c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Size

92KB
MD5

6ffb890f44c2eda9844e30e5d6c5b3f0
SHA1

35136eaab5e0eaf00bf84a07403facc33dbe1583
SHA256

c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f
SHA512

7ac454a2fc0ca3db3128c36370f15440de11ab05d4e16bb74086212aaa53da6d9dbb41d8caae5418a9d91952b99294e6f4a3d9e9725f1be48d588dc94a5f1df5
SSDEEP

1536:VsUE8JqIGzUE+spzv89xW7mVzBy3jLV3BGnMPJKEsztuJO:aUvqIGIETVon+jLlBRh1sN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gepmlimi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkaicd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekngemhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liabjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlicflic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqiec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clpppmqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eimlgnij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqilaplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjomap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcmfnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geflne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nieoal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljleil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djegekil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okceaikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fneoma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahkkhnpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqiipljg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdjhkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldhdlnli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgfdgpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcmgpbjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boklbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjamia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cldjkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpghkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlglidlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbajeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgihop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adnbapjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odifjipd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgfdmlcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfogeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaompd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljfhqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcghkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keekjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkedbmab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmoohe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhmcck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfodmdni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fejlbgek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilphk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfgahikm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oakjnnap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mociol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfcigkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdlfhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcqjal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffjgpj.exe

Executes dropped EXE 64 IoCs

pid	Process
2260	Ahoimd32.exe
2308	Dkgqfl32.exe
1260	Ddgkpp32.exe
1996	Eeidoc32.exe
3816	Eabbjc32.exe
2552	Ekjfcipa.exe
3108	Fkalchij.exe
112	Foabofnn.exe
2256	Fdnjgmle.exe
4664	Gkaejf32.exe
3916	Hodgkc32.exe
4284	Hioiji32.exe
2268	Iejcji32.exe
3124	Jfcbjk32.exe
4976	Kiidgeki.exe
1444	Kdcbom32.exe
4136	Lmppcbjd.exe
3528	Lbabgh32.exe
2472	Mlampmdo.exe
2060	Menjdbgj.exe
3084	Ndaggimg.exe
2064	Npjebj32.exe
3824	Ojllan32.exe
704	Pfhfan32.exe
4728	Pjhlml32.exe
1264	Qffbbldm.exe
4732	Amddjegd.exe
3192	Anfmjhmd.exe
2428	Bjagjhnc.exe
4256	Chokikeb.exe
3564	Cmqmma32.exe
5012	Ddakjkqi.exe
5096	Dkkcge32.exe
4764	Eglgbdep.exe
4528	Fnmepn32.exe
936	Fgjccb32.exe
3700	Gepmlimi.exe
3976	Ggqida32.exe
3464	Hffcmh32.exe
4840	Hfningai.exe
2932	Hninbj32.exe
3204	Ifbbig32.exe
3592	Igcoqocb.exe
1020	Ioopml32.exe
1404	Ibnligoc.exe
3568	Ibpiogmp.exe
4820	Ienekbld.exe
2080	Jkhngl32.exe
2872	Jbbfdfkn.exe
5112	Jgfdmlcm.exe
2496	Kflnfcgg.exe
2380	Khmknk32.exe
3764	Keakgpko.exe
4180	Kfcdfbqo.exe
4204	Lbjelc32.exe
884	Likcilhh.exe
5104	Mpghkf32.exe
4188	Mlpeff32.exe
1004	Mpqkad32.exe
2252	Ngomin32.exe
2540	Nlnbgddc.exe
3104	Oigllh32.exe
3232	Olehhc32.exe
3352	Ocopdn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bhpjjc32.dll	Nffceq32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Cleegp32.exe	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Ojemig32.exe	Ommceclc.exe
File opened for modification	C:\Windows\SysWOW64\Hgmgqc32.exe	Hpcodihc.exe
File opened for modification	C:\Windows\SysWOW64\Ioafchai.exe	Ihgnfnjl.exe
File created	C:\Windows\SysWOW64\Imiagi32.exe	Iglhob32.exe
File opened for modification	C:\Windows\SysWOW64\Cgagjo32.exe	Bnbmqjjo.exe
File opened for modification	C:\Windows\SysWOW64\Gclimi32.exe	Gkeakl32.exe
File opened for modification	C:\Windows\SysWOW64\Qoifflkg.exe	Qljjjqlc.exe
File created	C:\Windows\SysWOW64\Piiqdm32.dll	Dmoohe32.exe
File opened for modification	C:\Windows\SysWOW64\Ckdkhq32.exe	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Qfjcep32.exe	Pbgqdb32.exe
File created	C:\Windows\SysWOW64\Lenjfn32.dll	Iapbodql.exe
File opened for modification	C:\Windows\SysWOW64\Kiomnk32.exe	Kfpqap32.exe
File opened for modification	C:\Windows\SysWOW64\Hcmbee32.exe	Hkpqkcpd.exe
File created	C:\Windows\SysWOW64\Dahceqce.dll	Ganldgib.exe
File created	C:\Windows\SysWOW64\Gbpnjdkg.exe	Gjhfif32.exe
File created	C:\Windows\SysWOW64\Jjgcgo32.exe	Jcmkjeko.exe
File created	C:\Windows\SysWOW64\Lpelqj32.exe	Likcdpop.exe
File created	C:\Windows\SysWOW64\Aglnnkid.exe	Adnbapjp.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Fajgkfio.exe	Fineoi32.exe
File created	C:\Windows\SysWOW64\Gcghkm32.exe	Fbfkceca.exe
File opened for modification	C:\Windows\SysWOW64\Okceaikl.exe	Mccokj32.exe
File opened for modification	C:\Windows\SysWOW64\Abjfqpji.exe	Apkjddke.exe
File created	C:\Windows\SysWOW64\Ggqida32.exe	Gepmlimi.exe
File created	C:\Windows\SysWOW64\Einbcgha.dll	Keakgpko.exe
File created	C:\Windows\SysWOW64\Lbopphio.dll	Oejbfmpg.exe
File opened for modification	C:\Windows\SysWOW64\Acdioc32.exe	Qfjcep32.exe
File opened for modification	C:\Windows\SysWOW64\Ljmmcbdp.exe	Lhopgg32.exe
File created	C:\Windows\SysWOW64\Aanpie32.dll	Aabkbono.exe
File created	C:\Windows\SysWOW64\Gdaejejc.dll	Hligqnjp.exe
File opened for modification	C:\Windows\SysWOW64\Qffbbldm.exe	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Ajndioga.exe	Qkjgegae.exe
File created	C:\Windows\SysWOW64\Ommceclc.exe	Ofckhj32.exe
File created	C:\Windows\SysWOW64\Efmdqkmi.dll	Lbjelc32.exe
File created	C:\Windows\SysWOW64\Jgpmmp32.exe	Jdaaaeqg.exe
File created	C:\Windows\SysWOW64\Bkncfepb.dll	Kcbfcigf.exe
File opened for modification	C:\Windows\SysWOW64\Ajjjjghg.exe	Aglnnkid.exe
File created	C:\Windows\SysWOW64\Bggnijof.exe	Bjcmpepm.exe
File opened for modification	C:\Windows\SysWOW64\Fgjccb32.exe	Fnmepn32.exe
File opened for modification	C:\Windows\SysWOW64\Cleegp32.exe	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Iamlhdea.dll	Dbdano32.exe
File created	C:\Windows\SysWOW64\Nadleilm.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Loacdc32.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Lcelel32.dll	Okcogc32.exe
File created	C:\Windows\SysWOW64\Mffjnc32.exe	Lplaaiqd.exe
File opened for modification	C:\Windows\SysWOW64\Ppdjpcng.exe	Pjjaci32.exe
File opened for modification	C:\Windows\SysWOW64\Jjamia32.exe	Jgcamf32.exe
File created	C:\Windows\SysWOW64\Liqihglg.exe	Lajagj32.exe
File opened for modification	C:\Windows\SysWOW64\Gepmlimi.exe	Fgjccb32.exe
File opened for modification	C:\Windows\SysWOW64\Fnmepn32.exe	Eglgbdep.exe
File opened for modification	C:\Windows\SysWOW64\Dpqodfij.exe	Caienjfd.exe
File created	C:\Windows\SysWOW64\Nplkhf32.exe	Nmnnlk32.exe
File opened for modification	C:\Windows\SysWOW64\Qfbobf32.exe	Qoifflkg.exe
File created	C:\Windows\SysWOW64\Jgkmgk32.exe	Iebngial.exe
File created	C:\Windows\SysWOW64\Bqpbboeg.exe	Bnaffdfc.exe
File created	C:\Windows\SysWOW64\Bemlhj32.exe	Bboplo32.exe
File created	C:\Windows\SysWOW64\Fcqlqnpo.dll	Cejaobel.exe
File created	C:\Windows\SysWOW64\Limpiomm.exe	Lfodmdni.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Gmeakf32.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Loacdc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6524	6224	WerFault.exe	716

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgkmgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcghkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnkbcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Einbcgha.dll"	Keakgpko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldhdlnli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeipof32.dll"	Acpbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfhgcbfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkkekdhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpojkp32.dll"	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igcoqocb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddklbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acdioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmhgp32.dll"	Fgkfqgce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijblcb32.dll"	Libido32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgaiffii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mifnjj32.dll"	Eeidoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oalnaifk.dll"	Fkalchij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afnnnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpjdachc.dll"	Dmihij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khlaie32.dll"	Loacdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knkcmild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemqkk32.dll"	Abpmpkoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbdano32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fejlbgek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npliag32.dll"	Foonjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhagaamj.dll"	Khmknk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckoifgmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckoifgmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcdjba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocmjhfjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffpicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjamia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odlkfe32.dll"	Hlkfbocp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdppaidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbanq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cameci32.dll"	Bfghlhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnkcdoia.dll"	Dlicflic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjccdkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghjhofjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnqmpo32.dll"	Lkkekdhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Memfnodb.dll"	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bboplo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajnpjce.dll"	Imfdaigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhcfleff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkhngl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2260	4616	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	81
PID 4616 wrote to memory of 2260	4616	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	81
PID 4616 wrote to memory of 2260	4616	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	81
PID 2260 wrote to memory of 2308	2260	Ahoimd32.exe	82
PID 2260 wrote to memory of 2308	2260	Ahoimd32.exe	82
PID 2260 wrote to memory of 2308	2260	Ahoimd32.exe	82
PID 2308 wrote to memory of 1260	2308	Dkgqfl32.exe	83
PID 2308 wrote to memory of 1260	2308	Dkgqfl32.exe	83
PID 2308 wrote to memory of 1260	2308	Dkgqfl32.exe	83
PID 1260 wrote to memory of 1996	1260	Ddgkpp32.exe	84
PID 1260 wrote to memory of 1996	1260	Ddgkpp32.exe	84
PID 1260 wrote to memory of 1996	1260	Ddgkpp32.exe	84
PID 1996 wrote to memory of 3816	1996	Eeidoc32.exe	85
PID 1996 wrote to memory of 3816	1996	Eeidoc32.exe	85
PID 1996 wrote to memory of 3816	1996	Eeidoc32.exe	85
PID 3816 wrote to memory of 2552	3816	Eabbjc32.exe	86
PID 3816 wrote to memory of 2552	3816	Eabbjc32.exe	86
PID 3816 wrote to memory of 2552	3816	Eabbjc32.exe	86
PID 2552 wrote to memory of 3108	2552	Ekjfcipa.exe	87
PID 2552 wrote to memory of 3108	2552	Ekjfcipa.exe	87
PID 2552 wrote to memory of 3108	2552	Ekjfcipa.exe	87
PID 3108 wrote to memory of 112	3108	Fkalchij.exe	88
PID 3108 wrote to memory of 112	3108	Fkalchij.exe	88
PID 3108 wrote to memory of 112	3108	Fkalchij.exe	88
PID 112 wrote to memory of 2256	112	Foabofnn.exe	89
PID 112 wrote to memory of 2256	112	Foabofnn.exe	89
PID 112 wrote to memory of 2256	112	Foabofnn.exe	89
PID 2256 wrote to memory of 4664	2256	Fdnjgmle.exe	90
PID 2256 wrote to memory of 4664	2256	Fdnjgmle.exe	90
PID 2256 wrote to memory of 4664	2256	Fdnjgmle.exe	90
PID 4664 wrote to memory of 3916	4664	Gkaejf32.exe	91
PID 4664 wrote to memory of 3916	4664	Gkaejf32.exe	91
PID 4664 wrote to memory of 3916	4664	Gkaejf32.exe	91
PID 3916 wrote to memory of 4284	3916	Hodgkc32.exe	92
PID 3916 wrote to memory of 4284	3916	Hodgkc32.exe	92
PID 3916 wrote to memory of 4284	3916	Hodgkc32.exe	92
PID 4284 wrote to memory of 2268	4284	Hioiji32.exe	93
PID 4284 wrote to memory of 2268	4284	Hioiji32.exe	93
PID 4284 wrote to memory of 2268	4284	Hioiji32.exe	93
PID 2268 wrote to memory of 3124	2268	Iejcji32.exe	94
PID 2268 wrote to memory of 3124	2268	Iejcji32.exe	94
PID 2268 wrote to memory of 3124	2268	Iejcji32.exe	94
PID 3124 wrote to memory of 4976	3124	Jfcbjk32.exe	95
PID 3124 wrote to memory of 4976	3124	Jfcbjk32.exe	95
PID 3124 wrote to memory of 4976	3124	Jfcbjk32.exe	95
PID 4976 wrote to memory of 1444	4976	Kiidgeki.exe	96
PID 4976 wrote to memory of 1444	4976	Kiidgeki.exe	96
PID 4976 wrote to memory of 1444	4976	Kiidgeki.exe	96
PID 1444 wrote to memory of 4136	1444	Kdcbom32.exe	97
PID 1444 wrote to memory of 4136	1444	Kdcbom32.exe	97
PID 1444 wrote to memory of 4136	1444	Kdcbom32.exe	97
PID 4136 wrote to memory of 3528	4136	Lmppcbjd.exe	98
PID 4136 wrote to memory of 3528	4136	Lmppcbjd.exe	98
PID 4136 wrote to memory of 3528	4136	Lmppcbjd.exe	98
PID 3528 wrote to memory of 2472	3528	Lbabgh32.exe	99
PID 3528 wrote to memory of 2472	3528	Lbabgh32.exe	99
PID 3528 wrote to memory of 2472	3528	Lbabgh32.exe	99
PID 2472 wrote to memory of 2060	2472	Mlampmdo.exe	100
PID 2472 wrote to memory of 2060	2472	Mlampmdo.exe	100
PID 2472 wrote to memory of 2060	2472	Mlampmdo.exe	100
PID 2060 wrote to memory of 3084	2060	Menjdbgj.exe	101
PID 2060 wrote to memory of 3084	2060	Menjdbgj.exe	101
PID 2060 wrote to memory of 3084	2060	Menjdbgj.exe	101
PID 3084 wrote to memory of 2064	3084	Ndaggimg.exe	102

C:\Users\Admin\AppData\Local\Temp\c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
"C:\Users\Admin\AppData\Local\Temp\c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\Ahoimd32.exe
  C:\Windows\system32\Ahoimd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\Dkgqfl32.exe
    C:\Windows\system32\Dkgqfl32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\Ddgkpp32.exe
      C:\Windows\system32\Ddgkpp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:112
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        23⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        24⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        25⤵
        Executes dropped EXE
        
        PID:704
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1264
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        28⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        31⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        32⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        33⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        34⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:936
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        39⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        40⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        41⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        42⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        43⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        45⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        46⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        47⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        48⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2080
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        50⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        52⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        55⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        57⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        59⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        60⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        61⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        62⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        63⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        64⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        65⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        66⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        67⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        68⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        69⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        70⤵
        Drops file in System32 directory
        
        PID:3372
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        71⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        72⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        73⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        74⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        75⤵
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        76⤵
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        78⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:832
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2780
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        81⤵
        Drops file in System32 directory
        
        PID:972
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        82⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        83⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        84⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        85⤵
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        86⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        87⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        88⤵
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        89⤵
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        90⤵
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        91⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        93⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        94⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        95⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        96⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        97⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        98⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        99⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        100⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        101⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        102⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2216
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        104⤵
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        106⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        107⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1524
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        109⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        110⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        111⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        112⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        113⤵
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        114⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        115⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        116⤵
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        117⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        118⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        119⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        120⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        121⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        122⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        123⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        125⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        126⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        127⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        128⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        129⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        130⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        131⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        132⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        133⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        134⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        135⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        137⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        138⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        139⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        140⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        141⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        142⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        143⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        144⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        146⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        147⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        148⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        149⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        150⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        151⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        152⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        153⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        154⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        155⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        156⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        157⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        158⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        160⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        161⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        162⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        163⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        164⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        165⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        166⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        167⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        168⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        169⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        170⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        171⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        172⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        173⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        174⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        175⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        176⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        177⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        178⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        179⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        180⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        181⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        182⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        183⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        184⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        185⤵
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        186⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        187⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        188⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        189⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        190⤵
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        191⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4568
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        193⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2808
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1852
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        196⤵
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        197⤵
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        198⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        199⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        201⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        202⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        203⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        204⤵
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        205⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        206⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        207⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        208⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        209⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        210⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        211⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        212⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        213⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        214⤵
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        215⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        216⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        217⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        218⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        219⤵
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        220⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        221⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        222⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        223⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        224⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        225⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        226⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        227⤵
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        228⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        229⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        230⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        231⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        232⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        233⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        234⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        235⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        237⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        238⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        239⤵
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        240⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        241⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        242⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        243⤵
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        244⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        245⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        246⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        247⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        248⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        249⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        250⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        251⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        252⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        253⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        254⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        255⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        256⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:388
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        258⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        259⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        260⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        261⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        262⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        263⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        264⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:560
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        265⤵
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2476
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        267⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        268⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        269⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        270⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        271⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        272⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        273⤵
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        274⤵
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        275⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        276⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        277⤵
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        278⤵
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1008
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4872
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        281⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        282⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        283⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        284⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        285⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        286⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        288⤵
        Drops file in System32 directory
        
        PID:4272
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        289⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        290⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        292⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        293⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        294⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        295⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        296⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        297⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        299⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        300⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        302⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        303⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        304⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        305⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        307⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        309⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        310⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        311⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        312⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        313⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        314⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        315⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        316⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        318⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Gbpnjdkg.exe
        
        C:\Windows\system32\Gbpnjdkg.exe
        319⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        321⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        322⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        323⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        324⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        325⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        326⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        328⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        329⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        330⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        331⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        332⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        333⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        334⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        335⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        336⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        337⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        338⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        339⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        340⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6740
        
        C:\Windows\SysWOW64\Maaekg32.exe
        
        C:\Windows\system32\Maaekg32.exe
        342⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        343⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Mkjjdmaj.exe
        
        C:\Windows\system32\Mkjjdmaj.exe
        344⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        345⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        346⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        347⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        349⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        350⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        351⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        352⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        353⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        354⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        355⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        356⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        357⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        358⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        359⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        360⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        361⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        362⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        363⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        364⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        365⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        366⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        367⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        368⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        369⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Dgfdojfm.exe
        
        C:\Windows\system32\Dgfdojfm.exe
        370⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        371⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ephlnn32.exe
        
        C:\Windows\system32\Ephlnn32.exe
        372⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Egbdjhlp.exe
        
        C:\Windows\system32\Egbdjhlp.exe
        373⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        374⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        375⤵
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        377⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        378⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        379⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        380⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        381⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        382⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        383⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        384⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        385⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        386⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Iglhob32.exe
        
        C:\Windows\system32\Iglhob32.exe
        387⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Imiagi32.exe
        
        C:\Windows\system32\Imiagi32.exe
        388⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        389⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        390⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        391⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        392⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        393⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Iaifbg32.exe
        
        C:\Windows\system32\Iaifbg32.exe
        394⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        395⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        396⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        397⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        398⤵
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Keekjc32.exe
        
        C:\Windows\system32\Keekjc32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5116
        
        C:\Windows\SysWOW64\Khcgfo32.exe
        
        C:\Windows\system32\Khcgfo32.exe
        400⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Kjbdbjbi.exe
        
        C:\Windows\system32\Kjbdbjbi.exe
        401⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        402⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        404⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Kanidd32.exe
        
        C:\Windows\system32\Kanidd32.exe
        405⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Leqkeajd.exe
        
        C:\Windows\system32\Leqkeajd.exe
        406⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        407⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        408⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Lfgahikm.exe
        
        C:\Windows\system32\Lfgahikm.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3964
        
        C:\Windows\SysWOW64\Lmqiec32.exe
        
        C:\Windows\system32\Lmqiec32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3164
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        412⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Mhfmbl32.exe
        
        C:\Windows\system32\Mhfmbl32.exe
        413⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3528
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        415⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Mhmcck32.exe
        
        C:\Windows\system32\Mhmcck32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2032
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        417⤵
        
        PID:424
        
        C:\Windows\SysWOW64\Maehlqch.exe
        
        C:\Windows\system32\Maehlqch.exe
        418⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Mknlef32.exe
        
        C:\Windows\system32\Mknlef32.exe
        419⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        420⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        421⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        422⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        423⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1612
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        426⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        427⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        428⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Qhekaejj.exe
        
        C:\Windows\system32\Qhekaejj.exe
        429⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Qkchna32.exe
        
        C:\Windows\system32\Qkchna32.exe
        430⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Qnbdjl32.exe
        
        C:\Windows\system32\Qnbdjl32.exe
        431⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        432⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        433⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Aoapcood.exe
        
        C:\Windows\system32\Aoapcood.exe
        434⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        435⤵
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        436⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        437⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bbklli32.exe
        
        C:\Windows\system32\Bbklli32.exe
        438⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        439⤵
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        440⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Bkdqdokk.exe
        
        C:\Windows\system32\Bkdqdokk.exe
        441⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Bnbmqjjo.exe
        
        C:\Windows\system32\Bnbmqjjo.exe
        442⤵
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        443⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        444⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        445⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        446⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4904
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        448⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        449⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        450⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        451⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        452⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        453⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3764
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        455⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        456⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        457⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        458⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        460⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        461⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        462⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        463⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        464⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7344
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        466⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        467⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        468⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        469⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        470⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        472⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        473⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        474⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        475⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Gpodkdll.exe
        
        C:\Windows\system32\Gpodkdll.exe
        476⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        477⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        478⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        479⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        480⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        481⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        482⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        483⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hcaibo32.exe
        
        C:\Windows\system32\Hcaibo32.exe
        484⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        485⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        486⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Hfbbdj32.exe
        
        C:\Windows\system32\Hfbbdj32.exe
        487⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hllkqdli.exe
        
        C:\Windows\system32\Hllkqdli.exe
        488⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        489⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        490⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        491⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        493⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        494⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Lhopgg32.exe
        
        C:\Windows\system32\Lhopgg32.exe
        495⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        496⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lmkipncc.exe
        
        C:\Windows\system32\Lmkipncc.exe
        497⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        498⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        499⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Libido32.exe
        
        C:\Windows\system32\Libido32.exe
        500⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        501⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        502⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        503⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        504⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        505⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Mfhgcbfo.exe
        
        C:\Windows\system32\Mfhgcbfo.exe
        506⤵
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        507⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        508⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        509⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        510⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Maeaajpl.exe
        
        C:\Windows\system32\Maeaajpl.exe
        511⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        512⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        513⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        514⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Ndejcemn.exe
        
        C:\Windows\system32\Ndejcemn.exe
        515⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Nfdfoala.exe
        
        C:\Windows\system32\Nfdfoala.exe
        516⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        517⤵
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        518⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Nffceq32.exe
        
        C:\Windows\system32\Nffceq32.exe
        519⤵
        Drops file in System32 directory
        
        PID:1304
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2540
        
        C:\Windows\SysWOW64\Nmpkakak.exe
        
        C:\Windows\system32\Nmpkakak.exe
        521⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        522⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        523⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        524⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3496
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        526⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        527⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        528⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        529⤵
        Drops file in System32 directory
        
        PID:4124
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        530⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        531⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        532⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        534⤵
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        535⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        536⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        538⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3844
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        540⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        541⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        542⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        543⤵
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        544⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        545⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        546⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Bgjjoi32.exe
        
        C:\Windows\system32\Bgjjoi32.exe
        547⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        548⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        549⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        550⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        551⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        552⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        553⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        554⤵
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        555⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        556⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        557⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        558⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        559⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        560⤵
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        561⤵
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        562⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        563⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        564⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        565⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Fongpm32.exe
        
        C:\Windows\system32\Fongpm32.exe
        566⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        567⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Ficlmf32.exe
        
        C:\Windows\system32\Ficlmf32.exe
        568⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Flbhia32.exe
        
        C:\Windows\system32\Flbhia32.exe
        569⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Fblpflfg.exe
        
        C:\Windows\system32\Fblpflfg.exe
        570⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Fejlbgek.exe
        
        C:\Windows\system32\Fejlbgek.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Fhiinbdo.exe
        
        C:\Windows\system32\Fhiinbdo.exe
        572⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Focakm32.exe
        
        C:\Windows\system32\Focakm32.exe
        573⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Faamghko.exe
        
        C:\Windows\system32\Faamghko.exe
        574⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        575⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Fkiapn32.exe
        
        C:\Windows\system32\Fkiapn32.exe
        576⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        577⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Glngep32.exe
        
        C:\Windows\system32\Glngep32.exe
        578⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        579⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2484
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        581⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Gammbfqa.exe
        
        C:\Windows\system32\Gammbfqa.exe
        582⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Ghgeoq32.exe
        
        C:\Windows\system32\Ghgeoq32.exe
        583⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gkeakl32.exe
        
        C:\Windows\system32\Gkeakl32.exe
        584⤵
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        585⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        586⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        587⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        588⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Hikkdc32.exe
        
        C:\Windows\system32\Hikkdc32.exe
        589⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        590⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        591⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        592⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Ieiajckh.exe
        
        C:\Windows\system32\Ieiajckh.exe
        593⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        594⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        595⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Iapbodql.exe
        
        C:\Windows\system32\Iapbodql.exe
        596⤵
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        597⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        598⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        599⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        600⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        601⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Jfikaqme.exe
        
        C:\Windows\system32\Jfikaqme.exe
        602⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        603⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jkfcigkm.exe
        
        C:\Windows\system32\Jkfcigkm.exe
        604⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        605⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        606⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        607⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        608⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        609⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        610⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        611⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        612⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        613⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        614⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Koiejemn.exe
        
        C:\Windows\system32\Koiejemn.exe
        615⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        616⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        617⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Lbenho32.exe
        
        C:\Windows\system32\Lbenho32.exe
        618⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        620⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        621⤵
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        622⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        623⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        624⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Mcggga32.exe
        
        C:\Windows\system32\Mcggga32.exe
        625⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Mjaodkmo.exe
        
        C:\Windows\system32\Mjaodkmo.exe
        626⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        627⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        628⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        629⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6224 -s 400
        630⤵
        Program crash
        
        PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6224 -ip 6224
1⤵
PID:6440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
92KB

MD5
8b5cab9b6e1de50749995fcbbcb525ae

SHA1
449d3640743c898d7c716185d34837ab67fa069e

SHA256
c83bb1d9eadfb958b343a6247ce6d688956e2360f10c7316a030ccc63134d9a2

SHA512
ffbb5cd97019311e2aeb4a286c5c377d2b29795bd0e11e71012b119a75a113ff397b38fd0aba141062989eb1c5e9f170e1a085eaf46d95d1160db2e7808230e9

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
92KB

MD5
8b5cab9b6e1de50749995fcbbcb525ae

SHA1
449d3640743c898d7c716185d34837ab67fa069e

SHA256
c83bb1d9eadfb958b343a6247ce6d688956e2360f10c7316a030ccc63134d9a2

SHA512
ffbb5cd97019311e2aeb4a286c5c377d2b29795bd0e11e71012b119a75a113ff397b38fd0aba141062989eb1c5e9f170e1a085eaf46d95d1160db2e7808230e9

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
92KB

MD5
20a802bf981be02140f49454937f61a2

SHA1
40189a1264a01eeec5b195720e7d541ef406c93d

SHA256
5d1db193d13eaaae4883c9f31f4578f23a21b6a8ef9dfefc4b0cc7bb0a638f38

SHA512
b9ca2eaf246be77def2bd09836108763b8997c7418527bf62a23826584b2186326462ef8ed9d61ed86c5013cc13a461b48e5f1be916aeeffb3a404acd46a553f

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
92KB

MD5
20a802bf981be02140f49454937f61a2

SHA1
40189a1264a01eeec5b195720e7d541ef406c93d

SHA256
5d1db193d13eaaae4883c9f31f4578f23a21b6a8ef9dfefc4b0cc7bb0a638f38

SHA512
b9ca2eaf246be77def2bd09836108763b8997c7418527bf62a23826584b2186326462ef8ed9d61ed86c5013cc13a461b48e5f1be916aeeffb3a404acd46a553f

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
92KB

MD5
695aeb5d4515e4baac60b035d689c0f0

SHA1
8d3b5c707efe51750ef5086666e311cdf9a394b8

SHA256
12d229873654e48806ffc66eca6c1fb31a1188bc332e87c58bed54ff69691e8a

SHA512
12351b0a0682d5c233498c015b37d5ad9988ac91b8f810a1487223553eec58c227142dc9963ed5b49456a7301472459f61a21b74042bbc7b8c4e1f2c1b6f90bc

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
92KB

MD5
695aeb5d4515e4baac60b035d689c0f0

SHA1
8d3b5c707efe51750ef5086666e311cdf9a394b8

SHA256
12d229873654e48806ffc66eca6c1fb31a1188bc332e87c58bed54ff69691e8a

SHA512
12351b0a0682d5c233498c015b37d5ad9988ac91b8f810a1487223553eec58c227142dc9963ed5b49456a7301472459f61a21b74042bbc7b8c4e1f2c1b6f90bc

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
92KB

MD5
7c6d327cea135d2d5474bb32c4056264

SHA1
a6c9e30c08b5bc3c1cc385fdce3b6e5260ad843c

SHA256
72237a8cb9602bc26cd0fd8c65a0bf504e1b054dcac9002220322f067d3b7715

SHA512
64641b109b59fcd4fbee22f1962d32e070d6abb75d79802a48c85168543fae9e0cd44b264c20da1875eaa6556ddbc22716f808b88d83c59b58201b5537cf92b1

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
92KB

MD5
7c6d327cea135d2d5474bb32c4056264

SHA1
a6c9e30c08b5bc3c1cc385fdce3b6e5260ad843c

SHA256
72237a8cb9602bc26cd0fd8c65a0bf504e1b054dcac9002220322f067d3b7715

SHA512
64641b109b59fcd4fbee22f1962d32e070d6abb75d79802a48c85168543fae9e0cd44b264c20da1875eaa6556ddbc22716f808b88d83c59b58201b5537cf92b1

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
92KB

MD5
f6b2b993c3a58d7c967b28f76621ab13

SHA1
89a474e9e431e55aec89243acd24786a0b58c634

SHA256
3d74244497da11e0ea2b0811ad752f553a5ba51b084bc9cba1351c2d8da85687

SHA512
705e3922e3c3da8aac034c00b25914151eba1b37bf677ea2556c34512ff160dacad9d05e5cadbee2d23762b1739e92776953101ad4466d58b41aca68dee10f1e

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
92KB

MD5
f6b2b993c3a58d7c967b28f76621ab13

SHA1
89a474e9e431e55aec89243acd24786a0b58c634

SHA256
3d74244497da11e0ea2b0811ad752f553a5ba51b084bc9cba1351c2d8da85687

SHA512
705e3922e3c3da8aac034c00b25914151eba1b37bf677ea2556c34512ff160dacad9d05e5cadbee2d23762b1739e92776953101ad4466d58b41aca68dee10f1e

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
92KB

MD5
c4377f6d49f99a387ec602dc8cb7195e

SHA1
4b51881a56d29de8c1458ac01fbea41dafd408f8

SHA256
891a1b321fbe6bf39a14869d08bb2c161de4c54802322e38fe72540019f4bcd6

SHA512
ef373dc544009a57799d30398c828d29d3cc0f58897ba2ecb23503a5185242b0f08bfd4e26a9e2082b82859522ae39bfb3985f435135b88c06aa26ed04c3f6be

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
92KB

MD5
c4377f6d49f99a387ec602dc8cb7195e

SHA1
4b51881a56d29de8c1458ac01fbea41dafd408f8

SHA256
891a1b321fbe6bf39a14869d08bb2c161de4c54802322e38fe72540019f4bcd6

SHA512
ef373dc544009a57799d30398c828d29d3cc0f58897ba2ecb23503a5185242b0f08bfd4e26a9e2082b82859522ae39bfb3985f435135b88c06aa26ed04c3f6be

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
92KB

MD5
d6d58f78d332cbf105e5ef1d30ce8211

SHA1
780dabe04e3a98c6110c7041679586208cfa5aad

SHA256
b06b285132a0f5eff82ea9bded7f23fbcbf0f175ed84d6ca36fb4efa6a18ff10

SHA512
39c2324025d0ddd7ea2cb25318f8b575543fb2afa1a03ce0bb1b3d46d6df1bea8fadf0f13df17b723afa4ad259f37e6a0132abf575f5411ee4b35109e01c25c1

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
92KB

MD5
d6d58f78d332cbf105e5ef1d30ce8211

SHA1
780dabe04e3a98c6110c7041679586208cfa5aad

SHA256
b06b285132a0f5eff82ea9bded7f23fbcbf0f175ed84d6ca36fb4efa6a18ff10

SHA512
39c2324025d0ddd7ea2cb25318f8b575543fb2afa1a03ce0bb1b3d46d6df1bea8fadf0f13df17b723afa4ad259f37e6a0132abf575f5411ee4b35109e01c25c1

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
92KB

MD5
e47bc48dd27c444c4768ca81c988f6bc

SHA1
4607937d46e8071af648ac4a31c87e2186672059

SHA256
a61c4c07d20cc9e7912248a28e97d2300665329474660a4e243d4e4786680ae3

SHA512
6a51714f57d284e3147ae19ccd0c5ce528ed69c6a03d6955c7e7254b154ef9203859178f121295281c96124fb53d9c4c3b49eb5c36c3f3ffcbd1464438408a7a

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
92KB

MD5
e47bc48dd27c444c4768ca81c988f6bc

SHA1
4607937d46e8071af648ac4a31c87e2186672059

SHA256
a61c4c07d20cc9e7912248a28e97d2300665329474660a4e243d4e4786680ae3

SHA512
6a51714f57d284e3147ae19ccd0c5ce528ed69c6a03d6955c7e7254b154ef9203859178f121295281c96124fb53d9c4c3b49eb5c36c3f3ffcbd1464438408a7a

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
92KB

MD5
f5c9b94e94f59df2bd65e7eface374aa

SHA1
b83539365bf49746fe593578274da1698d740c00

SHA256
b6680166e486cd3ad11f6a8948064d5cd26fed4512350f519c0d790c7fc7ea95

SHA512
3c27fb65fefe49da9880ec58948625b7a19e979b0028b32454f882432af8e4ddff22f493fa3c7d287b48a7cab32c1b2b9dd4c98e315c54fc44d2abb3d1d75330

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
92KB

MD5
f5c9b94e94f59df2bd65e7eface374aa

SHA1
b83539365bf49746fe593578274da1698d740c00

SHA256
b6680166e486cd3ad11f6a8948064d5cd26fed4512350f519c0d790c7fc7ea95

SHA512
3c27fb65fefe49da9880ec58948625b7a19e979b0028b32454f882432af8e4ddff22f493fa3c7d287b48a7cab32c1b2b9dd4c98e315c54fc44d2abb3d1d75330

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
92KB

MD5
2e9cdb66806ac96bc7c8b86d9991f8e7

SHA1
c8e180b6f5d455ba695f16544e337dfc7d1b2fa0

SHA256
4913d6d61dd544c46416f343656abb23fcb51920d196182f060ecdcde3b2cf6e

SHA512
4cbbd09ff12167ae15be1b402ea2a749fcca6cdf7efe5b32bff3e1c56781277283c9bbf6074a0b03a5409732cfd4b10d6eb7052315eec3b5a615f019b61ddbda

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
92KB

MD5
2e9cdb66806ac96bc7c8b86d9991f8e7

SHA1
c8e180b6f5d455ba695f16544e337dfc7d1b2fa0

SHA256
4913d6d61dd544c46416f343656abb23fcb51920d196182f060ecdcde3b2cf6e

SHA512
4cbbd09ff12167ae15be1b402ea2a749fcca6cdf7efe5b32bff3e1c56781277283c9bbf6074a0b03a5409732cfd4b10d6eb7052315eec3b5a615f019b61ddbda

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
92KB

MD5
371a1427ab034012ecf09c31da786833

SHA1
41d6d2f515507c2445a70d2fa45c7fc45e6a203a

SHA256
974783f15fa87ca10d5e42f2f165c5f87e19db3d402695db02377ea83e09c960

SHA512
c29f58974caf96247e1d45a113e00a876e888eeac2724f8261938b5c2df6b00b8f359f4a98b923f61efba4787eaa2d624bc92d24ec3b007ab170c6e6f01fea57

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
92KB

MD5
371a1427ab034012ecf09c31da786833

SHA1
41d6d2f515507c2445a70d2fa45c7fc45e6a203a

SHA256
974783f15fa87ca10d5e42f2f165c5f87e19db3d402695db02377ea83e09c960

SHA512
c29f58974caf96247e1d45a113e00a876e888eeac2724f8261938b5c2df6b00b8f359f4a98b923f61efba4787eaa2d624bc92d24ec3b007ab170c6e6f01fea57

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
92KB

MD5
bc521dc612c8b981c4f926cdc620278c

SHA1
b2c4313cecd9d2dd7d7c7ac88bfd4455887b96fc

SHA256
8284aae077a7c1c65bc5dc04b347d19c599b35afe1df6700862c120e2be52137

SHA512
673d71dda09f1720f2f7644e112245edd604d68349cd918039f5a957f9e608df6928288b9ebe5b569b07aaed515add8beb29a4ae0b1f4f349ad0d50fdc30ef2a

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
92KB

MD5
bc521dc612c8b981c4f926cdc620278c

SHA1
b2c4313cecd9d2dd7d7c7ac88bfd4455887b96fc

SHA256
8284aae077a7c1c65bc5dc04b347d19c599b35afe1df6700862c120e2be52137

SHA512
673d71dda09f1720f2f7644e112245edd604d68349cd918039f5a957f9e608df6928288b9ebe5b569b07aaed515add8beb29a4ae0b1f4f349ad0d50fdc30ef2a

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
92KB

MD5
7492b0a784b0c1fdc002fbfc0cdfd8a6

SHA1
524386fb909cf177d5cbeaa71763aecc8fbb7115

SHA256
82e40ffa8256b3c26b5743e1699be49141b452083b756df4f266d30544150ee9

SHA512
171e7dda6658acc2dd84b7ce92f12e1b18bcbded2414e7f0d228f992a2e5bff3633231bbfdee07084866155ef6ef62913a2d7efbaa941aefae2530d4678b31ba

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
92KB

MD5
7492b0a784b0c1fdc002fbfc0cdfd8a6

SHA1
524386fb909cf177d5cbeaa71763aecc8fbb7115

SHA256
82e40ffa8256b3c26b5743e1699be49141b452083b756df4f266d30544150ee9

SHA512
171e7dda6658acc2dd84b7ce92f12e1b18bcbded2414e7f0d228f992a2e5bff3633231bbfdee07084866155ef6ef62913a2d7efbaa941aefae2530d4678b31ba

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
92KB

MD5
37e3a8b3f2ae9b493f4588fd48329f7d

SHA1
ea99b0172aea95f70ae235b2c5d9c5284e35d3a0

SHA256
667c88491697404a0709177668f01bde02ab9bd5d738532a7b2255d65b88ae5c

SHA512
6126bc53cb97cd20a1c677978365cab82e53e3918e8241e5c8fa9094df387b25f8c876d4985db2e3d9dce7872019999578d96da604fb9bd53c89b8837476ea55

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
92KB

MD5
37e3a8b3f2ae9b493f4588fd48329f7d

SHA1
ea99b0172aea95f70ae235b2c5d9c5284e35d3a0

SHA256
667c88491697404a0709177668f01bde02ab9bd5d738532a7b2255d65b88ae5c

SHA512
6126bc53cb97cd20a1c677978365cab82e53e3918e8241e5c8fa9094df387b25f8c876d4985db2e3d9dce7872019999578d96da604fb9bd53c89b8837476ea55

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
92KB

MD5
3246ea1a7f4c74ad06f1e4fc53bf2384

SHA1
f3db0b040795e7141b816be64fd0c243d97241b0

SHA256
cc4999cf1b00f9388060e45b44fd3e5ebac53d75f644356a9bea8a1f0adb4c3e

SHA512
b7eb69985a05a5e34d46be6fc49602be68d3bad41ab9f2a01029335422cc43e975b86bb84e4fa646346c8f9b677c45eb441ba33f908c216ecd939b61eacd010a

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
92KB

MD5
3246ea1a7f4c74ad06f1e4fc53bf2384

SHA1
f3db0b040795e7141b816be64fd0c243d97241b0

SHA256
cc4999cf1b00f9388060e45b44fd3e5ebac53d75f644356a9bea8a1f0adb4c3e

SHA512
b7eb69985a05a5e34d46be6fc49602be68d3bad41ab9f2a01029335422cc43e975b86bb84e4fa646346c8f9b677c45eb441ba33f908c216ecd939b61eacd010a

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
92KB

MD5
090ec0b9df813f716879f49f58766e46

SHA1
a6d8f635dc64e18bfbc2ae7f651bb6874c3fe5fe

SHA256
422d098eb83bfaa96bffd5f776e852c4d57a41304453faab149d691a7e3baed2

SHA512
37047bf753105c7a6a070e6a94e2d3d160314b516eb04718437026b62bc2422d2be2a14b221de1a115d8e788eab8f07a81edad20e1edea5b0515e8b5df9c541f

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
92KB

MD5
090ec0b9df813f716879f49f58766e46

SHA1
a6d8f635dc64e18bfbc2ae7f651bb6874c3fe5fe

SHA256
422d098eb83bfaa96bffd5f776e852c4d57a41304453faab149d691a7e3baed2

SHA512
37047bf753105c7a6a070e6a94e2d3d160314b516eb04718437026b62bc2422d2be2a14b221de1a115d8e788eab8f07a81edad20e1edea5b0515e8b5df9c541f

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
92KB

MD5
b4b895f6620592202e29af0fb201d2da

SHA1
60a6583f8eb229c83db2c22e8908d7644d8c3857

SHA256
6aff9c5a2376a7304eb838c4df4509d905fa5f23794025b16532b59039d85fca

SHA512
e7f55c4f466ef05d5f5e371e4602461921c074a798bd2fab05235b489c7192c8b3acd1cbfa02541c89c3c2e676e27d9ce63a8c5603027f3d2985dc7e68f2b54d

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
92KB

MD5
b4b895f6620592202e29af0fb201d2da

SHA1
60a6583f8eb229c83db2c22e8908d7644d8c3857

SHA256
6aff9c5a2376a7304eb838c4df4509d905fa5f23794025b16532b59039d85fca

SHA512
e7f55c4f466ef05d5f5e371e4602461921c074a798bd2fab05235b489c7192c8b3acd1cbfa02541c89c3c2e676e27d9ce63a8c5603027f3d2985dc7e68f2b54d

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
92KB

MD5
f4ee0bd149241d642a42e9080dc83fa0

SHA1
3d0511ffb4aeaaf4739bb89576a49a8e164d4a94

SHA256
809240a53356701402a90645cf417da2bfeea2c67bc9bd53c74f021d61cc69f3

SHA512
d3706df215cc6b70484d36b445b0b90a35962b073ba0ed034677b5f091af81b4ca2adba8c9446f2143d1dba277382c7549818a0586a04be36dcf16c9dc858d79

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
92KB

MD5
f4ee0bd149241d642a42e9080dc83fa0

SHA1
3d0511ffb4aeaaf4739bb89576a49a8e164d4a94

SHA256
809240a53356701402a90645cf417da2bfeea2c67bc9bd53c74f021d61cc69f3

SHA512
d3706df215cc6b70484d36b445b0b90a35962b073ba0ed034677b5f091af81b4ca2adba8c9446f2143d1dba277382c7549818a0586a04be36dcf16c9dc858d79

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
92KB

MD5
a2ef8f64bff3fed7af12744203e9474c

SHA1
53eea92e9444a068dc11d67a2bff23a934d07bb8

SHA256
9e89600489175650b2b0cc4cf21a780b8cb92a4cb88f9cdb34c192611fcd014f

SHA512
4a02b71d22485b21d6c76b95d02c30cf550d3384e4789a1ca2e13344f0000a6efac55208fa6afa5d9a7d68dea3ef0341cd6ac94953d592b820482677f09ff420

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
92KB

MD5
a2ef8f64bff3fed7af12744203e9474c

SHA1
53eea92e9444a068dc11d67a2bff23a934d07bb8

SHA256
9e89600489175650b2b0cc4cf21a780b8cb92a4cb88f9cdb34c192611fcd014f

SHA512
4a02b71d22485b21d6c76b95d02c30cf550d3384e4789a1ca2e13344f0000a6efac55208fa6afa5d9a7d68dea3ef0341cd6ac94953d592b820482677f09ff420

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
92KB

MD5
bfccc876e6607fc5566a7ce897fe4752

SHA1
c64a3adac3e79351e5d70bbe56458de007131ba7

SHA256
69e6d6ab346df5eb0360265fb2acec18a263b105936c0e1516e4f9a46d0801fa

SHA512
0c06de5613b249059467ed18ef8244b88f368f15aabf85b559b8bdcc88de02c44b2f66e20b73781e50e5cf7a8d0b4dbf03007a5210c0c74f142fce7c124701ef

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
92KB

MD5
bfccc876e6607fc5566a7ce897fe4752

SHA1
c64a3adac3e79351e5d70bbe56458de007131ba7

SHA256
69e6d6ab346df5eb0360265fb2acec18a263b105936c0e1516e4f9a46d0801fa

SHA512
0c06de5613b249059467ed18ef8244b88f368f15aabf85b559b8bdcc88de02c44b2f66e20b73781e50e5cf7a8d0b4dbf03007a5210c0c74f142fce7c124701ef

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
92KB

MD5
cbeef79de6e134fef668b69a68cccb62

SHA1
13249bb755bd3fec69824cc11f62eaddc109a9be

SHA256
bdd9b0a05cd0d711bc8ae1a3715d1ceb4c85904cc90e85ba42d2119ec4a3352e

SHA512
d6f48f02ccc6dc42a37a0290a179d83c34353b84d72100441f1f605a04bbe42c959291b7261c1f8d97670a6080ce64cfa46e06bfd1a034c4bd60801adf236c5d

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
92KB

MD5
cbeef79de6e134fef668b69a68cccb62

SHA1
13249bb755bd3fec69824cc11f62eaddc109a9be

SHA256
bdd9b0a05cd0d711bc8ae1a3715d1ceb4c85904cc90e85ba42d2119ec4a3352e

SHA512
d6f48f02ccc6dc42a37a0290a179d83c34353b84d72100441f1f605a04bbe42c959291b7261c1f8d97670a6080ce64cfa46e06bfd1a034c4bd60801adf236c5d

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
92KB

MD5
f3e1d155ca67c185a692b0342097373e

SHA1
970906b37460eb846f48e0797b0bde5dee512808

SHA256
85182545098aa5c816d4aa1591a7f5ec1c47e9a3bdf6b5328d858e8392e98099

SHA512
4c569b3ee99275227dc8b22d31cc244ac626d022457189c920bed75f2cfaf1d37e1d9e1cfd69bf815a8907b9b6341d197ae6c170424e089f79f4bad3eaf5bbaa

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
92KB

MD5
f3e1d155ca67c185a692b0342097373e

SHA1
970906b37460eb846f48e0797b0bde5dee512808

SHA256
85182545098aa5c816d4aa1591a7f5ec1c47e9a3bdf6b5328d858e8392e98099

SHA512
4c569b3ee99275227dc8b22d31cc244ac626d022457189c920bed75f2cfaf1d37e1d9e1cfd69bf815a8907b9b6341d197ae6c170424e089f79f4bad3eaf5bbaa

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
92KB

MD5
daeb04f59fa3b3919b164729330f660d

SHA1
531bc76bdfe94c8281a4ce22705ac40fa39835fd

SHA256
17a4ca276c8d96d49fc535da82e91d9f773fd2e2f5df76fc5377a40ecf79bd9e

SHA512
1f492fb1a5410a1a7f8b5d69b1d670a6fc51b2621c7c778245fb07aa7fcbf655a3dcbb50965ab5006909fe68e22209b97bf7cb9cadbebe6ef67a8596ad3b59b9

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
92KB

MD5
daeb04f59fa3b3919b164729330f660d

SHA1
531bc76bdfe94c8281a4ce22705ac40fa39835fd

SHA256
17a4ca276c8d96d49fc535da82e91d9f773fd2e2f5df76fc5377a40ecf79bd9e

SHA512
1f492fb1a5410a1a7f8b5d69b1d670a6fc51b2621c7c778245fb07aa7fcbf655a3dcbb50965ab5006909fe68e22209b97bf7cb9cadbebe6ef67a8596ad3b59b9

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
92KB

MD5
d695e03aca5af6d85f65df42e70144e2

SHA1
7b342b3d1535d63342eaf2a2c9d9fd80683695d2

SHA256
35ae7d29108d13141b97a952c351ec4e85d6a0672bc258f9f85b95e37eb50aab

SHA512
7e263ca60022038b3b682ef9ba372642b8adb81faf71409a030c389334079224a1d0a991d14ca17972d9f6f370616e11651d71b28ba4c0d409fe4940c9eb1e6f

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
92KB

MD5
d695e03aca5af6d85f65df42e70144e2

SHA1
7b342b3d1535d63342eaf2a2c9d9fd80683695d2

SHA256
35ae7d29108d13141b97a952c351ec4e85d6a0672bc258f9f85b95e37eb50aab

SHA512
7e263ca60022038b3b682ef9ba372642b8adb81faf71409a030c389334079224a1d0a991d14ca17972d9f6f370616e11651d71b28ba4c0d409fe4940c9eb1e6f

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
92KB

MD5
fc28ec3cc508a4d7830020a8b06a3871

SHA1
88a62b29815325d72466479821902c6801767928

SHA256
0a7357cbaeff68815d8ff3c454a8f5f9130fcf6defd2ee1b99c0171a24970ad2

SHA512
4cdaa0d49ded178c2f21860d8cde91073b4b56c6ab9c308a786833601323cadcd3af0a38811562369dc8e22edafd1f5785c24c7806da7bf5b2623e7435410d03

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
92KB

MD5
fc28ec3cc508a4d7830020a8b06a3871

SHA1
88a62b29815325d72466479821902c6801767928

SHA256
0a7357cbaeff68815d8ff3c454a8f5f9130fcf6defd2ee1b99c0171a24970ad2

SHA512
4cdaa0d49ded178c2f21860d8cde91073b4b56c6ab9c308a786833601323cadcd3af0a38811562369dc8e22edafd1f5785c24c7806da7bf5b2623e7435410d03

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
92KB

MD5
1099540a7bca8ede9781099bdc7a4883

SHA1
077adfa38e7dce1ac869ce0c043ca7bcb15446eb

SHA256
fb954fb6d30ee355d5e8ab2429781e7b0b49ded7755fe09efc9e7469bbd1381b

SHA512
b2714f39cb6354ecb6cc8e18c1bd6cfc83d2d052248695b58a1a6f4ffb81a925abd1180220474f2dccdd8be6a705060d84bd2b2394e7704eb6fb0904a36b73c5

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
92KB

MD5
1099540a7bca8ede9781099bdc7a4883

SHA1
077adfa38e7dce1ac869ce0c043ca7bcb15446eb

SHA256
fb954fb6d30ee355d5e8ab2429781e7b0b49ded7755fe09efc9e7469bbd1381b

SHA512
b2714f39cb6354ecb6cc8e18c1bd6cfc83d2d052248695b58a1a6f4ffb81a925abd1180220474f2dccdd8be6a705060d84bd2b2394e7704eb6fb0904a36b73c5

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
92KB

MD5
a82f3c193065863a73d63d82619164ce

SHA1
3dc94710fdd835aae57789ac061d0b888d495789

SHA256
1a130c7a641c6c68e5246a702bcca8157e8f9f2c443c9923eac59c5b07ef55dd

SHA512
7571b075a996e5c320d23b1ed187a88cefe5089ef02f28ce36c3190f55efb6064292226029d6d0764c311e6a2c7171f8e20b974394c7f03bf90ee70887bb6bb6

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
92KB

MD5
a82f3c193065863a73d63d82619164ce

SHA1
3dc94710fdd835aae57789ac061d0b888d495789

SHA256
1a130c7a641c6c68e5246a702bcca8157e8f9f2c443c9923eac59c5b07ef55dd

SHA512
7571b075a996e5c320d23b1ed187a88cefe5089ef02f28ce36c3190f55efb6064292226029d6d0764c311e6a2c7171f8e20b974394c7f03bf90ee70887bb6bb6

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
92KB

MD5
df87ddb0490a8fb3ed427500cdb1f202

SHA1
8d1189052961b36bb206829eb1f80ece72bb6e47

SHA256
bae62c6a5da7d5a1e71750626adf0e708bfe90d7134713857d71a58027971c3e

SHA512
2cc95dce6d73207c6931e4b97f0df14098c4295d959cc285e5cad0dc1a5e40664b36e4565f85b1b1c91c9f3d8281543a3b8007cc441bc17619a0a615ef1813bb

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
92KB

MD5
df87ddb0490a8fb3ed427500cdb1f202

SHA1
8d1189052961b36bb206829eb1f80ece72bb6e47

SHA256
bae62c6a5da7d5a1e71750626adf0e708bfe90d7134713857d71a58027971c3e

SHA512
2cc95dce6d73207c6931e4b97f0df14098c4295d959cc285e5cad0dc1a5e40664b36e4565f85b1b1c91c9f3d8281543a3b8007cc441bc17619a0a615ef1813bb

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
92KB

MD5
7e265b4baef48bf5ab552b1b63f37e10

SHA1
aa8eac38b17fbecd4d1fcacf304a5316033d6fc4

SHA256
e9e0721cdaa459c99b6b4e117c66ecc75f6755af41963fd868fb9e33a6133f34

SHA512
c6bc4dbc1fe1aa5d65dc2e82d569e971473ebdfdf2611cf94f7f0c928c3ecc8cd6082addaab62dc9e23be76b995997828a3e600d97af6dca606f78c34b5bf684

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
92KB

MD5
7e265b4baef48bf5ab552b1b63f37e10

SHA1
aa8eac38b17fbecd4d1fcacf304a5316033d6fc4

SHA256
e9e0721cdaa459c99b6b4e117c66ecc75f6755af41963fd868fb9e33a6133f34

SHA512
c6bc4dbc1fe1aa5d65dc2e82d569e971473ebdfdf2611cf94f7f0c928c3ecc8cd6082addaab62dc9e23be76b995997828a3e600d97af6dca606f78c34b5bf684

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
92KB

MD5
9425713d611a068ed6d4a3056244b99a

SHA1
024506a144144fbd264e811edb3e9f60871e54df

SHA256
631d3b8dc8ccf63563a60fe3c7d1bcf33d50015abe9e7c6638f7efe8a97d3c0e

SHA512
03ba466c6ae3a758bcbb2a93403efae41750487970ce2eb0b133c07e5ed160a97796b8542496432262af820f53a93396e4998ee1e8a2be437ac106e7b0b5731f

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
92KB

MD5
9425713d611a068ed6d4a3056244b99a

SHA1
024506a144144fbd264e811edb3e9f60871e54df

SHA256
631d3b8dc8ccf63563a60fe3c7d1bcf33d50015abe9e7c6638f7efe8a97d3c0e

SHA512
03ba466c6ae3a758bcbb2a93403efae41750487970ce2eb0b133c07e5ed160a97796b8542496432262af820f53a93396e4998ee1e8a2be437ac106e7b0b5731f

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
92KB

MD5
b27ea247ef9d4efc8cf68a751d7daa1e

SHA1
511651f503ab004e5f4c70873ba14b232d43b77c

SHA256
35a59baef615b2676c6924a34c1f04cddc3992812f3ac4a50d7a270aabb55015

SHA512
d4270745502e731350d3233f63f7113ab208c25b3358916bbaf3cdd00d8899ec5afeea2521bc675499131c6457e61e90b9ddea563644c6c0539f0f652476b818

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
92KB

MD5
b27ea247ef9d4efc8cf68a751d7daa1e

SHA1
511651f503ab004e5f4c70873ba14b232d43b77c

SHA256
35a59baef615b2676c6924a34c1f04cddc3992812f3ac4a50d7a270aabb55015

SHA512
d4270745502e731350d3233f63f7113ab208c25b3358916bbaf3cdd00d8899ec5afeea2521bc675499131c6457e61e90b9ddea563644c6c0539f0f652476b818

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
92KB

MD5
ef27d46b2dd335c12a26a32c65752520

SHA1
e7cc4491e4d3d528bbe5c3ae56500bf302016822

SHA256
cb3896f273df52a49bef4c1b4c662e4a056f2152a7040e1badc1d535d9385e17

SHA512
4850323e76d7fbf2554bfcf4c28a0fbbc953a1d12b95988689da1a0d61156dadc69e7d9e1269001892360dca1fd00b106542f826566bb82cd7e2cee477946a1e

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
92KB

MD5
ef27d46b2dd335c12a26a32c65752520

SHA1
e7cc4491e4d3d528bbe5c3ae56500bf302016822

SHA256
cb3896f273df52a49bef4c1b4c662e4a056f2152a7040e1badc1d535d9385e17

SHA512
4850323e76d7fbf2554bfcf4c28a0fbbc953a1d12b95988689da1a0d61156dadc69e7d9e1269001892360dca1fd00b106542f826566bb82cd7e2cee477946a1e

Download Submit
memory/112-164-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/704-234-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/884-311-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/936-271-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1004-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1020-288-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1260-150-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1264-236-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1404-289-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1444-199-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2060-215-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2064-223-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2080-293-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2252-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2256-177-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2260-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2268-187-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2308-149-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2380-302-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2428-248-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2472-214-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2496-301-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2540-321-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2552-162-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2872-299-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2932-285-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3084-216-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3104-322-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3108-163-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3124-188-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3192-247-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3204-286-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3232-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3464-275-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3528-213-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3564-259-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3568-290-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3592-287-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3700-272-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3764-304-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3816-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3824-224-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3916-179-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3976-274-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-200-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4180-305-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4188-313-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4204-310-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4256-258-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4284-180-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4528-266-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4616-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4664-178-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4728-235-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4732-246-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4764-265-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4820-291-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4840-284-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4976-198-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5012-260-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5096-264-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5104-312-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5112-300-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download