5881eb02fe0e728d52113c3e37065

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
77KB

MD5
e60294d48df9b240d4694430f52f4a27

SHA1
9c53c44d1af3f348e993f7cf4ad495cf41903ebc

SHA256
e1e84415517d2ec8c8f3ce293fc946419d4ef30b553b4a690c87be633b678b0e

SHA512
fcac2dde33c3978c7a3b52e0160239401c59df0df3596b265d2d75eae3bd46a0bb5f79153013fd0f05c8cf48220c6c175867f9603adaa62c13273bd69ea239ff

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
77KB

MD5
40bb82f88d8dab70bd8c4aeaa4f33bb6

SHA1
019e1227dc78f363e90acc431a527f5ba7e05c54

SHA256
56fed569aaf758c38c2e62f3f034399ac3af5311947e72fe73e72114fae7cc1e

SHA512
fec421443aef6b9697e5fc511fb0049a019b3d1c3ef02892745b12fcd82c65d21438c1b17efa7474eed3b05cff6a5bfe9bbc59ef79da366871831399b3338ab3

Download Submit
C:\Windows\SysWOW64\Kjhloj32.exe

Filesize
77KB

MD5
0b1c62899f5719fddc23ef6dd9659494

SHA1
f0c17824523a7a5a684809ad9f4d85d2959b7bfe

SHA256
1077980ced2c0c70d02aed94bf86690cdfb1e2a4b3f7611d2108287ad64ab253

SHA512
c0793f66def74be35bee940d7141c9ab947b49b707b3b78b2c2802dd9c0f19b7694f817ad0a7ae6b779be2abdbb1f65b36ef95a04823856a0623f2f790a90ae8

Download Submit
C:\Windows\SysWOW64\Kkconn32.exe

Filesize
77KB

MD5
216bb83ef0bc361197131b3109b849f4

SHA1
28f1cbedea7920c9318ab2e6c68dd7972ad6d411

SHA256
a8ea07f0c481c46cfcc16cb7eda7c08c33f256525f595b5e4607bbe94437174f

SHA512
c28e1878d378745f1d44dac216c8f78742fea325cdbbb94918d61ba90f7855fd6d9005bc9e07abbd83adda034d4898a7c62a56a51c7f4c8b8e501000dbc187aa

Download Submit
C:\Windows\SysWOW64\Kkgiimng.exe

Filesize
77KB

MD5
9b953bac12abf0f04de196a2471cae42

SHA1
10e02f0ecc9287eb22541acef3c37b2bf9eb1962

SHA256
6d22e085f1b41836450605362fc8bfcc15ce11a1b3d6d0e193b9acc9cd68e063

SHA512
3b82097ad657b2df37df57a8a34131979b1e8a18a6760f7b73b1dd0d1d66b057efdec9f7beb776fcab02697947ef0f2d3f9bc339b65539a33636864703453345

Download Submit
C:\Windows\SysWOW64\Kmfhkf32.exe

Filesize
77KB

MD5
8b5974a50fb634dd30b31df82a37939e

SHA1
3dcb76fc58a5ce22adb05fbc336377d8cf2d069f

SHA256
bcd02f25bbdbce236b8980cb7d16e212b17d25d1657bd6390a9f77c8241d0171

SHA512
cbdcf241a8f1967a18ef4f05c6e6c414991b055e481de7551301872e50499e3ce4bb306080e3d8bddb90c9008eadd5dc968f412f8cd19763e274a6411efc4f3d

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
77KB

MD5
dc341694eb48102a8b48fba26794148b

SHA1
bc67da302675aee714120bc026d66f48cb58d461

SHA256
8f14e32b306b5aa1d9525c6478c1aa26bfd26678dae6d30653e2060a6b63ce46

SHA512
1fa0350b626b1f4b794d2110e4991591ff1c82a826dcee9d7443ff98b0748c2b1bb9eb37585b5bfd1ee46efcfc396800343be85c9c529018d72271a67583d611

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
77KB

MD5
43e25abcc4dc2696d2ccc20fc3639201

SHA1
517c466ffc0fcbd3fee2d91c44242bb1df67f167

SHA256
7b50584dcfa4e83f51001059d7979438879417ec670131640355fe430fc9f606

SHA512
0ec392f427a61076f8e51633b335497d4e841e6542ea3ce9d4864fe90ab6650684428f4ab2d5b6493bd5a60ca0dec6dbb0a36f4b3649a4446db06b875d41fbeb

Download Submit
C:\Windows\SysWOW64\Knooej32.exe

Filesize
77KB

MD5
3658e146e86f56e18ccb1717c064f677

SHA1
6739fe96636c4e452040093a02e465fc59e3ec79

SHA256
0c749a4f1f7f5f9e8002c390290556879d3805af7becfe1816aef346308ee43b

SHA512
d7fa3eeebe0071aa50c85aa3542e6b7c526c0ac2534e0edcfbb3e7658946c5773bd0c9055d4bc53eff967e30f441660e2b6275572457aa3e783a52566b9511d9

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
77KB

MD5
1be687631f2d20b1d270124814382e95

SHA1
b510e53894ae973042516ef692d0c4f5fd2d5036

SHA256
dbff8348b69256babbcd03b7cfb7a65055dd12c8fb98036e70374eac4bb77a64

SHA512
6325c3fcd421b1ae5b2aa05c4314d2e2e2e9c1e4b073993e80fb775c201689acb4e3c88ead5cb73b476582b6ec91d5779251af7a21cfcbf2d992c65cb0a8bff9

Download Submit
C:\Windows\SysWOW64\Koodbl32.exe

Filesize
77KB

MD5
7a52fd22c957aef437cf9ee1591764c9

SHA1
b5303e51e77bb82c613a80c9896228c9c282c246

SHA256
b64a9a81caea72b373ea06ca7c163b88e0123788ec8309face395ec291e03177

SHA512
bc852ef98abac708316d744d3c615c98710912fe56ce09a4491282f7542ab24455f6b056b9ce69a3481f5a142e16f7cbbb711205129f57061016aab857f9d9e0

Download Submit
C:\Windows\SysWOW64\Kqmkae32.exe

Filesize
77KB

MD5
c53c26b470aef26d3e7762f2ea89c569

SHA1
22f2318f4f7ec341d62e2a0f1c45536dede7924c

SHA256
2ebbab134f9410dd29ad109466432165e3f9f9489a8068ee72ea9a5eb96a9d61

SHA512
91364811def1002983d29eae8c613ae232ec6259070ff6169c492a7885bf56dc58340e51eda2a428ec7302cfffe4aa041dc1c2fae91de2da1ae12e06c19f16e5

Download Submit
C:\Windows\SysWOW64\Lchfib32.exe

Filesize
77KB

MD5
5b2d08516a3917b3a9579280774d944f

SHA1
156794dfd7af1ee881e69e35bb94a4f4f110afd7

SHA256
d726d28bc9f9ed7691a3627f0e2e1ff62d10ab28433ba256e16de281557a751c

SHA512
985f3c501b35faf56bd5e5168dce710da88a8f0da85bfa531a58c8238f742f70eb4c6ddea8728f546bf993eece25eaa5169fabf9847fc702c9a635ec89851ef3

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
77KB

MD5
e54db62d67e6021393c760dec35adfea

SHA1
b81464a04f9f4080d8843d3ed6791856776a2d48

SHA256
cc10c483c24930edfca1cc85e783bd3b02e00da7a06345c9e6d762c5357245e2

SHA512
3d0b8a68a6c6949144daf0a106a8c3532b8bfbf8eab5e38cd57d19db8d69921b5f4914a613bc08d1fe64d5be0d8987520544a337210fc68df5de990d8684a986

Download Submit
C:\Windows\SysWOW64\Lcnmin32.exe

Filesize
77KB

MD5
7569fcdfc64f72fd7b62c72c2e75db26

SHA1
cb6e2e52f8f4ef4b58d1db39d8a638f55a01f762

SHA256
6086f1c6acdedfd9896950c36b14d40b1711f47f112b0a0bbcddcc06c0a1c9e1

SHA512
6f086c0f76deaa94c84f8178ee2743200d8ff7c760745abb2b54f61cbf221e778fcf8bc8c2e27b1320787e75c35fafafeb1f4d7a2350e489ea07b10f8de6d36a

Download Submit
C:\Windows\SysWOW64\Lddgmbpb.exe

Filesize
77KB

MD5
20028e758567f82e9601d1998c709c45

SHA1
fbea2ac022f98f8681a79f12e0d5371feaa72782

SHA256
1441f1d7b97db3430a525419704cd5ac0553593ce24b5c6d895c90c414373d14

SHA512
3ea93e04974196264407909df48cb0432b589f2b3eb42e82175bf926c5ab068233c86e9a96d1364ae713e0facb32d396e190d5ab1ed941fcd925d9dee9a8adb5

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
77KB

MD5
2bd8baf1eb4cc76fc2ccc77d697983cf

SHA1
71a8aac0d6affb879495755b6228d93f287e8faf

SHA256
8caf68d00793762907d6f4159de5d465b35d79ae45695b139caec3f3bd5ed117

SHA512
64c4df34cdec6f230dc8071bdc7e7987dd703132ca400aee769bda98fa23128bc05e7f235d17cb0973b7fefb344f3f51b24dc108d4d2c293911fc31263804051

Download Submit
C:\Windows\SysWOW64\Lfbped32.exe

Filesize
77KB

MD5
ac0ad6d1f61777f56f8fbcdc6724f6d2

SHA1
9d10fb60c6cdae0d2738b24d1097f07a22115a74

SHA256
547fddbcd5eaa5823b5aa18f158257cb7af7c12882217c9dee1e4e1016801970

SHA512
e54e6ce0129c228b02e98efec91fa0c921944b2cb2ca6b25e28677c8c171963184c0e64b5e3dce22a79694118d5f672abc08b53ded64742193cb94617a057f0a

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
77KB

MD5
97927c4a495b4f67d54f27af5aeaa40a

SHA1
38eb5b39373e2ebe8bfb0a001c31a6c3cd2c29cc

SHA256
05c8e3499a736911396b6c79ae2720e257a31ddc062088c4fe7a472215a39032

SHA512
e7aaa2d49a2cc1b46ce7d1b8735192017c37ac5de2f5d0c470542cdcff484bb51f3de041556f2521843b4b37d428ac5ec9ffb018229af14b3621d96ced1b7abe

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
77KB

MD5
284405d9a0876827e6e2a00d260bf925

SHA1
2c2bfc7b3d693e272716bdba46bef9f31422acfe

SHA256
2acd52efc534e97480c6b8bb46ded7c0a0e11aad69a719197d70c26bda2b789b

SHA512
7e8c82e964f1e5cc02fedf0dc99bd679de5a826be7c54b6cb5852876768b3860dfc3c68c5164ff53e233de151fd02b249f9437a4a829ce42372a28693eab4fbd

Download Submit
C:\Windows\SysWOW64\Lkalplel.exe

Filesize
77KB

MD5
243347fa103e4319634e0def21f2fded

SHA1
06fdb3276b86ca9ffce7da03668ff44c1af1e3b0

SHA256
1fcd06960f96332ce00aab792dbc47b73c1d2b819a99ba319c749d030f7b4c46

SHA512
e4b0445b4afc2a9b81e99ba7b8801668be3c73b90fa4362ced19f67d1cc78f7ec5ff5c106982d9524ad61bd5ea8cde48aff248bc00d00401d89328fc6562b89d

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
77KB

MD5
5e494c90a436adc7b438d087412cee1a

SHA1
ea6ec7b46fa5e6143e305b48a7bd377fa94ed001

SHA256
c2c0b9e61354b21d2bc80d5906c4b1be4fecec3328e2a601ab703bc2493cfa2a

SHA512
56bad737b57dfaa6adb0402d0a70032d29324d0011daa9400534030219d3d76b5a68161365d317aa0dbaff2e7d6843ca24890385803fd5ca4ca014272e15bd58

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
77KB

MD5
054004cfdadd24148e9b285640f9895a

SHA1
65ef4c66465bf0eacf90be567f20b44dd6df1120

SHA256
8c4bb42255444aad9c3b95e23d6dcd030ce57ca63702c48430893a682e268344

SHA512
ac0fad1027b07119894a5d27dbd0203e85de274788f33a44c4bdc53deb649b6f472fd735eba6c19c163d46ea7b02aa276c0385c46efabc64b4fad51355a27640

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
77KB

MD5
ff6cb61c7dde78af019227bd23d1826c

SHA1
1ad9a64a4f20d03fc5536fdccbe6f39a2e7bcc48

SHA256
0ce348e522ce19dd8ea5669eba3da5fa7e41f02d778cdd2e9ca224bc7542fc5b

SHA512
637fc4f069fb4693eeafcfec39cdb7f0fc76aaa2f9bb7446aad5903920aa747d4cb42adbd6d8050eccd5487fcd640c5f57da0190afcab9b27e06cb7fee8c8a8c

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
77KB

MD5
8483bd336167f3df9ddd7f68898678f1

SHA1
2b9fd9b529fb318edb21b4917ed5f801c676c84d

SHA256
697ede9f347a31c143292092dc46332a21d60c915484ce26612161f648fe7a58

SHA512
09ff49c0056300461e8ff7efb222c5cf29b30425c3b9477fe05230c40b05bbfea67d886a1493648205ff2641244b6cedef9ba068b651cc3ff79468a0a01bdf0e

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
77KB

MD5
c2eb1c1042fec0e43981f50d1b7c8414

SHA1
2769b2b7b36122086e2b1740838440e68807842a

SHA256
595886740f681c891fef2d79808a2f474088f2cbd93c17bf56d3f014a1bf65b4

SHA512
dcc2bbf933bafe555a9f1fd0d4100cda04fc6ee17ddb0d0ccc2d73e55871d10a67f8dd5a6e3911ec4f702d325fa0f99e0c68bf7a9c410d8840fafdff172e63e2

Download Submit
C:\Windows\SysWOW64\Lmpkadnm.exe

Filesize
77KB

MD5
bc21dd0e88dd680b494f9824d132774d

SHA1
1506ac207424f182b8d8686022410dc5e4237088

SHA256
34853c152866fe060a5a24f26d7e8eef10782b7716f422b45a91735c22785985

SHA512
9b35cbfb07526b4bbe7c0fdeea0304e9ca187b21b3d6f53cb5bbba064819207eedcd89011bbecc1a80e4bbbae6086773276f21b9a97643649fffd0f08d17e286

Download Submit
C:\Windows\SysWOW64\Lncjlq32.exe

Filesize
77KB

MD5
d0144b934ad5acdbc4fed07f61b7fea1

SHA1
67ea1172d13ddec7c27965a18992a849419eab5c

SHA256
64108c123241ea3db4ef01057a62f5e07ba30b3b1d2f01ba3a5fde744ef3437b

SHA512
d30ab39c493474b4a968cbc79f2d2ab8bd99354644617aec0bcfe27a2b99f83074cf6faa226237eb0092c6bb4fe2dc1028beb0272bc5ed7e79879934da7ed8fe

Download Submit
C:\Windows\SysWOW64\Lnjnqh32.exe

Filesize
77KB

MD5
2d401fa0d809ef7b799c17b8628a586a

SHA1
f081cf5b420ff68ad4c895f354a6235d1667e5d6

SHA256
89f921c1619ddb20edb6dd5bb7e184f25bbac3c5f11aab99812bfca8d99e1412

SHA512
516be29b14c4fd3ae1bc5d17be45b44af39f21e9fd42b64fd1ecf2806ac1f8ce64e55369e761ee11abea9dfc2e14fd21018d0f78825de4130657ee791a5e29ee

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
77KB

MD5
157e9db324ce127113426676540d2742

SHA1
a474bdce4e2464504839267e0d594b544d66c823

SHA256
1dc74067c704cda85eabb686374c754e82ed5b77373ae6ce8194c6302bf69b00

SHA512
5e144f6cecdb5c71542046297d44dcd207fa6b8cac6fec3845366f72f61ebe652b334a2c969ae15bc3e26a99e3d130e14ba8dab31d893b5461bd2551c2e7afe9

Download Submit
C:\Windows\SysWOW64\Lpgmhg32.exe

Filesize
77KB

MD5
3ec0a78fb979e5c251e1cc7affe18474

SHA1
93aef8f7868455479099b2735c9cb68135127d5e

SHA256
68439b48320ccebaae09541644d2213053382acd7e0a624f4689bc12697f2ced

SHA512
b7e5faaa8f54c659c02a11f9dd5f765df49de2af59a367bb0ad884d05729bbd7ac49ebb7d21450e6f410aa5e554f0fb3d2a6dc57126fb294cfcb7d64817babf6

Download Submit
C:\Windows\SysWOW64\Maggnali.exe

Filesize
77KB

MD5
215a30d154822bd4a4876d9ba79bf75b

SHA1
864d55eba6b571fe2a7d668d15cab24674d9f4ec

SHA256
2e28f6681ac0b0107eddadd08bb732fa3bd7ba78a36b62b4efa05ddbf76fa087

SHA512
797fcdedd872c47c013d1d5e8ed67dca664ba09fc153c6c1d19231e1d448fe696a82f128080e48bde910ead036fcd50c9f656239f64fdd8fbaf2a7027a0b3ec5

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
77KB

MD5
ab73e7699a4ede9dad4e83776f30a6d3

SHA1
dfcf5997555ab486a56168c518253f4d40cf8c90

SHA256
758d8a43c5dad009ec023481cdfdf33a1ba34066fad4ce2f8589c8b49a1a7575

SHA512
3d7163fd05b6e327901f193bed7a5bc307135e4d1f214871d01b9077765a9ec61694db00232a7ef5e192b9f72cac8d50b4911ffab750535b105eb4cb5ed1af2e

Download Submit
C:\Windows\SysWOW64\Mogcihaj.exe

Filesize
77KB

MD5
c8cf294cf276d91d9f94206840fce097

SHA1
1fc81dff32cfb68fa1dca07b83604057cba97990

SHA256
df6418dca9c5484793fc107270469c92824c6a21c1c8d60030eaf9e14fb8d03c

SHA512
be627c2deebcab0b1503aedd87afe2546fa792eab7ea4f9cd03d433e067a8e7012b352b885147e0dd7555c94f3497c92316c12dd700d402b25b70c2c993488e8

Download Submit
C:\Windows\SysWOW64\Ofgdcipq.exe

Filesize
77KB

MD5
a722d7631c62a4a3b568c92e57cd6d3e

SHA1
cd3b44eece9547619da24e69206d0a5c0963f772

SHA256
c14c78335609320b606f2a0a67c66402fcf1198505821656a5b6394468861a9d

SHA512
fe686d427b91b2a691d03144e77a67537adc0b4c661b9b4868c9ae76ad2754a68b5c32d9d07d9c6b1f25edffde84655bc028146b914989c1f47fb798474979b0

Download Submit
C:\Windows\SysWOW64\Olicnfco.exe

Filesize
77KB

MD5
3670192c51f30926cd066c5e533d0bc5

SHA1
4c09eefe5b7d6984c08eab7efc844e8f44141eb8

SHA256
1529313239f862679a8149b4ee0d5cc4fe1234bc83cafe44894d1e375914e22e

SHA512
23008de8eb4fa15e6b18d93b925c707512c1544c19fe9017baa1631b7a36218cab225edca0a8fa07e5a85b5b46b52b1352925d873f5b66dc36e5a2611ee818be

Download Submit
C:\Windows\SysWOW64\Omdieb32.exe

Filesize
77KB

MD5
55740d76a741f8241b49aceb676978a0

SHA1
c4c41728a80d678947fa30cbf8abe473d02b2e35

SHA256
972ba3a941232a10794606e0087ca5bd38c8cfcaeb17dbf05426ca27fc159c90

SHA512
31779352dd0388ae946817241f6d8cabca851502b1850920a59a6804235fde126c84487cf977ca9f482bb1f5f6f3c5883ff11bcd1b8ce91d2d204d274681434b

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
77KB

MD5
6b5f9d7c8395cadf3c53c876e5e957b7

SHA1
fca09111a5bba2895f50a6f974d8c57243ac9793

SHA256
a896c19917294a5c27858b6be08ff5fe64cc87dae65a0c0647172f2f1ba008ae

SHA512
2649e9486615f1ead0812f0607a2da466f59bcb701bd91424647e7b54a485a63981967a632adf90ca5206ab2325c8d91a1e28ede133b12859edb680743e01a27

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
77KB

MD5
55c5115789ed9119b537d9a270f05dfb

SHA1
2b6dc5236a896cf652d62b0358587e15d0d22c56

SHA256
18c6c7ea9e59f1f3ebbb8ba38bfe87fb76eded1c79c34004a9d8787f4dafc2b4

SHA512
ba68d6b796c0c8da597d2b83819671062b7de6371f7ed84b84de5d1b4a28749c3076887811839d65ea94c83b7b42312aa8c5e7abfe30a6f778ebbe4b1d24a28e

Download Submit
C:\Windows\SysWOW64\Pmblagmf.exe

Filesize
77KB

MD5
80b49c42f2cc420de3e09fa3f6457b31

SHA1
e6f6b76d86a7245f8943e1dacce57505aa1f6e96

SHA256
183d2eaf6f8a7c3fe4368d5745ed7b13d011d7230cfd0bd035694bff0510158c

SHA512
45c0829c1987587e6a74e190a5c6b615e3a6f67a92e766412f80416ebda6ae6d05ffcca5c596eaa7655520df9888255aa39cf7e7f6d01eba0119d8b7c0bacdee

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
77KB

MD5
fcbb603b65f09c9444d64b1717df231c

SHA1
b3584b9a7072e876e7bc27a73ff64975d0bb0fe0

SHA256
dbecaade9d415bd2b2f62ec04df724cb23a4b8a95405d2179ecb9cad8f18ed16

SHA512
89178d5fc4319093d27a048a67ecc3f901e8b6a8b3e96f429f3601410cc3ef11db236e2c07f71926bcb67dfd7f33abfebd43c2b328132f41e4106b9b7348763f

Download Submit
C:\Windows\SysWOW64\Pqbala32.exe

Filesize
77KB

MD5
e8429f28732f890507157b85a7caee44

SHA1
1bf21b2fee4ece3c83c64ce38947dcd374a079db

SHA256
fbb5f8370a8db5c34a95bdbe2b1e935883bb84f86a0ea52249aebdee59ab124a

SHA512
c5936b69b2128172fbcbc65d0cbe85b5d8b5ef30c31459440fd7dd4601a83f882a00769c5ecb5d02611ad517ba1cd490c088cee25e6d7a8596d0733c98db5fe3

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
77KB

MD5
0e006f28ba5ff47fc25d6b2163378eec

SHA1
8fb3eba84336df82c015929ea7d7587f06bdebf8

SHA256
4b8a0fe131bdd8457b0729602eef94190cb31c2281154bcf533f304c620759f5

SHA512
7233ebdcd979e3862fee365ddad90ca97d32e70e6a92586eba26177a628e7fc3320ed164caeff415cd206459121a54c68de9c567599d3e244f235ba7103ba9e1

Download Submit
memory/232-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/432-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/444-393-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/628-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/628-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/748-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1052-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1100-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1368-45-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1484-212-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1528-283-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1644-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1684-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1812-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1832-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1992-230-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2180-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2188-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2228-375-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2244-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2260-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2260-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2344-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2348-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2440-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2484-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2492-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2644-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2724-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-589-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-273-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2980-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2988-369-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3024-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-571-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3536-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-198-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3852-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3856-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-267-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4040-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4064-315-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4092-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4116-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4124-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4176-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4300-246-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4308-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4344-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4460-351-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4560-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4592-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-141-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4660-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4660-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4932-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-417-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5124-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5160-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5164-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5204-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5240-592-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5252-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5296-459-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5320-598-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5340-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5380-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5420-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5476-484-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5524-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5584-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5624-502-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5660-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5712-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5760-520-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5796-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5840-532-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5876-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5920-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5964-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6008-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6048-560-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6096-572-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6132-574-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads