8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908

Analysis

max time kernel
69s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe
Size

248KB
MD5

87e1905afd5be25c4dd1e16b28811ec6
SHA1

74d0da5f96c92e203ff95c0d3252858defe28fc2
SHA256

8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908
SHA512

c54c8d6de324b2ab6c23488e5d940df325582c654fa4a2d02a88b3a69fe7ecdb1682cf80997f1990ecbc572cffb7a5c26e5e525ef95e35a61ccd5ecefc6044da
SSDEEP

6144:HZpbwFmvXT83nL0qzdwOSzhrQD2s68RXT83nL0qzdwOSL:DbAew3P+hrYw3P0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efamflbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojkkhbqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faqfclaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnnoojhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gammiakd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjeldlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofohmmeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neokbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaglck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hafieion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olidodei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inflpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaibod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpliae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbaog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aljmgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjlnocoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjdfmmlm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhcmhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nplddj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldfhmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbaohbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdinld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogglbifo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jflgmkee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljjijf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lidofb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Begcad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aofjei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqpfojjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcjpmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gplbjamj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfikgkgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmpoadha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amdilc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlnknlcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djjecf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Immcnlhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eimecapa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilgchg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnahie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emlglo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcfcdinh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkdamgga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gffkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpfgnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkdgen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oplfqbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqkdao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oioanh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjmmlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgjdiha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghdafe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicdcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pijaic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppepag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkdfbij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gopfhofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pijaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkgeqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkmkmhmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbmhikfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmgdda.exe

Executes dropped EXE 64 IoCs

pid	Process
4788	Kcjhaj32.exe
2080	Kejekm32.exe
4792	Knbidbqo.exe
1476	Khknmh32.exe
916	Kacbfnnp.exe
2500	Lmjckocd.exe
5016	Lmlpqnaa.exe
1716	Ldfhmh32.exe
964	Lmnlfn32.exe
4320	Lhdqcg32.exe
2332	Ldkahhei.exe
3896	Lopeeq32.exe
4804	Mkgfkajc.exe
936	Mkicpahq.exe
1756	Mackmkpn.exe
3676	Mdagigoa.exe
2504	Mmjlbl32.exe
2220	Mojhlold.exe
1072	Mgempa32.exe
4688	Nonbgo32.exe
5036	Nehjci32.exe
2008	Nncohk32.exe
1868	Nnfknk32.exe
3740	Ngnpfp32.exe
4268	Neopdhjd.exe
1808	Neamjgha.exe
4324	Oahnohme.exe
1940	Oolnhmlo.exe
1884	Oooknl32.exe
1852	Oeicjfai.exe
4144	Ogjpbo32.exe
3264	Odnplc32.exe
4348	Onfddh32.exe
3636	Pdpmabdo.exe
3488	Pofankdd.exe
3284	Phnega32.exe
3504	Pnknphil.exe
1076	Pdeflb32.exe
1520	Pojjik32.exe
1580	Pfdbfegl.exe
3528	Phcobpfp.exe
4844	Pnpgkg32.exe
4048	Pdipgald.exe
2004	Pnbdpg32.exe
652	Qbpmfe32.exe
3916	Abbile32.exe
3908	Aofjei32.exe
4248	Aiakcn32.exe
4860	Abipmcap.exe
720	Aompfh32.exe
2140	Aejhno32.exe
1228	Bnbmgdda.exe
408	Beledo32.exe
1512	Cnbfnbfo.exe
4484	Cihjkkfe.exe
396	Cnebcadl.exe
1660	Chmglg32.exe
2260	Cngoiabj.exe
4940	Ceagfkjf.exe
4908	Dnjloa32.exe
1836	Deddkkgd.exe
2024	Dlnlhe32.exe
4480	Dbhdeofn.exe
116	Defaak32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eohjlked.dll	Hhhego32.exe
File created	C:\Windows\SysWOW64\Cdghjo32.dll	Jflnga32.exe
File created	C:\Windows\SysWOW64\Fadapnad.dll	Kfhnco32.exe
File created	C:\Windows\SysWOW64\Alkoacpm.dll	Klceqlmg.exe
File created	C:\Windows\SysWOW64\Qgapgjlp.dll	Pfoackfl.exe
File created	C:\Windows\SysWOW64\Eljbcn32.dll	Ccfcfg32.exe
File opened for modification	C:\Windows\SysWOW64\Cjeenqcc.exe	Cggibe32.exe
File created	C:\Windows\SysWOW64\Fnaclk32.exe	Fggkpqgj.exe
File opened for modification	C:\Windows\SysWOW64\Ganljdbj.exe	Gnponhcg.exe
File created	C:\Windows\SysWOW64\Anebbpnk.dll	Qqbfgk32.exe
File created	C:\Windows\SysWOW64\Ialihaog.dll	Ghdafe32.exe
File created	C:\Windows\SysWOW64\Hddeaeoa.exe	Hafieion.exe
File created	C:\Windows\SysWOW64\Ejmdemoh.exe	Egnhibpd.exe
File opened for modification	C:\Windows\SysWOW64\Gccepqii.exe	Gmimcg32.exe
File opened for modification	C:\Windows\SysWOW64\Figocflb.exe	Fbmggl32.exe
File created	C:\Windows\SysWOW64\Pgbkng32.exe	Ppicam32.exe
File created	C:\Windows\SysWOW64\Kkpfjend.dll	Nleaok32.exe
File created	C:\Windows\SysWOW64\Cjhinfdl.exe	Cgjmbkeh.exe
File created	C:\Windows\SysWOW64\Ialaljom.dll	Ganljdbj.exe
File created	C:\Windows\SysWOW64\Edicbnjn.dll	Hhmmameb.exe
File created	C:\Windows\SysWOW64\Icfqop32.dll	Qbpmfe32.exe
File created	C:\Windows\SysWOW64\Lmamioao.dll	Cgcmlb32.exe
File created	C:\Windows\SysWOW64\Clfmcfaj.dll	Nfjeldlp.exe
File created	C:\Windows\SysWOW64\Fmgghm32.exe	Fndglqqp.exe
File created	C:\Windows\SysWOW64\Hefpmo32.dll	Hdfafdlo.exe
File opened for modification	C:\Windows\SysWOW64\Mfnofo32.exe	Modgieke.exe
File created	C:\Windows\SysWOW64\Aigpfe32.exe	Aekdefel.exe
File created	C:\Windows\SysWOW64\Jhpocmpp.dll	Lhiokg32.exe
File created	C:\Windows\SysWOW64\Adnafp32.dll	Bhendgbo.exe
File opened for modification	C:\Windows\SysWOW64\Ebbmfgid.exe	Elieim32.exe
File created	C:\Windows\SysWOW64\Fiheopfd.exe	Fkgeqh32.exe
File opened for modification	C:\Windows\SysWOW64\Mpfcoeib.exe	Mkkgnf32.exe
File created	C:\Windows\SysWOW64\Donmbfgm.exe	Dmoafjhi.exe
File created	C:\Windows\SysWOW64\Nlpmde32.dll	Ehbind32.exe
File created	C:\Windows\SysWOW64\Lpkmgnip.dll	Hebkpn32.exe
File created	C:\Windows\SysWOW64\Bgpjllnc.exe	Bqfaob32.exe
File created	C:\Windows\SysWOW64\Abipmcap.exe	Aiakcn32.exe
File opened for modification	C:\Windows\SysWOW64\Obccfd32.exe	Odabkhig.exe
File created	C:\Windows\SysWOW64\Clbnma32.dll	Cnahie32.exe
File opened for modification	C:\Windows\SysWOW64\Aokook32.exe	Amibgbpg.exe
File created	C:\Windows\SysWOW64\Gmimcg32.exe	Ffodfmjo.exe
File opened for modification	C:\Windows\SysWOW64\Fhnijbng.exe	Fgmlbj32.exe
File created	C:\Windows\SysWOW64\Kongmenq.dll	Gjghjd32.exe
File created	C:\Windows\SysWOW64\Lolfih32.dll	Cnbocl32.exe
File opened for modification	C:\Windows\SysWOW64\Hheagifa.exe	Hchiobhj.exe
File created	C:\Windows\SysWOW64\Akpfqm32.exe	Adfndbil.exe
File created	C:\Windows\SysWOW64\Hkbfinbi.exe	Hhdjmcce.exe
File created	C:\Windows\SysWOW64\Ghppif32.dll	Abaadj32.exe
File opened for modification	C:\Windows\SysWOW64\Mackmkpn.exe	Mkicpahq.exe
File opened for modification	C:\Windows\SysWOW64\Ijlkla32.exe	Ifqolbco.exe
File opened for modification	C:\Windows\SysWOW64\Bhendgbo.exe	Ajdmfpkp.exe
File created	C:\Windows\SysWOW64\Gmliaace.dll	Lfecjg32.exe
File opened for modification	C:\Windows\SysWOW64\Aohbik32.exe	Aepmpe32.exe
File opened for modification	C:\Windows\SysWOW64\Hjmfch32.exe	Hhojgm32.exe
File created	C:\Windows\SysWOW64\Dodffg32.dll	Pnbdpg32.exe
File created	C:\Windows\SysWOW64\Gbhabm32.dll	Chmglg32.exe
File created	C:\Windows\SysWOW64\Opmceo32.exe	Oickidge.exe
File created	C:\Windows\SysWOW64\Cjdfmmlm.exe	Cqlbdhfl.exe
File created	C:\Windows\SysWOW64\Hkbklb32.dll	Hoefnd32.exe
File created	C:\Windows\SysWOW64\Plepgble.dll	Gkggmplf.exe
File created	C:\Windows\SysWOW64\Jocekj32.exe	Jhimopqn.exe
File created	C:\Windows\SysWOW64\Kbkdnd32.exe	Komhah32.exe
File opened for modification	C:\Windows\SysWOW64\Oekknh32.exe	Ooqcanlb.exe
File opened for modification	C:\Windows\SysWOW64\Chmglg32.exe	Cnebcadl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5436	5816	WerFault.exe	970

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmfhqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpngcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkbmim32.dll"	Inflpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pedqog32.dll"	Pocpgnjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jookpjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lialfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npqgbogf.dll"	Pedndg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qoalhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klcniphb.dll"	Epgejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gofnfa32.dll"	Nkboljlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pijaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdhphkin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blpckaod.dll"	Idpdmcdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lialfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plgpqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccfcfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Demgajpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llpomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndliph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hemkjill.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqkdbo32.dll"	Cgdlle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldlidm32.dll"	Gieled32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfkiib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgpcafjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbhncjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcggnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cddjeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diigchld.dll"	Ikecnnpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghhdfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onfddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epehdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiehndeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cackgmil.dll"	Flinpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pilgdm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlkmbbod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchgei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhdqcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aejhno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cqnojg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcabnc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glakkpqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omlkdcaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnecfpfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddgbpkcj.dll"	Hjkinide.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iohljb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npgakcjl.dll"	Egoodhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdejgmgi.dll"	Djohdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmhkqeqm.dll"	Dmoafjhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgmlbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmnifjnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjkikk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgbfoada.dll"	Phddniaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbpfpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npmkoamd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plnfaaba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpjokp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihlal32.dll"	Anhcfoiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnnoojhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fojnll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mimbla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfbnjn32.dll"	Iojbek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpgnekom.dll"	Mihbgkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okeqmq32.dll"	Ahbaog32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4788	4816	8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe	85
PID 4816 wrote to memory of 4788	4816	8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe	85
PID 4816 wrote to memory of 4788	4816	8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe	85
PID 4788 wrote to memory of 2080	4788	Kcjhaj32.exe	86
PID 4788 wrote to memory of 2080	4788	Kcjhaj32.exe	86
PID 4788 wrote to memory of 2080	4788	Kcjhaj32.exe	86
PID 2080 wrote to memory of 4792	2080	Kejekm32.exe	87
PID 2080 wrote to memory of 4792	2080	Kejekm32.exe	87
PID 2080 wrote to memory of 4792	2080	Kejekm32.exe	87
PID 4792 wrote to memory of 1476	4792	Knbidbqo.exe	88
PID 4792 wrote to memory of 1476	4792	Knbidbqo.exe	88
PID 4792 wrote to memory of 1476	4792	Knbidbqo.exe	88
PID 1476 wrote to memory of 916	1476	Khknmh32.exe	89
PID 1476 wrote to memory of 916	1476	Khknmh32.exe	89
PID 1476 wrote to memory of 916	1476	Khknmh32.exe	89
PID 916 wrote to memory of 2500	916	Kacbfnnp.exe	90
PID 916 wrote to memory of 2500	916	Kacbfnnp.exe	90
PID 916 wrote to memory of 2500	916	Kacbfnnp.exe	90
PID 2500 wrote to memory of 5016	2500	Lmjckocd.exe	91
PID 2500 wrote to memory of 5016	2500	Lmjckocd.exe	91
PID 2500 wrote to memory of 5016	2500	Lmjckocd.exe	91
PID 5016 wrote to memory of 1716	5016	Lmlpqnaa.exe	92
PID 5016 wrote to memory of 1716	5016	Lmlpqnaa.exe	92
PID 5016 wrote to memory of 1716	5016	Lmlpqnaa.exe	92
PID 1716 wrote to memory of 964	1716	Ldfhmh32.exe	93
PID 1716 wrote to memory of 964	1716	Ldfhmh32.exe	93
PID 1716 wrote to memory of 964	1716	Ldfhmh32.exe	93
PID 964 wrote to memory of 4320	964	Lmnlfn32.exe	94
PID 964 wrote to memory of 4320	964	Lmnlfn32.exe	94
PID 964 wrote to memory of 4320	964	Lmnlfn32.exe	94
PID 4320 wrote to memory of 2332	4320	Lhdqcg32.exe	95
PID 4320 wrote to memory of 2332	4320	Lhdqcg32.exe	95
PID 4320 wrote to memory of 2332	4320	Lhdqcg32.exe	95
PID 2332 wrote to memory of 3896	2332	Ldkahhei.exe	96
PID 2332 wrote to memory of 3896	2332	Ldkahhei.exe	96
PID 2332 wrote to memory of 3896	2332	Ldkahhei.exe	96
PID 3896 wrote to memory of 4804	3896	Lopeeq32.exe	97
PID 3896 wrote to memory of 4804	3896	Lopeeq32.exe	97
PID 3896 wrote to memory of 4804	3896	Lopeeq32.exe	97
PID 4804 wrote to memory of 936	4804	Mkgfkajc.exe	98
PID 4804 wrote to memory of 936	4804	Mkgfkajc.exe	98
PID 4804 wrote to memory of 936	4804	Mkgfkajc.exe	98
PID 936 wrote to memory of 1756	936	Mkicpahq.exe	99
PID 936 wrote to memory of 1756	936	Mkicpahq.exe	99
PID 936 wrote to memory of 1756	936	Mkicpahq.exe	99
PID 1756 wrote to memory of 3676	1756	Mackmkpn.exe	100
PID 1756 wrote to memory of 3676	1756	Mackmkpn.exe	100
PID 1756 wrote to memory of 3676	1756	Mackmkpn.exe	100
PID 3676 wrote to memory of 2504	3676	Mdagigoa.exe	101
PID 3676 wrote to memory of 2504	3676	Mdagigoa.exe	101
PID 3676 wrote to memory of 2504	3676	Mdagigoa.exe	101
PID 2504 wrote to memory of 2220	2504	Mmjlbl32.exe	102
PID 2504 wrote to memory of 2220	2504	Mmjlbl32.exe	102
PID 2504 wrote to memory of 2220	2504	Mmjlbl32.exe	102
PID 2220 wrote to memory of 1072	2220	Mojhlold.exe	103
PID 2220 wrote to memory of 1072	2220	Mojhlold.exe	103
PID 2220 wrote to memory of 1072	2220	Mojhlold.exe	103
PID 1072 wrote to memory of 4688	1072	Mgempa32.exe	104
PID 1072 wrote to memory of 4688	1072	Mgempa32.exe	104
PID 1072 wrote to memory of 4688	1072	Mgempa32.exe	104
PID 4688 wrote to memory of 5036	4688	Nonbgo32.exe	105
PID 4688 wrote to memory of 5036	4688	Nonbgo32.exe	105
PID 4688 wrote to memory of 5036	4688	Nonbgo32.exe	105
PID 5036 wrote to memory of 2008	5036	Nehjci32.exe	106

C:\Users\Admin\AppData\Local\Temp\8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe
"C:\Users\Admin\AppData\Local\Temp\8cef743a92a922b3b45b6a02660a0fbbb13328a0d6a9e1ffebad51cb88910908.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\Kcjhaj32.exe
  C:\Windows\system32\Kcjhaj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\Kejekm32.exe
    C:\Windows\system32\Kejekm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\SysWOW64\Knbidbqo.exe
      C:\Windows\system32\Knbidbqo.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Windows\SysWOW64\Khknmh32.exe
        
        C:\Windows\system32\Khknmh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Windows\SysWOW64\Kacbfnnp.exe
        
        C:\Windows\system32\Kacbfnnp.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Lmjckocd.exe
        
        C:\Windows\system32\Lmjckocd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Lmlpqnaa.exe
        
        C:\Windows\system32\Lmlpqnaa.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ldfhmh32.exe
        
        C:\Windows\system32\Ldfhmh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Lmnlfn32.exe
        
        C:\Windows\system32\Lmnlfn32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Lhdqcg32.exe
        
        C:\Windows\system32\Lhdqcg32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Ldkahhei.exe
        
        C:\Windows\system32\Ldkahhei.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Lopeeq32.exe
        
        C:\Windows\system32\Lopeeq32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Mkgfkajc.exe
        
        C:\Windows\system32\Mkgfkajc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Mkicpahq.exe
        
        C:\Windows\system32\Mkicpahq.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Mackmkpn.exe
        
        C:\Windows\system32\Mackmkpn.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Mdagigoa.exe
        
        C:\Windows\system32\Mdagigoa.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Mmjlbl32.exe
        
        C:\Windows\system32\Mmjlbl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Mojhlold.exe
        
        C:\Windows\system32\Mojhlold.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Mgempa32.exe
        
        C:\Windows\system32\Mgempa32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Nonbgo32.exe
        
        C:\Windows\system32\Nonbgo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Nehjci32.exe
        
        C:\Windows\system32\Nehjci32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Nncohk32.exe
        
        C:\Windows\system32\Nncohk32.exe
        23⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Nnfknk32.exe
        
        C:\Windows\system32\Nnfknk32.exe
        24⤵
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Ngnpfp32.exe
        
        C:\Windows\system32\Ngnpfp32.exe
        25⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Neopdhjd.exe
        
        C:\Windows\system32\Neopdhjd.exe
        26⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Neamjgha.exe
        
        C:\Windows\system32\Neamjgha.exe
        27⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Oahnohme.exe
        
        C:\Windows\system32\Oahnohme.exe
        28⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Oolnhmlo.exe
        
        C:\Windows\system32\Oolnhmlo.exe
        29⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Oooknl32.exe
        
        C:\Windows\system32\Oooknl32.exe
        30⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Oeicjfai.exe
        
        C:\Windows\system32\Oeicjfai.exe
        31⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Ogjpbo32.exe
        
        C:\Windows\system32\Ogjpbo32.exe
        32⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Odnplc32.exe
        
        C:\Windows\system32\Odnplc32.exe
        33⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Onfddh32.exe
        
        C:\Windows\system32\Onfddh32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Pdpmabdo.exe
        
        C:\Windows\system32\Pdpmabdo.exe
        35⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Pofankdd.exe
        
        C:\Windows\system32\Pofankdd.exe
        36⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Phnega32.exe
        
        C:\Windows\system32\Phnega32.exe
        37⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Pnknphil.exe
        
        C:\Windows\system32\Pnknphil.exe
        38⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Pdeflb32.exe
        
        C:\Windows\system32\Pdeflb32.exe
        39⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Pojjik32.exe
        
        C:\Windows\system32\Pojjik32.exe
        40⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Pfdbfegl.exe
        
        C:\Windows\system32\Pfdbfegl.exe
        41⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Phcobpfp.exe
        
        C:\Windows\system32\Phcobpfp.exe
        42⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Pnpgkg32.exe
        
        C:\Windows\system32\Pnpgkg32.exe
        43⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Pdipgald.exe
        
        C:\Windows\system32\Pdipgald.exe
        44⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Pnbdpg32.exe
        
        C:\Windows\system32\Pnbdpg32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2004
        
        C:\Windows\SysWOW64\Qbpmfe32.exe
        
        C:\Windows\system32\Qbpmfe32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:652
        
        C:\Windows\SysWOW64\Abbile32.exe
        
        C:\Windows\system32\Abbile32.exe
        47⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Aofjei32.exe
        
        C:\Windows\system32\Aofjei32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3908
        
        C:\Windows\SysWOW64\Aiakcn32.exe
        
        C:\Windows\system32\Aiakcn32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\Abipmcap.exe
        
        C:\Windows\system32\Abipmcap.exe
        50⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Aompfh32.exe
        
        C:\Windows\system32\Aompfh32.exe
        51⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Aejhno32.exe
        
        C:\Windows\system32\Aejhno32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Bnbmgdda.exe
        
        C:\Windows\system32\Bnbmgdda.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Beledo32.exe
        
        C:\Windows\system32\Beledo32.exe
        54⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Cnbfnbfo.exe
        
        C:\Windows\system32\Cnbfnbfo.exe
        55⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Cihjkkfe.exe
        
        C:\Windows\system32\Cihjkkfe.exe
        56⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Cnebcadl.exe
        
        C:\Windows\system32\Cnebcadl.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:396
        
        C:\Windows\SysWOW64\Chmglg32.exe
        
        C:\Windows\system32\Chmglg32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Cngoiabj.exe
        
        C:\Windows\system32\Cngoiabj.exe
        59⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Ceagfkjf.exe
        
        C:\Windows\system32\Ceagfkjf.exe
        60⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Dnjloa32.exe
        
        C:\Windows\system32\Dnjloa32.exe
        61⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Deddkkgd.exe
        
        C:\Windows\system32\Deddkkgd.exe
        62⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Dlnlhe32.exe
        
        C:\Windows\system32\Dlnlhe32.exe
        63⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\Dbhdeofn.exe
        
        C:\Windows\system32\Dbhdeofn.exe
        64⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Defaak32.exe
        
        C:\Windows\system32\Defaak32.exe
        65⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Dehnfj32.exe
        
        C:\Windows\system32\Dehnfj32.exe
        66⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Dpnbcc32.exe
        
        C:\Windows\system32\Dpnbcc32.exe
        67⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Dlebid32.exe
        
        C:\Windows\system32\Dlebid32.exe
        68⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Demgajpi.exe
        
        C:\Windows\system32\Demgajpi.exe
        69⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Ehkcneom.exe
        
        C:\Windows\system32\Ehkcneom.exe
        70⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Eoekjo32.exe
        
        C:\Windows\system32\Eoekjo32.exe
        71⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Eeodgimf.exe
        
        C:\Windows\system32\Eeodgimf.exe
        72⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Epehdb32.exe
        
        C:\Windows\system32\Epehdb32.exe
        73⤵
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Ebcdqn32.exe
        
        C:\Windows\system32\Ebcdqn32.exe
        74⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Epgejb32.exe
        
        C:\Windows\system32\Epgejb32.exe
        75⤵
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Efamflbg.exe
        
        C:\Windows\system32\Efamflbg.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4032
        
        C:\Windows\SysWOW64\Ehbind32.exe
        
        C:\Windows\system32\Ehbind32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Ebhnlmhk.exe
        
        C:\Windows\system32\Ebhnlmhk.exe
        78⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Eibfhg32.exe
        
        C:\Windows\system32\Eibfhg32.exe
        79⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Eplneagd.exe
        
        C:\Windows\system32\Eplneagd.exe
        80⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Ebjjamfh.exe
        
        C:\Windows\system32\Ebjjamfh.exe
        81⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Eeifmhel.exe
        
        C:\Windows\system32\Eeifmhel.exe
        82⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Flcojb32.exe
        
        C:\Windows\system32\Flcojb32.exe
        83⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Fbmggl32.exe
        
        C:\Windows\system32\Fbmggl32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\Figocflb.exe
        
        C:\Windows\system32\Figocflb.exe
        85⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Flelpbkf.exe
        
        C:\Windows\system32\Flelpbkf.exe
        86⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Fbodll32.exe
        
        C:\Windows\system32\Fbodll32.exe
        87⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Fhlldc32.exe
        
        C:\Windows\system32\Fhlldc32.exe
        88⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Fofdam32.exe
        
        C:\Windows\system32\Fofdam32.exe
        89⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Fgmlbj32.exe
        
        C:\Windows\system32\Fgmlbj32.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Fhnijbng.exe
        
        C:\Windows\system32\Fhnijbng.exe
        91⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Fcdmgknn.exe
        
        C:\Windows\system32\Fcdmgknn.exe
        92⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Finede32.exe
        
        C:\Windows\system32\Finede32.exe
        93⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Fojnll32.exe
        
        C:\Windows\system32\Fojnll32.exe
        94⤵
        Modifies registry class
        
        PID:3776
        
        C:\Windows\SysWOW64\Glakkpqi.exe
        
        C:\Windows\system32\Glakkpqi.exe
        95⤵
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\Googglpl.exe
        
        C:\Windows\system32\Googglpl.exe
        96⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Ggfohi32.exe
        
        C:\Windows\system32\Ggfohi32.exe
        97⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Gieled32.exe
        
        C:\Windows\system32\Gieled32.exe
        98⤵
        Modifies registry class
        
        PID:676
        
        C:\Windows\SysWOW64\Gpodaogo.exe
        
        C:\Windows\system32\Gpodaogo.exe
        99⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Gcmpnjfc.exe
        
        C:\Windows\system32\Gcmpnjfc.exe
        100⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Gjghjd32.exe
        
        C:\Windows\system32\Gjghjd32.exe
        101⤵
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Ghjhfadj.exe
        
        C:\Windows\system32\Ghjhfadj.exe
        102⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Godqbk32.exe
        
        C:\Windows\system32\Godqbk32.exe
        103⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Genioecd.exe
        
        C:\Windows\system32\Genioecd.exe
        104⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Ghlekq32.exe
        
        C:\Windows\system32\Ghlekq32.exe
        105⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Gofmhkjd.exe
        
        C:\Windows\system32\Gofmhkjd.exe
        106⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Ggmeihjg.exe
        
        C:\Windows\system32\Ggmeihjg.exe
        107⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Hhobap32.exe
        
        C:\Windows\system32\Hhobap32.exe
        108⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Hpfjbn32.exe
        
        C:\Windows\system32\Hpfjbn32.exe
        109⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Hfbbjd32.exe
        
        C:\Windows\system32\Hfbbjd32.exe
        110⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hlmkgo32.exe
        
        C:\Windows\system32\Hlmkgo32.exe
        111⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Hcfcdinh.exe
        
        C:\Windows\system32\Hcfcdinh.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Hjqkqc32.exe
        
        C:\Windows\system32\Hjqkqc32.exe
        113⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Hpjcmmmb.exe
        
        C:\Windows\system32\Hpjcmmmb.exe
        114⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Hcipihle.exe
        
        C:\Windows\system32\Hcipihle.exe
        115⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hhehaojm.exe
        
        C:\Windows\system32\Hhehaojm.exe
        116⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hpmpbm32.exe
        
        C:\Windows\system32\Hpmpbm32.exe
        117⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Hckloh32.exe
        
        C:\Windows\system32\Hckloh32.exe
        118⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Hhhego32.exe
        
        C:\Windows\system32\Hhhego32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Hobmdipg.exe
        
        C:\Windows\system32\Hobmdipg.exe
        120⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Ijgaabom.exe
        
        C:\Windows\system32\Ijgaabom.exe
        121⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ilfmmmnq.exe
        
        C:\Windows\system32\Ilfmmmnq.exe
        122⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Icpfjgfn.exe
        
        C:\Windows\system32\Icpfjgfn.exe
        123⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Imhjcm32.exe
        
        C:\Windows\system32\Imhjcm32.exe
        124⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Icbbpgck.exe
        
        C:\Windows\system32\Icbbpgck.exe
        125⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ifqolbco.exe
        
        C:\Windows\system32\Ifqolbco.exe
        126⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Ijlkla32.exe
        
        C:\Windows\system32\Ijlkla32.exe
        127⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ihokhnbb.exe
        
        C:\Windows\system32\Ihokhnbb.exe
        128⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Iqfcikbd.exe
        
        C:\Windows\system32\Iqfcikbd.exe
        129⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Icdoeg32.exe
        
        C:\Windows\system32\Icdoeg32.exe
        130⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Igpkeeja.exe
        
        C:\Windows\system32\Igpkeeja.exe
        131⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Iiagmn32.exe
        
        C:\Windows\system32\Iiagmn32.exe
        132⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Immcnlhi.exe
        
        C:\Windows\system32\Immcnlhi.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Igbhkeho.exe
        
        C:\Windows\system32\Igbhkeho.exe
        134⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ijadgqgb.exe
        
        C:\Windows\system32\Ijadgqgb.exe
        135⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Iicdcm32.exe
        
        C:\Windows\system32\Iicdcm32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Jjcqmp32.exe
        
        C:\Windows\system32\Jjcqmp32.exe
        137⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Jqmijjlm.exe
        
        C:\Windows\system32\Jqmijjlm.exe
        138⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Jclefflp.exe
        
        C:\Windows\system32\Jclefflp.exe
        139⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Jjembp32.exe
        
        C:\Windows\system32\Jjembp32.exe
        140⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Jqpfojjj.exe
        
        C:\Windows\system32\Jqpfojjj.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Jflnga32.exe
        
        C:\Windows\system32\Jflnga32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Jmffdkpn.exe
        
        C:\Windows\system32\Jmffdkpn.exe
        143⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Jcpoae32.exe
        
        C:\Windows\system32\Jcpoae32.exe
        144⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Jfokmq32.exe
        
        C:\Windows\system32\Jfokmq32.exe
        145⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Jimgil32.exe
        
        C:\Windows\system32\Jimgil32.exe
        146⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Jcbkfe32.exe
        
        C:\Windows\system32\Jcbkfe32.exe
        147⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Jfagbp32.exe
        
        C:\Windows\system32\Jfagbp32.exe
        148⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Jpilkf32.exe
        
        C:\Windows\system32\Jpilkf32.exe
        149⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Kfcdhpbi.exe
        
        C:\Windows\system32\Kfcdhpbi.exe
        150⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Kibqdkam.exe
        
        C:\Windows\system32\Kibqdkam.exe
        151⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Kpliae32.exe
        
        C:\Windows\system32\Kpliae32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Kffanpqf.exe
        
        C:\Windows\system32\Kffanpqf.exe
        153⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Kcjagd32.exe
        
        C:\Windows\system32\Kcjagd32.exe
        154⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Kfhnco32.exe
        
        C:\Windows\system32\Kfhnco32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Lalnafbj.exe
        
        C:\Windows\system32\Lalnafbj.exe
        156⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Mmellgfk.exe
        
        C:\Windows\system32\Mmellgfk.exe
        157⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Mhjpipea.exe
        
        C:\Windows\system32\Mhjpipea.exe
        158⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Millah32.exe
        
        C:\Windows\system32\Millah32.exe
        159⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Mpednbcl.exe
        
        C:\Windows\system32\Mpednbcl.exe
        160⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Mhmmoo32.exe
        
        C:\Windows\system32\Mhmmoo32.exe
        161⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mjkikk32.exe
        
        C:\Windows\system32\Mjkikk32.exe
        162⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Mipflggj.exe
        
        C:\Windows\system32\Mipflggj.exe
        163⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Npmkoamd.exe
        
        C:\Windows\system32\Npmkoamd.exe
        164⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Nkboljlj.exe
        
        C:\Windows\system32\Nkboljlj.exe
        165⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Nalgid32.exe
        
        C:\Windows\system32\Nalgid32.exe
        166⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Nhfoenkd.exe
        
        C:\Windows\system32\Nhfoenkd.exe
        167⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Niglmfab.exe
        
        C:\Windows\system32\Niglmfab.exe
        168⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Npadjp32.exe
        
        C:\Windows\system32\Npadjp32.exe
        169⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Nhhlkn32.exe
        
        C:\Windows\system32\Nhhlkn32.exe
        170⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Naqqdcpb.exe
        
        C:\Windows\system32\Naqqdcpb.exe
        171⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ndompooe.exe
        
        C:\Windows\system32\Ndompooe.exe
        172⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Nilehemm.exe
        
        C:\Windows\system32\Nilehemm.exe
        173⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ndaien32.exe
        
        C:\Windows\system32\Ndaien32.exe
        174⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Nkkabhdp.exe
        
        C:\Windows\system32\Nkkabhdp.exe
        175⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ophjjobg.exe
        
        C:\Windows\system32\Ophjjobg.exe
        176⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Omlkdcaq.exe
        
        C:\Windows\system32\Omlkdcaq.exe
        177⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Odfcqnin.exe
        
        C:\Windows\system32\Odfcqnin.exe
        178⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Oickidge.exe
        
        C:\Windows\system32\Oickidge.exe
        179⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Opmceo32.exe
        
        C:\Windows\system32\Opmceo32.exe
        180⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ogglbifo.exe
        
        C:\Windows\system32\Ogglbifo.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Oiehndeb.exe
        
        C:\Windows\system32\Oiehndeb.exe
        182⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Opopknlo.exe
        
        C:\Windows\system32\Opopknlo.exe
        183⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Odmiam32.exe
        
        C:\Windows\system32\Odmiam32.exe
        184⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Pijaic32.exe
        
        C:\Windows\system32\Pijaic32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Paaikq32.exe
        
        C:\Windows\system32\Paaikq32.exe
        186⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Pgnbcgpf.exe
        
        C:\Windows\system32\Pgnbcgpf.exe
        187⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Pjlnocoj.exe
        
        C:\Windows\system32\Pjlnocoj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Pacfpqpm.exe
        
        C:\Windows\system32\Pacfpqpm.exe
        189⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Pjokdbmg.exe
        
        C:\Windows\system32\Pjokdbmg.exe
        190⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Ppicam32.exe
        
        C:\Windows\system32\Ppicam32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Pgbkng32.exe
        
        C:\Windows\system32\Pgbkng32.exe
        192⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ppkpgmba.exe
        
        C:\Windows\system32\Ppkpgmba.exe
        193⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Pgehcf32.exe
        
        C:\Windows\system32\Pgehcf32.exe
        194⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Pjcdpb32.exe
        
        C:\Windows\system32\Pjcdpb32.exe
        195⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ppmmllpo.exe
        
        C:\Windows\system32\Ppmmllpo.exe
        196⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Phddniaa.exe
        
        C:\Windows\system32\Phddniaa.exe
        197⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Qjfaeagp.exe
        
        C:\Windows\system32\Qjfaeagp.exe
        198⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Qdkebjfe.exe
        
        C:\Windows\system32\Qdkebjfe.exe
        199⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Qgjaofei.exe
        
        C:\Windows\system32\Qgjaofei.exe
        200⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Qqbfgk32.exe
        
        C:\Windows\system32\Qqbfgk32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Aglndecf.exe
        
        C:\Windows\system32\Aglndecf.exe
        202⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Anffapkc.exe
        
        C:\Windows\system32\Anffapkc.exe
        203⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Agnkje32.exe
        
        C:\Windows\system32\Agnkje32.exe
        204⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Anhcfoiq.exe
        
        C:\Windows\system32\Anhcfoiq.exe
        205⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Agqhoe32.exe
        
        C:\Windows\system32\Agqhoe32.exe
        206⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ajodkp32.exe
        
        C:\Windows\system32\Ajodkp32.exe
        207⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Addhiink.exe
        
        C:\Windows\system32\Addhiink.exe
        208⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Abhibmmd.exe
        
        C:\Windows\system32\Abhibmmd.exe
        209⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ahbaog32.exe
        
        C:\Windows\system32\Ahbaog32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Ajdmfpkp.exe
        
        C:\Windows\system32\Ajdmfpkp.exe
        211⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Bhendgbo.exe
        
        C:\Windows\system32\Bhendgbo.exe
        212⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Bjfjlo32.exe
        
        C:\Windows\system32\Bjfjlo32.exe
        213⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Bgjjec32.exe
        
        C:\Windows\system32\Bgjjec32.exe
        214⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Bjhgao32.exe
        
        C:\Windows\system32\Bjhgao32.exe
        215⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Bbpocl32.exe
        
        C:\Windows\system32\Bbpocl32.exe
        216⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bjkcgodg.exe
        
        C:\Windows\system32\Bjkcgodg.exe
        217⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Bqeldi32.exe
        
        C:\Windows\system32\Bqeldi32.exe
        218⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bbdhnlcg.exe
        
        C:\Windows\system32\Bbdhnlcg.exe
        219⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Cgcmlb32.exe
        
        C:\Windows\system32\Cgcmlb32.exe
        220⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Cjbihn32.exe
        
        C:\Windows\system32\Cjbihn32.exe
        221⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Cqlbdhfl.exe
        
        C:\Windows\system32\Cqlbdhfl.exe
        222⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Cjdfmmlm.exe
        
        C:\Windows\system32\Cjdfmmlm.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Cqnojg32.exe
        
        C:\Windows\system32\Cqnojg32.exe
        224⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Ckcbgp32.exe
        
        C:\Windows\system32\Ckcbgp32.exe
        225⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Cnbocl32.exe
        
        C:\Windows\system32\Cnbocl32.exe
        226⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Caqkpg32.exe
        
        C:\Windows\system32\Caqkpg32.exe
        227⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Cgjclaid.exe
        
        C:\Windows\system32\Cgjclaid.exe
        228⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Cndlikqq.exe
        
        C:\Windows\system32\Cndlikqq.exe
        229⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Cachegpd.exe
        
        C:\Windows\system32\Cachegpd.exe
        230⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ckhlbppj.exe
        
        C:\Windows\system32\Ckhlbppj.exe
        231⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Dajnff32.exe
        
        C:\Windows\system32\Dajnff32.exe
        232⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Dgdfbpai.exe
        
        C:\Windows\system32\Dgdfbpai.exe
        233⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Dnnoojhf.exe
        
        C:\Windows\system32\Dnnoojhf.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Dehgld32.exe
        
        C:\Windows\system32\Dehgld32.exe
        235⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Diccmchl.exe
        
        C:\Windows\system32\Diccmchl.exe
        236⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Djdodk32.exe
        
        C:\Windows\system32\Djdodk32.exe
        237⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Dejcad32.exe
        
        C:\Windows\system32\Dejcad32.exe
        238⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dhhpno32.exe
        
        C:\Windows\system32\Dhhpno32.exe
        239⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dnbhjidq.exe
        
        C:\Windows\system32\Dnbhjidq.exe
        240⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eelpgcln.exe
        
        C:\Windows\system32\Eelpgcln.exe
        241⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Elfhdn32.exe
        
        C:\Windows\system32\Elfhdn32.exe
        242⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ebpqqhkg.exe
        
        C:\Windows\system32\Ebpqqhkg.exe
        243⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Eijimb32.exe
        
        C:\Windows\system32\Eijimb32.exe
        244⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Elieim32.exe
        
        C:\Windows\system32\Elieim32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7304
        
        C:\Windows\SysWOW64\Ebbmfgid.exe
        
        C:\Windows\system32\Ebbmfgid.exe
        246⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Eimecapa.exe
        
        C:\Windows\system32\Eimecapa.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Ebggag32.exe
        
        C:\Windows\system32\Ebggag32.exe
        248⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Eefcmbdc.exe
        
        C:\Windows\system32\Eefcmbdc.exe
        249⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Eiaona32.exe
        
        C:\Windows\system32\Eiaona32.exe
        250⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ehdoincf.exe
        
        C:\Windows\system32\Ehdoincf.exe
        251⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Ejbkeibj.exe
        
        C:\Windows\system32\Ejbkeibj.exe
        252⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Eongfh32.exe
        
        C:\Windows\system32\Eongfh32.exe
        253⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Fbjcgfbl.exe
        
        C:\Windows\system32\Fbjcgfbl.exe
        254⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Fehpcbap.exe
        
        C:\Windows\system32\Fehpcbap.exe
        255⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Fhflomad.exe
        
        C:\Windows\system32\Fhflomad.exe
        256⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Flbhpl32.exe
        
        C:\Windows\system32\Flbhpl32.exe
        257⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Foqdlg32.exe
        
        C:\Windows\system32\Foqdlg32.exe
        258⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fblplfqj.exe
        
        C:\Windows\system32\Fblplfqj.exe
        259⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Fejlhapn.exe
        
        C:\Windows\system32\Fejlhapn.exe
        260⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fifhiphg.exe
        
        C:\Windows\system32\Fifhiphg.exe
        261⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fkgeqh32.exe
        
        C:\Windows\system32\Fkgeqh32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Fiheopfd.exe
        
        C:\Windows\system32\Fiheopfd.exe
        263⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Flgakkeh.exe
        
        C:\Windows\system32\Flgakkeh.exe
        264⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Fbqjge32.exe
        
        C:\Windows\system32\Fbqjge32.exe
        265⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Feofca32.exe
        
        C:\Windows\system32\Feofca32.exe
        266⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Flinpk32.exe
        
        C:\Windows\system32\Flinpk32.exe
        267⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Fogjlf32.exe
        
        C:\Windows\system32\Fogjlf32.exe
        268⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Fimojo32.exe
        
        C:\Windows\system32\Fimojo32.exe
        269⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Flkkfk32.exe
        
        C:\Windows\system32\Flkkfk32.exe
        270⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Gbecbeho.exe
        
        C:\Windows\system32\Gbecbeho.exe
        271⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Gedoopgc.exe
        
        C:\Windows\system32\Gedoopgc.exe
        272⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Glngkjop.exe
        
        C:\Windows\system32\Glngkjop.exe
        273⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Goldgfnc.exe
        
        C:\Windows\system32\Goldgfnc.exe
        274⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Giaheoni.exe
        
        C:\Windows\system32\Giaheoni.exe
        275⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Glpdajmm.exe
        
        C:\Windows\system32\Glpdajmm.exe
        276⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Gooqmelq.exe
        
        C:\Windows\system32\Gooqmelq.exe
        277⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Gammiakd.exe
        
        C:\Windows\system32\Gammiakd.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Ghgefk32.exe
        
        C:\Windows\system32\Ghgefk32.exe
        279⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Gkeabf32.exe
        
        C:\Windows\system32\Gkeabf32.exe
        280⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gaoioq32.exe
        
        C:\Windows\system32\Gaoioq32.exe
        281⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ghiakkqo.exe
        
        C:\Windows\system32\Ghiakkqo.exe
        282⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Gkhngfpb.exe
        
        C:\Windows\system32\Gkhngfpb.exe
        283⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Gembeooh.exe
        
        C:\Windows\system32\Gembeooh.exe
        284⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ghlnajol.exe
        
        C:\Windows\system32\Ghlnajol.exe
        285⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Hoefnd32.exe
        
        C:\Windows\system32\Hoefnd32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8108
        
        C:\Windows\SysWOW64\Hcabnc32.exe
        
        C:\Windows\system32\Hcabnc32.exe
        287⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Hhnkfj32.exe
        
        C:\Windows\system32\Hhnkfj32.exe
        288⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Hliggieb.exe
        
        C:\Windows\system32\Hliggieb.exe
        289⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Hohccddf.exe
        
        C:\Windows\system32\Hohccddf.exe
        290⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hebkpn32.exe
        
        C:\Windows\system32\Hebkpn32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Hhphlj32.exe
        
        C:\Windows\system32\Hhphlj32.exe
        292⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Hkodhe32.exe
        
        C:\Windows\system32\Hkodhe32.exe
        293⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Haileo32.exe
        
        C:\Windows\system32\Haileo32.exe
        294⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Hedhenip.exe
        
        C:\Windows\system32\Hedhenip.exe
        295⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Hommnc32.exe
        
        C:\Windows\system32\Hommnc32.exe
        296⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hchiobhj.exe
        
        C:\Windows\system32\Hchiobhj.exe
        297⤵
        Drops file in System32 directory
        
        PID:8224
        
        C:\Windows\SysWOW64\Hheagifa.exe
        
        C:\Windows\system32\Hheagifa.exe
        298⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Hooidc32.exe
        
        C:\Windows\system32\Hooidc32.exe
        299⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Heiaqm32.exe
        
        C:\Windows\system32\Heiaqm32.exe
        300⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Hhgnmi32.exe
        
        C:\Windows\system32\Hhgnmi32.exe
        301⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Ikfjid32.exe
        
        C:\Windows\system32\Ikfjid32.exe
        302⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ioccobji.exe
        
        C:\Windows\system32\Ioccobji.exe
        303⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ienklm32.exe
        
        C:\Windows\system32\Ienklm32.exe
        304⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ilgchg32.exe
        
        C:\Windows\system32\Ilgchg32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Ihndmhnf.exe
        
        C:\Windows\system32\Ihndmhnf.exe
        306⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Iohljb32.exe
        
        C:\Windows\system32\Iohljb32.exe
        307⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Illmcfdm.exe
        
        C:\Windows\system32\Illmcfdm.exe
        308⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Iokipacq.exe
        
        C:\Windows\system32\Iokipacq.exe
        309⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ibielmcd.exe
        
        C:\Windows\system32\Ibielmcd.exe
        310⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ijpmmjcg.exe
        
        C:\Windows\system32\Ijpmmjcg.exe
        311⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Jhcmhg32.exe
        
        C:\Windows\system32\Jhcmhg32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Jkajdb32.exe
        
        C:\Windows\system32\Jkajdb32.exe
        313⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Jchafp32.exe
        
        C:\Windows\system32\Jchafp32.exe
        314⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Jfgnbk32.exe
        
        C:\Windows\system32\Jfgnbk32.exe
        315⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Jhejng32.exe
        
        C:\Windows\system32\Jhejng32.exe
        316⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Jkdfjbgb.exe
        
        C:\Windows\system32\Jkdfjbgb.exe
        317⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Joobka32.exe
        
        C:\Windows\system32\Joobka32.exe
        318⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Jfikgkgh.exe
        
        C:\Windows\system32\Jfikgkgh.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8692
        
        C:\Windows\SysWOW64\Jlccde32.exe
        
        C:\Windows\system32\Jlccde32.exe
        320⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Jcmkaofb.exe
        
        C:\Windows\system32\Jcmkaofb.exe
        321⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Jflgmkee.exe
        
        C:\Windows\system32\Jflgmkee.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Jjgcni32.exe
        
        C:\Windows\system32\Jjgcni32.exe
        323⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Jkhpeacm.exe
        
        C:\Windows\system32\Jkhpeacm.exe
        324⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Jcphfo32.exe
        
        C:\Windows\system32\Jcphfo32.exe
        325⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Jbbhblkj.exe
        
        C:\Windows\system32\Jbbhblkj.exe
        326⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jmhlodjp.exe
        
        C:\Windows\system32\Jmhlodjp.exe
        327⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Jfpqhj32.exe
        
        C:\Windows\system32\Jfpqhj32.exe
        328⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kicfoelo.exe
        
        C:\Windows\system32\Kicfoelo.exe
        329⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Komolo32.exe
        
        C:\Windows\system32\Komolo32.exe
        330⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Kfggii32.exe
        
        C:\Windows\system32\Kfggii32.exe
        331⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kmaoecbe.exe
        
        C:\Windows\system32\Kmaoecbe.exe
        332⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Kopkaoai.exe
        
        C:\Windows\system32\Kopkaoai.exe
        333⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Kfjcni32.exe
        
        C:\Windows\system32\Kfjcni32.exe
        334⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Kkflfp32.exe
        
        C:\Windows\system32\Kkflfp32.exe
        335⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Kflpdhgc.exe
        
        C:\Windows\system32\Kflpdhgc.exe
        336⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lmfhqb32.exe
        
        C:\Windows\system32\Lmfhqb32.exe
        337⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Lbcaii32.exe
        
        C:\Windows\system32\Lbcaii32.exe
        338⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ljjijf32.exe
        
        C:\Windows\system32\Ljjijf32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Lkkeaocg.exe
        
        C:\Windows\system32\Lkkeaocg.exe
        340⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Lbenni32.exe
        
        C:\Windows\system32\Lbenni32.exe
        341⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Ljlepfkg.exe
        
        C:\Windows\system32\Ljlepfkg.exe
        342⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Lmkblajj.exe
        
        C:\Windows\system32\Lmkblajj.exe
        343⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Lbgjdiha.exe
        
        C:\Windows\system32\Lbgjdiha.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8708
        
        C:\Windows\SysWOW64\Lfcfdg32.exe
        
        C:\Windows\system32\Lfcfdg32.exe
        345⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Liabqc32.exe
        
        C:\Windows\system32\Liabqc32.exe
        346⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Llpomn32.exe
        
        C:\Windows\system32\Llpomn32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8876
        
        C:\Windows\SysWOW64\Lcggnl32.exe
        
        C:\Windows\system32\Lcggnl32.exe
        348⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Lfecjg32.exe
        
        C:\Windows\system32\Lfecjg32.exe
        349⤵
        Drops file in System32 directory
        
        PID:8748
        
        C:\Windows\SysWOW64\Lidofb32.exe
        
        C:\Windows\system32\Lidofb32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Lpngcm32.exe
        
        C:\Windows\system32\Lpngcm32.exe
        351⤵
        Modifies registry class
        
        PID:9244
        
        C:\Windows\SysWOW64\Lbldoh32.exe
        
        C:\Windows\system32\Lbldoh32.exe
        352⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Mfhppfme.exe
        
        C:\Windows\system32\Mfhppfme.exe
        353⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Mjclpe32.exe
        
        C:\Windows\system32\Mjclpe32.exe
        354⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Mihiaajf.exe
        
        C:\Windows\system32\Mihiaajf.exe
        355⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Mflikf32.exe
        
        C:\Windows\system32\Mflikf32.exe
        356⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Mikega32.exe
        
        C:\Windows\system32\Mikega32.exe
        357⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Mpencloq.exe
        
        C:\Windows\system32\Mpencloq.exe
        358⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Mfofpe32.exe
        
        C:\Windows\system32\Mfofpe32.exe
        359⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Mimbla32.exe
        
        C:\Windows\system32\Mimbla32.exe
        360⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Mllnhm32.exe
        
        C:\Windows\system32\Mllnhm32.exe
        361⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Mccfjjeg.exe
        
        C:\Windows\system32\Mccfjjeg.exe
        362⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Mjmofd32.exe
        
        C:\Windows\system32\Mjmofd32.exe
        363⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Mlnknlcb.exe
        
        C:\Windows\system32\Mlnknlcb.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9504
        
        C:\Windows\SysWOW64\Nbhckf32.exe
        
        C:\Windows\system32\Nbhckf32.exe
        365⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Njoklc32.exe
        
        C:\Windows\system32\Njoklc32.exe
        366⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Nmmgho32.exe
        
        C:\Windows\system32\Nmmgho32.exe
        367⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Nplddj32.exe
        
        C:\Windows\system32\Nplddj32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Njahacio.exe
        
        C:\Windows\system32\Njahacio.exe
        369⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Nmpdnohb.exe
        
        C:\Windows\system32\Nmpdnohb.exe
        370⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Nbmmfefj.exe
        
        C:\Windows\system32\Nbmmfefj.exe
        371⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Nifebp32.exe
        
        C:\Windows\system32\Nifebp32.exe
        372⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Nleaok32.exe
        
        C:\Windows\system32\Nleaok32.exe
        373⤵
        Drops file in System32 directory
        
        PID:9648
        
        C:\Windows\SysWOW64\Ndliph32.exe
        
        C:\Windows\system32\Ndliph32.exe
        374⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Nfjeldlp.exe
        
        C:\Windows\system32\Nfjeldlp.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Npcjei32.exe
        
        C:\Windows\system32\Npcjei32.exe
        376⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Nbafae32.exe
        
        C:\Windows\system32\Nbafae32.exe
        377⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Nfmbacjn.exe
        
        C:\Windows\system32\Nfmbacjn.exe
        378⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Niknnoia.exe
        
        C:\Windows\system32\Niknnoia.exe
        379⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Nmgjnn32.exe
        
        C:\Windows\system32\Nmgjnn32.exe
        380⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Npefji32.exe
        
        C:\Windows\system32\Npefji32.exe
        381⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Odabkhig.exe
        
        C:\Windows\system32\Odabkhig.exe
        382⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Obccfd32.exe
        
        C:\Windows\system32\Obccfd32.exe
        383⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Ojkkhbqd.exe
        
        C:\Windows\system32\Ojkkhbqd.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Oinkco32.exe
        
        C:\Windows\system32\Oinkco32.exe
        385⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Omigdmph.exe
        
        C:\Windows\system32\Omigdmph.exe
        386⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Opgcpiok.exe
        
        C:\Windows\system32\Opgcpiok.exe
        387⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Odcoqg32.exe
        
        C:\Windows\system32\Odcoqg32.exe
        388⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Obfpldno.exe
        
        C:\Windows\system32\Obfpldno.exe
        389⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Ojmgmaoa.exe
        
        C:\Windows\system32\Ojmgmaoa.exe
        390⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Oiphin32.exe
        
        C:\Windows\system32\Oiphin32.exe
        391⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Olndej32.exe
        
        C:\Windows\system32\Olndej32.exe
        392⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Opjpehmi.exe
        
        C:\Windows\system32\Opjpehmi.exe
        393⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Obhladll.exe
        
        C:\Windows\system32\Obhladll.exe
        394⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ofdhbb32.exe
        
        C:\Windows\system32\Ofdhbb32.exe
        395⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Olqqjibm.exe
        
        C:\Windows\system32\Olqqjibm.exe
        396⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Olcmpiqj.exe
        
        C:\Windows\system32\Olcmpiqj.exe
        397⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Obmfmc32.exe
        
        C:\Windows\system32\Obmfmc32.exe
        398⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Olejei32.exe
        
        C:\Windows\system32\Olejei32.exe
        399⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Pbobbcfd.exe
        
        C:\Windows\system32\Pbobbcfd.exe
        400⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Pkfjcpfg.exe
        
        C:\Windows\system32\Pkfjcpfg.exe
        401⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Plhgkh32.exe
        
        C:\Windows\system32\Plhgkh32.exe
        402⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Pbaohbda.exe
        
        C:\Windows\system32\Pbaohbda.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Pilgdm32.exe
        
        C:\Windows\system32\Pilgdm32.exe
        404⤵
        Modifies registry class
        
        PID:9272
        
        C:\Windows\SysWOW64\Ppepag32.exe
        
        C:\Windows\system32\Ppepag32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2824
        
        C:\Windows\SysWOW64\Pgphnajh.exe
        
        C:\Windows\system32\Pgphnajh.exe
        406⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Pindjlil.exe
        
        C:\Windows\system32\Pindjlil.exe
        407⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Pphlgf32.exe
        
        C:\Windows\system32\Pphlgf32.exe
        408⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Pgbdcqhe.exe
        
        C:\Windows\system32\Pgbdcqhe.exe
        409⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Pipqplgi.exe
        
        C:\Windows\system32\Pipqplgi.exe
        410⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Ppjilfof.exe
        
        C:\Windows\system32\Ppjilfof.exe
        411⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Pciehanj.exe
        
        C:\Windows\system32\Pciehanj.exe
        412⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Pgdaip32.exe
        
        C:\Windows\system32\Pgdaip32.exe
        413⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Pmnifjnp.exe
        
        C:\Windows\system32\Pmnifjnp.exe
        414⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Qgfnop32.exe
        
        C:\Windows\system32\Qgfnop32.exe
        415⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Qiejkk32.exe
        
        C:\Windows\system32\Qiejkk32.exe
        416⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Qlcfgg32.exe
        
        C:\Windows\system32\Qlcfgg32.exe
        417⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Qpobgekq.exe
        
        C:\Windows\system32\Qpobgekq.exe
        418⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Qcmoca32.exe
        
        C:\Windows\system32\Qcmoca32.exe
        419⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Qgikdpbn.exe
        
        C:\Windows\system32\Qgikdpbn.exe
        420⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Qkdgen32.exe
        
        C:\Windows\system32\Qkdgen32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10396
        
        C:\Windows\SysWOW64\Qnccaj32.exe
        
        C:\Windows\system32\Qnccaj32.exe
        422⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Admkndag.exe
        
        C:\Windows\system32\Admkndag.exe
        423⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Agkgjopk.exe
        
        C:\Windows\system32\Agkgjopk.exe
        424⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Alhpbfnb.exe
        
        C:\Windows\system32\Alhpbfnb.exe
        425⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Adohccod.exe
        
        C:\Windows\system32\Adohccod.exe
        426⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Aljmgf32.exe
        
        C:\Windows\system32\Aljmgf32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Acdedpcl.exe
        
        C:\Windows\system32\Acdedpcl.exe
        428⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Aklmemdo.exe
        
        C:\Windows\system32\Aklmemdo.exe
        429⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Aphendbf.exe
        
        C:\Windows\system32\Aphendbf.exe
        430⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Anlfgh32.exe
        
        C:\Windows\system32\Anlfgh32.exe
        431⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Adfndbil.exe
        
        C:\Windows\system32\Adfndbil.exe
        432⤵
        Drops file in System32 directory
        
        PID:10720
        
        C:\Windows\SysWOW64\Akpfqm32.exe
        
        C:\Windows\system32\Akpfqm32.exe
        433⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Bnobmh32.exe
        
        C:\Windows\system32\Bnobmh32.exe
        434⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Bckkeo32.exe
        
        C:\Windows\system32\Bckkeo32.exe
        435⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Bnaobhmj.exe
        
        C:\Windows\system32\Bnaobhmj.exe
        436⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Bpokncln.exe
        
        C:\Windows\system32\Bpokncln.exe
        437⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Bcngjoka.exe
        
        C:\Windows\system32\Bcngjoka.exe
        438⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Bkepllld.exe
        
        C:\Windows\system32\Bkepllld.exe
        439⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Blflcd32.exe
        
        C:\Windows\system32\Blflcd32.exe
        440⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Bdmdda32.exe
        
        C:\Windows\system32\Bdmdda32.exe
        441⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Bcpdpnio.exe
        
        C:\Windows\system32\Bcpdpnio.exe
        442⤵
        
        PID:11000

C:\Windows\SysWOW64\Bkglalja.exe
C:\Windows\system32\Bkglalja.exe
1⤵
PID:11016
- C:\Windows\SysWOW64\Bnfhmg32.exe
  C:\Windows\system32\Bnfhmg32.exe
  2⤵
  PID:11032
- - C:\Windows\SysWOW64\Blhiidpp.exe
    C:\Windows\system32\Blhiidpp.exe
    3⤵
    PID:11048
  - - C:\Windows\SysWOW64\Bdpajaqb.exe
      C:\Windows\system32\Bdpajaqb.exe
      4⤵
      PID:11060
    - - C:\Windows\SysWOW64\Bgnmfmpe.exe
        
        C:\Windows\system32\Bgnmfmpe.exe
        5⤵
        
        PID:11084
      - C:\Windows\SysWOW64\Bkjigk32.exe
        
        C:\Windows\system32\Bkjigk32.exe
        6⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Bqfaob32.exe
        
        C:\Windows\system32\Bqfaob32.exe
        7⤵
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Bgpjllnc.exe
        
        C:\Windows\system32\Bgpjllnc.exe
        8⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Cnjbhfep.exe
        
        C:\Windows\system32\Cnjbhfep.exe
        9⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Cddjeq32.exe
        
        C:\Windows\system32\Cddjeq32.exe
        10⤵
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Cgcfal32.exe
        
        C:\Windows\system32\Cgcfal32.exe
        11⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Cjabmg32.exe
        
        C:\Windows\system32\Cjabmg32.exe
        12⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Cqkkjabq.exe
        
        C:\Windows\system32\Cqkkjabq.exe
        13⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Cdggkp32.exe
        
        C:\Windows\system32\Cdggkp32.exe
        14⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Cgecgl32.exe
        
        C:\Windows\system32\Cgecgl32.exe
        15⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Ckqogjbg.exe
        
        C:\Windows\system32\Ckqogjbg.exe
        16⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Cjcocg32.exe
        
        C:\Windows\system32\Cjcocg32.exe
        17⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Cmblob32.exe
        
        C:\Windows\system32\Cmblob32.exe
        18⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Cdicpphg.exe
        
        C:\Windows\system32\Cdicpphg.exe
        19⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Ccldlm32.exe
        
        C:\Windows\system32\Ccldlm32.exe
        20⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Cjflhggo.exe
        
        C:\Windows\system32\Cjflhggo.exe
        21⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cnahie32.exe
        
        C:\Windows\system32\Cnahie32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10832

C:\Windows\SysWOW64\Cmdhdbfb.exe
C:\Windows\system32\Cmdhdbfb.exe
1⤵
PID:11252
- C:\Windows\SysWOW64\Ccnqal32.exe
  C:\Windows\system32\Ccnqal32.exe
  2⤵
  PID:10492
- - C:\Windows\SysWOW64\Cgjmbkeh.exe
    C:\Windows\system32\Cgjmbkeh.exe
    3⤵
    - Drops file in System32 directory
    PID:11164
  - - C:\Windows\SysWOW64\Cjhinfdl.exe
      C:\Windows\system32\Cjhinfdl.exe
      4⤵
      PID:11268
    - - C:\Windows\SysWOW64\Cndeoe32.exe
        
        C:\Windows\system32\Cndeoe32.exe
        5⤵
        
        PID:11288
      - C:\Windows\SysWOW64\Cqbakq32.exe
        
        C:\Windows\system32\Cqbakq32.exe
        6⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Cdnmko32.exe
        
        C:\Windows\system32\Cdnmko32.exe
        7⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Ccqmglkl.exe
        
        C:\Windows\system32\Ccqmglkl.exe
        8⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Dkhehilo.exe
        
        C:\Windows\system32\Dkhehilo.exe
        9⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Djjecf32.exe
        
        C:\Windows\system32\Djjecf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11396
        
        C:\Windows\SysWOW64\Dqdnppjf.exe
        
        C:\Windows\system32\Dqdnppjf.exe
        11⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Ddpjao32.exe
        
        C:\Windows\system32\Ddpjao32.exe
        12⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Dmkoea32.exe
        
        C:\Windows\system32\Dmkoea32.exe
        13⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Dqkdao32.exe
        
        C:\Windows\system32\Dqkdao32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11472
        
        C:\Windows\SysWOW64\Dcjpmk32.exe
        
        C:\Windows\system32\Dcjpmk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11488
        
        C:\Windows\SysWOW64\Emdakp32.exe
        
        C:\Windows\system32\Emdakp32.exe
        16⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Eelimm32.exe
        
        C:\Windows\system32\Eelimm32.exe
        17⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Egjeii32.exe
        
        C:\Windows\system32\Egjeii32.exe
        18⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Ejhbedfi.exe
        
        C:\Windows\system32\Ejhbedfi.exe
        19⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Emgnapem.exe
        
        C:\Windows\system32\Emgnapem.exe
        20⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Ecafnj32.exe
        
        C:\Windows\system32\Ecafnj32.exe
        21⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Ekhnog32.exe
        
        C:\Windows\system32\Ekhnog32.exe
        22⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Enfjkb32.exe
        
        C:\Windows\system32\Enfjkb32.exe
        23⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Eeqbhmdl.exe
        
        C:\Windows\system32\Eeqbhmdl.exe
        24⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Egoodhcp.exe
        
        C:\Windows\system32\Egoodhcp.exe
        25⤵
        Modifies registry class
        
        PID:11648
        
        C:\Windows\SysWOW64\Ejmkpcbd.exe
        
        C:\Windows\system32\Ejmkpcbd.exe
        26⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Enigqbkm.exe
        
        C:\Windows\system32\Enigqbkm.exe
        27⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Emlglo32.exe
        
        C:\Windows\system32\Emlglo32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11696
        
        C:\Windows\SysWOW64\Eecoml32.exe
        
        C:\Windows\system32\Eecoml32.exe
        29⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Egalih32.exe
        
        C:\Windows\system32\Egalih32.exe
        30⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Ejphec32.exe
        
        C:\Windows\system32\Ejphec32.exe
        31⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Enkdfbij.exe
        
        C:\Windows\system32\Enkdfbij.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11772
        
        C:\Windows\SysWOW64\Eeelcl32.exe
        
        C:\Windows\system32\Eeelcl32.exe
        33⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Echlniga.exe
        
        C:\Windows\system32\Echlniga.exe
        34⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Flodpfgd.exe
        
        C:\Windows\system32\Flodpfgd.exe
        35⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Fnnqla32.exe
        
        C:\Windows\system32\Fnnqla32.exe
        36⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Fmpagnmb.exe
        
        C:\Windows\system32\Fmpagnmb.exe
        37⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Falmhm32.exe
        
        C:\Windows\system32\Falmhm32.exe
        38⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Fcjidh32.exe
        
        C:\Windows\system32\Fcjidh32.exe
        39⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Fjdaqbll.exe
        
        C:\Windows\system32\Fjdaqbll.exe
        40⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Fmbnmnkp.exe
        
        C:\Windows\system32\Fmbnmnkp.exe
        41⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Fejenklb.exe
        
        C:\Windows\system32\Fejenklb.exe
        42⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Fhhbjgke.exe
        
        C:\Windows\system32\Fhhbjgke.exe
        43⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Fldnke32.exe
        
        C:\Windows\system32\Fldnke32.exe
        44⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Fnbjga32.exe
        
        C:\Windows\system32\Fnbjga32.exe
        45⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Fmejbnim.exe
        
        C:\Windows\system32\Fmejbnim.exe
        46⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Faqfclaf.exe
        
        C:\Windows\system32\Faqfclaf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12148
        
        C:\Windows\SysWOW64\Fhkopf32.exe
        
        C:\Windows\system32\Fhkopf32.exe
        48⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Fndglqqp.exe
        
        C:\Windows\system32\Fndglqqp.exe
        49⤵
        Drops file in System32 directory
        
        PID:12188
        
        C:\Windows\SysWOW64\Fmgghm32.exe
        
        C:\Windows\system32\Fmgghm32.exe
        50⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Fngcbpom.exe
        
        C:\Windows\system32\Fngcbpom.exe
        51⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Faepnlnq.exe
        
        C:\Windows\system32\Faepnlnq.exe
        52⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Ghohkfen.exe
        
        C:\Windows\system32\Ghohkfen.exe
        53⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Gmlpcmce.exe
        
        C:\Windows\system32\Gmlpcmce.exe
        54⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Gaglck32.exe
        
        C:\Windows\system32\Gaglck32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11740
        
        C:\Windows\SysWOW64\Gdfipg32.exe
        
        C:\Windows\system32\Gdfipg32.exe
        56⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Glmqad32.exe
        
        C:\Windows\system32\Glmqad32.exe
        57⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Gmnmhlab.exe
        
        C:\Windows\system32\Gmnmhlab.exe
        58⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Gajiik32.exe
        
        C:\Windows\system32\Gajiik32.exe
        59⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Ghdafe32.exe
        
        C:\Windows\system32\Ghdafe32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11952
        
        C:\Windows\SysWOW64\Gmqjnl32.exe
        
        C:\Windows\system32\Gmqjnl32.exe
        61⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Gopfhofb.exe
        
        C:\Windows\system32\Gopfhofb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12116
        
        C:\Windows\SysWOW64\Gaobdjef.exe
        
        C:\Windows\system32\Gaobdjef.exe
        63⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Gdmopfdj.exe
        
        C:\Windows\system32\Gdmopfdj.exe
        64⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Gkggmplf.exe
        
        C:\Windows\system32\Gkggmplf.exe
        65⤵
        Drops file in System32 directory
        
        PID:12232
        
        C:\Windows\SysWOW64\Hemkjill.exe
        
        C:\Windows\system32\Hemkjill.exe
        66⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Hhkgfdkp.exe
        
        C:\Windows\system32\Hhkgfdkp.exe
        67⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Hkicbpjd.exe
        
        C:\Windows\system32\Hkicbpjd.exe
        68⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Hmhpokig.exe
        
        C:\Windows\system32\Hmhpokig.exe
        69⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Hacloj32.exe
        
        C:\Windows\system32\Hacloj32.exe
        70⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Hdahke32.exe
        
        C:\Windows\system32\Hdahke32.exe
        71⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Hlipmbag.exe
        
        C:\Windows\system32\Hlipmbag.exe
        72⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Hmjmdk32.exe
        
        C:\Windows\system32\Hmjmdk32.exe
        73⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Hafieion.exe
        
        C:\Windows\system32\Hafieion.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12432
        
        C:\Windows\SysWOW64\Hddeaeoa.exe
        
        C:\Windows\system32\Hddeaeoa.exe
        75⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Hlkmbbod.exe
        
        C:\Windows\system32\Hlkmbbod.exe
        76⤵
        Modifies registry class
        
        PID:12464
        
        C:\Windows\SysWOW64\Hojinnnh.exe
        
        C:\Windows\system32\Hojinnnh.exe
        77⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Hahejimk.exe
        
        C:\Windows\system32\Hahejimk.exe
        78⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Hdfafdlo.exe
        
        C:\Windows\system32\Hdfafdlo.exe
        79⤵
        Drops file in System32 directory
        
        PID:12520
        
        C:\Windows\SysWOW64\Hhbngc32.exe
        
        C:\Windows\system32\Hhbngc32.exe
        80⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Hkpjcodl.exe
        
        C:\Windows\system32\Hkpjcodl.exe
        81⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Holfdm32.exe
        
        C:\Windows\system32\Holfdm32.exe
        82⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Hajbpi32.exe
        
        C:\Windows\system32\Hajbpi32.exe
        83⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Hdinld32.exe
        
        C:\Windows\system32\Hdinld32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12632
        
        C:\Windows\SysWOW64\Hhdjmcce.exe
        
        C:\Windows\system32\Hhdjmcce.exe
        85⤵
        Drops file in System32 directory
        
        PID:12656
        
        C:\Windows\SysWOW64\Hkbfinbi.exe
        
        C:\Windows\system32\Hkbfinbi.exe
        86⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Iamoeh32.exe
        
        C:\Windows\system32\Iamoeh32.exe
        87⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Idkkad32.exe
        
        C:\Windows\system32\Idkkad32.exe
        88⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Ilbcca32.exe
        
        C:\Windows\system32\Ilbcca32.exe
        89⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Ikecnnpf.exe
        
        C:\Windows\system32\Ikecnnpf.exe
        90⤵
        Modifies registry class
        
        PID:12772
        
        C:\Windows\SysWOW64\Iaokkhgc.exe
        
        C:\Windows\system32\Iaokkhgc.exe
        91⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Ildphqgi.exe
        
        C:\Windows\system32\Ildphqgi.exe
        92⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Ikgpdn32.exe
        
        C:\Windows\system32\Ikgpdn32.exe
        93⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Inflpi32.exe
        
        C:\Windows\system32\Inflpi32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12836
        
        C:\Windows\SysWOW64\Idpdmcdd.exe
        
        C:\Windows\system32\Idpdmcdd.exe
        95⤵
        Modifies registry class
        
        PID:12852
        
        C:\Windows\SysWOW64\Iadefg32.exe
        
        C:\Windows\system32\Iadefg32.exe
        96⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Ihnmcakk.exe
        
        C:\Windows\system32\Ihnmcakk.exe
        97⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Injekhib.exe
        
        C:\Windows\system32\Injekhib.exe
        98⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Ieanleid.exe
        
        C:\Windows\system32\Ieanleid.exe
        99⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Illfip32.exe
        
        C:\Windows\system32\Illfip32.exe
        100⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Iojbek32.exe
        
        C:\Windows\system32\Iojbek32.exe
        101⤵
        Modifies registry class
        
        PID:12948
        
        C:\Windows\SysWOW64\Jahnag32.exe
        
        C:\Windows\system32\Jahnag32.exe
        102⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Jdgjmbnl.exe
        
        C:\Windows\system32\Jdgjmbnl.exe
        103⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Jlnbopoo.exe
        
        C:\Windows\system32\Jlnbopoo.exe
        104⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Jolokknb.exe
        
        C:\Windows\system32\Jolokknb.exe
        105⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Jnoofh32.exe
        
        C:\Windows\system32\Jnoofh32.exe
        106⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Jefgge32.exe
        
        C:\Windows\system32\Jefgge32.exe
        107⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Jlpodoml.exe
        
        C:\Windows\system32\Jlpodoml.exe
        108⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Jookpjlp.exe
        
        C:\Windows\system32\Jookpjlp.exe
        109⤵
        Modifies registry class
        
        PID:13076
        
        C:\Windows\SysWOW64\Jamhlfkc.exe
        
        C:\Windows\system32\Jamhlfkc.exe
        110⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Jhgpipbp.exe
        
        C:\Windows\system32\Jhgpipbp.exe
        111⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Joahfj32.exe
        
        C:\Windows\system32\Joahfj32.exe
        112⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Jekpbdaj.exe
        
        C:\Windows\system32\Jekpbdaj.exe
        113⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Jhimopqn.exe
        
        C:\Windows\system32\Jhimopqn.exe
        114⤵
        Drops file in System32 directory
        
        PID:13156
        
        C:\Windows\SysWOW64\Jocekj32.exe
        
        C:\Windows\system32\Jocekj32.exe
        115⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Jabage32.exe
        
        C:\Windows\system32\Jabage32.exe
        116⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Jdpmcq32.exe
        
        C:\Windows\system32\Jdpmcq32.exe
        117⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Jofaaifh.exe
        
        C:\Windows\system32\Jofaaifh.exe
        118⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Kadnmeek.exe
        
        C:\Windows\system32\Kadnmeek.exe
        119⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Kdbjiqdo.exe
        
        C:\Windows\system32\Kdbjiqdo.exe
        120⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Kljbjnea.exe
        
        C:\Windows\system32\Kljbjnea.exe
        121⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Kklbfj32.exe
        
        C:\Windows\system32\Kklbfj32.exe
        122⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Kafjbdci.exe
        
        C:\Windows\system32\Kafjbdci.exe
        123⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Kllopm32.exe
        
        C:\Windows\system32\Kllopm32.exe
        124⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Knmkgeim.exe
        
        C:\Windows\system32\Knmkgeim.exe
        125⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kfdcicio.exe
        
        C:\Windows\system32\Kfdcicio.exe
        126⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Klnkem32.exe
        
        C:\Windows\system32\Klnkem32.exe
        127⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Komhah32.exe
        
        C:\Windows\system32\Komhah32.exe
        128⤵
        Drops file in System32 directory
        
        PID:12600
        
        C:\Windows\SysWOW64\Kbkdnd32.exe
        
        C:\Windows\system32\Kbkdnd32.exe
        129⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Kheljnfp.exe
        
        C:\Windows\system32\Kheljnfp.exe
        130⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Koodghnm.exe
        
        C:\Windows\system32\Koodghnm.exe
        131⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Kdlmoold.exe
        
        C:\Windows\system32\Kdlmoold.exe
        132⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Klceqlmg.exe
        
        C:\Windows\system32\Klceqlmg.exe
        133⤵
        Drops file in System32 directory
        
        PID:11992
        
        C:\Windows\SysWOW64\Loaamhlj.exe
        
        C:\Windows\system32\Loaamhlj.exe
        134⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Lfkiib32.exe
        
        C:\Windows\system32\Lfkiib32.exe
        135⤵
        Modifies registry class
        
        PID:13248
        
        C:\Windows\SysWOW64\Lhjeem32.exe
        
        C:\Windows\system32\Lhjeem32.exe
        136⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Lodnbg32.exe
        
        C:\Windows\system32\Lodnbg32.exe
        137⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Lbbjnc32.exe
        
        C:\Windows\system32\Lbbjnc32.exe
        138⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Lhlbkmph.exe
        
        C:\Windows\system32\Lhlbkmph.exe
        139⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Lkmkmhmi.exe
        
        C:\Windows\system32\Lkmkmhmi.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Lnkgiclm.exe
        
        C:\Windows\system32\Lnkgiclm.exe
        141⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Lialfl32.exe
        
        C:\Windows\system32\Lialfl32.exe
        142⤵
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Lkohbh32.exe
        
        C:\Windows\system32\Lkohbh32.exe
        143⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Lbipobbc.exe
        
        C:\Windows\system32\Lbipobbc.exe
        144⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Lichll32.exe
        
        C:\Windows\system32\Lichll32.exe
        145⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Lmodlkbi.exe
        
        C:\Windows\system32\Lmodlkbi.exe
        146⤵
        
        PID:204
        
        C:\Windows\SysWOW64\Mkadhg32.exe
        
        C:\Windows\system32\Mkadhg32.exe
        147⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Mnpadc32.exe
        
        C:\Windows\system32\Mnpadc32.exe
        148⤵
        
        PID:13352
        
        C:\Windows\SysWOW64\Mfgiepij.exe
        
        C:\Windows\system32\Mfgiepij.exe
        149⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\Mejiqm32.exe
        
        C:\Windows\system32\Mejiqm32.exe
        150⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Mmaabj32.exe
        
        C:\Windows\system32\Mmaabj32.exe
        151⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\Mkdamgga.exe
        
        C:\Windows\system32\Mkdamgga.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13436
        
        C:\Windows\SysWOW64\Mfiekpgg.exe
        
        C:\Windows\system32\Mfiekpgg.exe
        153⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\Mihbgkfk.exe
        
        C:\Windows\system32\Mihbgkfk.exe
        154⤵
        Modifies registry class
        
        PID:13468
        
        C:\Windows\SysWOW64\Mobjce32.exe
        
        C:\Windows\system32\Mobjce32.exe
        155⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\Mbpfpa32.exe
        
        C:\Windows\system32\Mbpfpa32.exe
        156⤵
        Modifies registry class
        
        PID:13500
        
        C:\Windows\SysWOW64\Meoblllo.exe
        
        C:\Windows\system32\Meoblllo.exe
        157⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\Mmfkmjla.exe
        
        C:\Windows\system32\Mmfkmjla.exe
        158⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\Modgieke.exe
        
        C:\Windows\system32\Modgieke.exe
        159⤵
        Drops file in System32 directory
        
        PID:13548
        
        C:\Windows\SysWOW64\Mfnofo32.exe
        
        C:\Windows\system32\Mfnofo32.exe
        160⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Mkkgnf32.exe
        
        C:\Windows\system32\Mkkgnf32.exe
        161⤵
        Drops file in System32 directory
        
        PID:13580
        
        C:\Windows\SysWOW64\Mpfcoeib.exe
        
        C:\Windows\system32\Mpfcoeib.exe
        162⤵
        
        PID:13596
        
        C:\Windows\SysWOW64\Mfqlko32.exe
        
        C:\Windows\system32\Mfqlko32.exe
        163⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Miohgjpc.exe
        
        C:\Windows\system32\Miohgjpc.exe
        164⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Nnlqpanj.exe
        
        C:\Windows\system32\Nnlqpanj.exe
        165⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Nefilk32.exe
        
        C:\Windows\system32\Nefilk32.exe
        166⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\Nmmqni32.exe
        
        C:\Windows\system32\Nmmqni32.exe
        167⤵
        
        PID:13676
        
        C:\Windows\SysWOW64\Nnnmealg.exe
        
        C:\Windows\system32\Nnnmealg.exe
        168⤵
        
        PID:13692
        
        C:\Windows\SysWOW64\Nlbnoe32.exe
        
        C:\Windows\system32\Nlbnoe32.exe
        169⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Nnpjkq32.exe
        
        C:\Windows\system32\Nnpjkq32.exe
        170⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\Nejbgkaa.exe
        
        C:\Windows\system32\Nejbgkaa.exe
        171⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Nldjde32.exe
        
        C:\Windows\system32\Nldjde32.exe
        172⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\Nnbfpp32.exe
        
        C:\Windows\system32\Nnbfpp32.exe
        173⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Nfjoan32.exe
        
        C:\Windows\system32\Nfjoan32.exe
        174⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Nmdgnhpa.exe
        
        C:\Windows\system32\Nmdgnhpa.exe
        175⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\Nnecfpfp.exe
        
        C:\Windows\system32\Nnecfpfp.exe
        176⤵
        Modifies registry class
        
        PID:13820
        
        C:\Windows\SysWOW64\Nflkgmgb.exe
        
        C:\Windows\system32\Nflkgmgb.exe
        177⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\Neokbj32.exe
        
        C:\Windows\system32\Neokbj32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13872
        
        C:\Windows\SysWOW64\Omfcdg32.exe
        
        C:\Windows\system32\Omfcdg32.exe
        179⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\Olidodei.exe
        
        C:\Windows\system32\Olidodei.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13916
        
        C:\Windows\SysWOW64\Ongpkpdm.exe
        
        C:\Windows\system32\Ongpkpdm.exe
        181⤵
        
        PID:13936
        
        C:\Windows\SysWOW64\Ofohmmeo.exe
        
        C:\Windows\system32\Ofohmmeo.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13956
        
        C:\Windows\SysWOW64\Oeahhj32.exe
        
        C:\Windows\system32\Oeahhj32.exe
        183⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\Oimdihdc.exe
        
        C:\Windows\system32\Oimdihdc.exe
        184⤵
        
        PID:14004
        
        C:\Windows\SysWOW64\Olkqedcf.exe
        
        C:\Windows\system32\Olkqedcf.exe
        185⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Opglebkp.exe
        
        C:\Windows\system32\Opglebkp.exe
        186⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\Ofaebm32.exe
        
        C:\Windows\system32\Ofaebm32.exe
        187⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Oioanh32.exe
        
        C:\Windows\system32\Oioanh32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14080
        
        C:\Windows\SysWOW64\Olnmjc32.exe
        
        C:\Windows\system32\Olnmjc32.exe
        189⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Obhegnhq.exe
        
        C:\Windows\system32\Obhegnhq.exe
        190⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\Oefacigd.exe
        
        C:\Windows\system32\Oefacigd.exe
        191⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Oplfqbgj.exe
        
        C:\Windows\system32\Oplfqbgj.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14156
        
        C:\Windows\SysWOW64\Oehnii32.exe
        
        C:\Windows\system32\Oehnii32.exe
        193⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\Ompfjf32.exe
        
        C:\Windows\system32\Ompfjf32.exe
        194⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\Ooqcanlb.exe
        
        C:\Windows\system32\Ooqcanlb.exe
        195⤵
        Drops file in System32 directory
        
        PID:14204
        
        C:\Windows\SysWOW64\Oekknh32.exe
        
        C:\Windows\system32\Oekknh32.exe
        196⤵
        
        PID:14220
        
        C:\Windows\SysWOW64\Pleckbkl.exe
        
        C:\Windows\system32\Pleckbkl.exe
        197⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\Pocpgnjp.exe
        
        C:\Windows\system32\Pocpgnjp.exe
        198⤵
        Modifies registry class
        
        PID:14252
        
        C:\Windows\SysWOW64\Piiddg32.exe
        
        C:\Windows\system32\Piiddg32.exe
        199⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\Plgpqb32.exe
        
        C:\Windows\system32\Plgpqb32.exe
        200⤵
        Modifies registry class
        
        PID:14284
        
        C:\Windows\SysWOW64\Pbahmlpf.exe
        
        C:\Windows\system32\Pbahmlpf.exe
        201⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\Pikqjf32.exe
        
        C:\Windows\system32\Pikqjf32.exe
        202⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Ppeigqop.exe
        
        C:\Windows\system32\Ppeigqop.exe
        203⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\Pfoackfl.exe
        
        C:\Windows\system32\Pfoackfl.exe
        204⤵
        Drops file in System32 directory
        
        PID:13324
        
        C:\Windows\SysWOW64\Pimmpfep.exe
        
        C:\Windows\system32\Pimmpfep.exe
        205⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Pedndg32.exe
        
        C:\Windows\system32\Pedndg32.exe
        206⤵
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Plnfaaba.exe
        
        C:\Windows\system32\Plnfaaba.exe
        207⤵
        Modifies registry class
        
        PID:13424
        
        C:\Windows\SysWOW64\Polbmmbe.exe
        
        C:\Windows\system32\Polbmmbe.exe
        208⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Pfcjojbg.exe
        
        C:\Windows\system32\Pfcjojbg.exe
        209⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Qlqcga32.exe
        
        C:\Windows\system32\Qlqcga32.exe
        210⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Qplogpih.exe
        
        C:\Windows\system32\Qplogpih.exe
        211⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Qffgdj32.exe
        
        C:\Windows\system32\Qffgdj32.exe
        212⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Qidcpe32.exe
        
        C:\Windows\system32\Qidcpe32.exe
        213⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Qmpoadha.exe
        
        C:\Windows\system32\Qmpoadha.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3676
        
        C:\Windows\SysWOW64\Qoalhl32.exe
        
        C:\Windows\system32\Qoalhl32.exe
        215⤵
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Qbmhikfi.exe
        
        C:\Windows\system32\Qbmhikfi.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2220
        
        C:\Windows\SysWOW64\Aekdefel.exe
        
        C:\Windows\system32\Aekdefel.exe
        217⤵
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Aigpfe32.exe
        
        C:\Windows\system32\Aigpfe32.exe
        218⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\Amblfc32.exe
        
        C:\Windows\system32\Amblfc32.exe
        219⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Aochnllm.exe
        
        C:\Windows\system32\Aochnllm.exe
        220⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Agkqoilo.exe
        
        C:\Windows\system32\Agkqoilo.exe
        221⤵
        
        PID:13984
        
        C:\Windows\SysWOW64\Aiimkdkc.exe
        
        C:\Windows\system32\Aiimkdkc.exe
        222⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Amdilc32.exe
        
        C:\Windows\system32\Amdilc32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14072
        
        C:\Windows\SysWOW64\Algigpkf.exe
        
        C:\Windows\system32\Algigpkf.exe
        224⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Apceho32.exe
        
        C:\Windows\system32\Apceho32.exe
        225⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Abaadj32.exe
        
        C:\Windows\system32\Abaadj32.exe
        226⤵
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\Aepmpe32.exe
        
        C:\Windows\system32\Aepmpe32.exe
        227⤵
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Aohbik32.exe
        
        C:\Windows\system32\Aohbik32.exe
        228⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Amibgbpg.exe
        
        C:\Windows\system32\Amibgbpg.exe
        229⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Aokook32.exe
        
        C:\Windows\system32\Aokook32.exe
        230⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Aedgkema.exe
        
        C:\Windows\system32\Aedgkema.exe
        231⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Alooho32.exe
        
        C:\Windows\system32\Alooho32.exe
        232⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Bchgei32.exe
        
        C:\Windows\system32\Bchgei32.exe
        233⤵
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Begcad32.exe
        
        C:\Windows\system32\Begcad32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4348
        
        C:\Windows\SysWOW64\Blalnobl.exe
        
        C:\Windows\system32\Blalnobl.exe
        235⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Bckdji32.exe
        
        C:\Windows\system32\Bckdji32.exe
        236⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Bielgcae.exe
        
        C:\Windows\system32\Bielgcae.exe
        237⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Blchcnpi.exe
        
        C:\Windows\system32\Blchcnpi.exe
        238⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\Bcmqphhf.exe
        
        C:\Windows\system32\Bcmqphhf.exe
        239⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Bigimb32.exe
        
        C:\Windows\system32\Bigimb32.exe
        240⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Bpaaimgp.exe
        
        C:\Windows\system32\Bpaaimgp.exe
        241⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Bcpmehfc.exe
        
        C:\Windows\system32\Bcpmehfc.exe
        242⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Benjaceg.exe
        
        C:\Windows\system32\Benjaceg.exe
        243⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Bneacaei.exe
        
        C:\Windows\system32\Bneacaei.exe
        244⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Bofnji32.exe
        
        C:\Windows\system32\Bofnji32.exe
        245⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Bepfgc32.exe
        
        C:\Windows\system32\Bepfgc32.exe
        246⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Bjlbhbkn.exe
        
        C:\Windows\system32\Bjlbhbkn.exe
        247⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Bpfkdl32.exe
        
        C:\Windows\system32\Bpfkdl32.exe
        248⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Cgpcafjg.exe
        
        C:\Windows\system32\Cgpcafjg.exe
        249⤵
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Cjnomaik.exe
        
        C:\Windows\system32\Cjnomaik.exe
        250⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Clmkimho.exe
        
        C:\Windows\system32\Clmkimho.exe
        251⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Ccfcfg32.exe
        
        C:\Windows\system32\Ccfcfg32.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Cgbpgf32.exe
        
        C:\Windows\system32\Cgbpgf32.exe
        253⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Cjqlca32.exe
        
        C:\Windows\system32\Cjqlca32.exe
        254⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Cnlhcppa.exe
        
        C:\Windows\system32\Cnlhcppa.exe
        255⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\Clohom32.exe
        
        C:\Windows\system32\Clohom32.exe
        256⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\Comdkh32.exe
        
        C:\Windows\system32\Comdkh32.exe
        257⤵
        
        PID:14388
        
        C:\Windows\SysWOW64\Cgdlle32.exe
        
        C:\Windows\system32\Cgdlle32.exe
        258⤵
        Modifies registry class
        
        PID:14412
        
        C:\Windows\SysWOW64\Cfgmhbml.exe
        
        C:\Windows\system32\Cfgmhbml.exe
        259⤵
        
        PID:14428
        
        C:\Windows\SysWOW64\Cjchha32.exe
        
        C:\Windows\system32\Cjchha32.exe
        260⤵
        
        PID:14456
        
        C:\Windows\SysWOW64\Claedl32.exe
        
        C:\Windows\system32\Claedl32.exe
        261⤵
        
        PID:14480
        
        C:\Windows\SysWOW64\Cpmqekmb.exe
        
        C:\Windows\system32\Cpmqekmb.exe
        262⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\Cggibe32.exe
        
        C:\Windows\system32\Cggibe32.exe
        263⤵
        Drops file in System32 directory
        
        PID:14520
        
        C:\Windows\SysWOW64\Cjeenqcc.exe
        
        C:\Windows\system32\Cjeenqcc.exe
        264⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\Clcajlbf.exe
        
        C:\Windows\system32\Clcajlbf.exe
        265⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\Cjgbcpap.exe
        
        C:\Windows\system32\Cjgbcpap.exe
        266⤵
        
        PID:14576
        
        C:\Windows\SysWOW64\Clfnplpd.exe
        
        C:\Windows\system32\Clfnplpd.exe
        267⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\Dodjlgog.exe
        
        C:\Windows\system32\Dodjlgog.exe
        268⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\Dfnbha32.exe
        
        C:\Windows\system32\Dfnbha32.exe
        269⤵
        
        PID:14624
        
        C:\Windows\SysWOW64\Dlhkek32.exe
        
        C:\Windows\system32\Dlhkek32.exe
        270⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\Doggag32.exe
        
        C:\Windows\system32\Doggag32.exe
        271⤵
        
        PID:14656
        
        C:\Windows\SysWOW64\Dgnobd32.exe
        
        C:\Windows\system32\Dgnobd32.exe
        272⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\Dnhgoned.exe
        
        C:\Windows\system32\Dnhgoned.exe
        273⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\Doidgf32.exe
        
        C:\Windows\system32\Doidgf32.exe
        274⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\Dgplhd32.exe
        
        C:\Windows\system32\Dgplhd32.exe
        275⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\Djohdo32.exe
        
        C:\Windows\system32\Djohdo32.exe
        276⤵
        Modifies registry class
        
        PID:14736
        
        C:\Windows\SysWOW64\Dqhpai32.exe
        
        C:\Windows\system32\Dqhpai32.exe
        277⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\Dgbhncjb.exe
        
        C:\Windows\system32\Dgbhncjb.exe
        278⤵
        Modifies registry class
        
        PID:14768
        
        C:\Windows\SysWOW64\Dnlqjn32.exe
        
        C:\Windows\system32\Dnlqjn32.exe
        279⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\Dmoafjhi.exe
        
        C:\Windows\system32\Dmoafjhi.exe
        280⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:14800
        
        C:\Windows\SysWOW64\Donmbfgm.exe
        
        C:\Windows\system32\Donmbfgm.exe
        281⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\Dgeeccho.exe
        
        C:\Windows\system32\Dgeeccho.exe
        282⤵
        
        PID:14832
        
        C:\Windows\SysWOW64\Dnompm32.exe
        
        C:\Windows\system32\Dnompm32.exe
        283⤵
        
        PID:14848
        
        C:\Windows\SysWOW64\Eqmjlinp.exe
        
        C:\Windows\system32\Eqmjlinp.exe
        284⤵
        
        PID:14864
        
        C:\Windows\SysWOW64\Eggbic32.exe
        
        C:\Windows\system32\Eggbic32.exe
        285⤵
        
        PID:14880
        
        C:\Windows\SysWOW64\Enajemmi.exe
        
        C:\Windows\system32\Enajemmi.exe
        286⤵
        
        PID:14896
        
        C:\Windows\SysWOW64\Eqpfahlm.exe
        
        C:\Windows\system32\Eqpfahlm.exe
        287⤵
        
        PID:14912
        
        C:\Windows\SysWOW64\Eflojojd.exe
        
        C:\Windows\system32\Eflojojd.exe
        288⤵
        
        PID:14928
        
        C:\Windows\SysWOW64\Emfgfi32.exe
        
        C:\Windows\system32\Emfgfi32.exe
        289⤵
        
        PID:14944
        
        C:\Windows\SysWOW64\Eqbcghjj.exe
        
        C:\Windows\system32\Eqbcghjj.exe
        290⤵
        
        PID:14972
        
        C:\Windows\SysWOW64\Eoecbe32.exe
        
        C:\Windows\system32\Eoecbe32.exe
        291⤵
        
        PID:14988
        
        C:\Windows\SysWOW64\Eglkdbag.exe
        
        C:\Windows\system32\Eglkdbag.exe
        292⤵
        
        PID:15024
        
        C:\Windows\SysWOW64\Ejjgpnak.exe
        
        C:\Windows\system32\Ejjgpnak.exe
        293⤵
        
        PID:15040
        
        C:\Windows\SysWOW64\Enfcql32.exe
        
        C:\Windows\system32\Enfcql32.exe
        294⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\Emidlipo.exe
        
        C:\Windows\system32\Emidlipo.exe
        295⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\Eogphdob.exe
        
        C:\Windows\system32\Eogphdob.exe
        296⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\Egnhibpd.exe
        
        C:\Windows\system32\Egnhibpd.exe
        297⤵
        Drops file in System32 directory
        
        PID:15132
        
        C:\Windows\SysWOW64\Ejmdemoh.exe
        
        C:\Windows\system32\Ejmdemoh.exe
        298⤵
        
        PID:15160
        
        C:\Windows\SysWOW64\Enhpfl32.exe
        
        C:\Windows\system32\Enhpfl32.exe
        299⤵
        
        PID:15176
        
        C:\Windows\SysWOW64\Eqfmbg32.exe
        
        C:\Windows\system32\Eqfmbg32.exe
        300⤵
        
        PID:15200
        
        C:\Windows\SysWOW64\Efcejndl.exe
        
        C:\Windows\system32\Efcejndl.exe
        301⤵
        
        PID:15220
        
        C:\Windows\SysWOW64\Ejoakm32.exe
        
        C:\Windows\system32\Ejoakm32.exe
        302⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\Fmmmgh32.exe
        
        C:\Windows\system32\Fmmmgh32.exe
        303⤵
        
        PID:15264
        
        C:\Windows\SysWOW64\Fqiihgdb.exe
        
        C:\Windows\system32\Fqiihgdb.exe
        304⤵
        
        PID:15292
        
        C:\Windows\SysWOW64\Fplicd32.exe
        
        C:\Windows\system32\Fplicd32.exe
        305⤵
        
        PID:15312
        
        C:\Windows\SysWOW64\Fpnfic32.exe
        
        C:\Windows\system32\Fpnfic32.exe
        306⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\Fgenjqil.exe
        
        C:\Windows\system32\Fgenjqil.exe
        307⤵
        
        PID:15344
        
        C:\Windows\SysWOW64\Fnofgk32.exe
        
        C:\Windows\system32\Fnofgk32.exe
        308⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Fanbcf32.exe
        
        C:\Windows\system32\Fanbcf32.exe
        309⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\Fggkpqgj.exe
        
        C:\Windows\system32\Fggkpqgj.exe
        310⤵
        Drops file in System32 directory
        
        PID:14408
        
        C:\Windows\SysWOW64\Fnaclk32.exe
        
        C:\Windows\system32\Fnaclk32.exe
        311⤵
        
        PID:14440
        
        C:\Windows\SysWOW64\Fpcpdcee.exe
        
        C:\Windows\system32\Fpcpdcee.exe
        312⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Ffmhqm32.exe
        
        C:\Windows\system32\Ffmhqm32.exe
        313⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Fmgpmg32.exe
        
        C:\Windows\system32\Fmgpmg32.exe
        314⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Fcqhjakk.exe
        
        C:\Windows\system32\Fcqhjakk.exe
        315⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Ffodfmjo.exe
        
        C:\Windows\system32\Ffodfmjo.exe
        316⤵
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Gmimcg32.exe
        
        C:\Windows\system32\Gmimcg32.exe
        317⤵
        Drops file in System32 directory
        
        PID:1228
        
        C:\Windows\SysWOW64\Gccepqii.exe
        
        C:\Windows\system32\Gccepqii.exe
        318⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Gjmmlk32.exe
        
        C:\Windows\system32\Gjmmlk32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:368
        
        C:\Windows\SysWOW64\Gageie32.exe
        
        C:\Windows\system32\Gageie32.exe
        320⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Gpjfdbom.exe
        
        C:\Windows\system32\Gpjfdbom.exe
        321⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Gganfooo.exe
        
        C:\Windows\system32\Gganfooo.exe
        322⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Gjojbkoc.exe
        
        C:\Windows\system32\Gjojbkoc.exe
        323⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Gaibod32.exe
        
        C:\Windows\system32\Gaibod32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2524
        
        C:\Windows\SysWOW64\Gplbjamj.exe
        
        C:\Windows\system32\Gplbjamj.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3760
        
        C:\Windows\SysWOW64\Gffkgl32.exe
        
        C:\Windows\system32\Gffkgl32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3660
        
        C:\Windows\SysWOW64\Gnmbhi32.exe
        
        C:\Windows\system32\Gnmbhi32.exe
        327⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Gpoopa32.exe
        
        C:\Windows\system32\Gpoopa32.exe
        328⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Gfhglkbd.exe
        
        C:\Windows\system32\Gfhglkbd.exe
        329⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\Gnponhcg.exe
        
        C:\Windows\system32\Gnponhcg.exe
        330⤵
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\Ganljdbj.exe
        
        C:\Windows\system32\Ganljdbj.exe
        331⤵
        Drops file in System32 directory
        
        PID:15092
        
        C:\Windows\SysWOW64\Gpaleq32.exe
        
        C:\Windows\system32\Gpaleq32.exe
        332⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Ghhdfn32.exe
        
        C:\Windows\system32\Ghhdfn32.exe
        333⤵
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Hjfpbi32.exe
        
        C:\Windows\system32\Hjfpbi32.exe
        334⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Haphoc32.exe
        
        C:\Windows\system32\Haphoc32.exe
        335⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Hdodko32.exe
        
        C:\Windows\system32\Hdodko32.exe
        336⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Hhjqlngd.exe
        
        C:\Windows\system32\Hhjqlngd.exe
        337⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Hjimhifh.exe
        
        C:\Windows\system32\Hjimhifh.exe
        338⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Hndiih32.exe
        
        C:\Windows\system32\Hndiih32.exe
        339⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Hmgiddel.exe
        
        C:\Windows\system32\Hmgiddel.exe
        340⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Habeec32.exe
        
        C:\Windows\system32\Habeec32.exe
        341⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Hdaaao32.exe
        
        C:\Windows\system32\Hdaaao32.exe
        342⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Hhmmameb.exe
        
        C:\Windows\system32\Hhmmameb.exe
        343⤵
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Hfpnmj32.exe
        
        C:\Windows\system32\Hfpnmj32.exe
        344⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Hjkinide.exe
        
        C:\Windows\system32\Hjkinide.exe
        345⤵
        Modifies registry class
        
        PID:4084
        
        C:\Windows\SysWOW64\Haeajc32.exe
        
        C:\Windows\system32\Haeajc32.exe
        346⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Hdcnfnkf.exe
        
        C:\Windows\system32\Hdcnfnkf.exe
        347⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Hhojgm32.exe
        
        C:\Windows\system32\Hhojgm32.exe
        348⤵
        Drops file in System32 directory
        
        PID:4004
        
        C:\Windows\SysWOW64\Hjmfch32.exe
        
        C:\Windows\system32\Hjmfch32.exe
        349⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Hnibdgkl.exe
        
        C:\Windows\system32\Hnibdgkl.exe
        350⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Hmlbod32.exe
        
        C:\Windows\system32\Hmlbod32.exe
        351⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Hpjokp32.exe
        
        C:\Windows\system32\Hpjokp32.exe
        352⤵
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Hdfklnic.exe
        
        C:\Windows\system32\Hdfklnic.exe
        353⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Hjpcih32.exe
        
        C:\Windows\system32\Hjpcih32.exe
        354⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Hpmkao32.exe
        
        C:\Windows\system32\Hpmkao32.exe
        355⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\Imqljcma.exe
        
        C:\Windows\system32\Imqljcma.exe
        356⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Idjdgm32.exe
        
        C:\Windows\system32\Idjdgm32.exe
        357⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Iophdf32.exe
        
        C:\Windows\system32\Iophdf32.exe
        358⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Jknojfdp.exe
        
        C:\Windows\system32\Jknojfdp.exe
        359⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Jmlkfacd.exe
        
        C:\Windows\system32\Jmlkfacd.exe
        360⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jpkhbmbg.exe
        
        C:\Windows\system32\Jpkhbmbg.exe
        361⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jhapcjcj.exe
        
        C:\Windows\system32\Jhapcjcj.exe
        362⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Jkplpfbn.exe
        
        C:\Windows\system32\Jkplpfbn.exe
        363⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Jmohla32.exe
        
        C:\Windows\system32\Jmohla32.exe
        364⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Jdhphkin.exe
        
        C:\Windows\system32\Jdhphkin.exe
        365⤵
        Modifies registry class
        
        PID:15280
        
        C:\Windows\SysWOW64\Jggmdgha.exe
        
        C:\Windows\system32\Jggmdgha.exe
        366⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jkbhee32.exe
        
        C:\Windows\system32\Jkbhee32.exe
        367⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Jmaeaa32.exe
        
        C:\Windows\system32\Jmaeaa32.exe
        368⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Jalabpgh.exe
        
        C:\Windows\system32\Jalabpgh.exe
        369⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Jgiijffo.exe
        
        C:\Windows\system32\Jgiijffo.exe
        370⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Jkeeke32.exe
        
        C:\Windows\system32\Jkeeke32.exe
        371⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Jopakdfa.exe
        
        C:\Windows\system32\Jopakdfa.exe
        372⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Jaongo32.exe
        
        C:\Windows\system32\Jaongo32.exe
        373⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Jpancllp.exe
        
        C:\Windows\system32\Jpancllp.exe
        374⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Jdmjck32.exe
        
        C:\Windows\system32\Jdmjck32.exe
        375⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Jhifdimb.exe
        
        C:\Windows\system32\Jhifdimb.exe
        376⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Jglfpf32.exe
        
        C:\Windows\system32\Jglfpf32.exe
        377⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jobnac32.exe
        
        C:\Windows\system32\Jobnac32.exe
        378⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jaajmo32.exe
        
        C:\Windows\system32\Jaajmo32.exe
        379⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Jdpfij32.exe
        
        C:\Windows\system32\Jdpfij32.exe
        380⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kgnbef32.exe
        
        C:\Windows\system32\Kgnbef32.exe
        381⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kkiofdjc.exe
        
        C:\Windows\system32\Kkiofdjc.exe
        382⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Knhkbpif.exe
        
        C:\Windows\system32\Knhkbpif.exe
        383⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Kacgboap.exe
        
        C:\Windows\system32\Kacgboap.exe
        384⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Kpfgnk32.exe
        
        C:\Windows\system32\Kpfgnk32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Kdbcojqc.exe
        
        C:\Windows\system32\Kdbcojqc.exe
        386⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Kklkkd32.exe
        
        C:\Windows\system32\Kklkkd32.exe
        387⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Knjhgp32.exe
        
        C:\Windows\system32\Knjhgp32.exe
        388⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Kafchnom.exe
        
        C:\Windows\system32\Kafchnom.exe
        389⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Kgblpend.exe
        
        C:\Windows\system32\Kgblpend.exe
        390⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kknhad32.exe
        
        C:\Windows\system32\Kknhad32.exe
        391⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kojdabng.exe
        
        C:\Windows\system32\Kojdabng.exe
        392⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Kahpnnmj.exe
        
        C:\Windows\system32\Kahpnnmj.exe
        393⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kpkqik32.exe
        
        C:\Windows\system32\Kpkqik32.exe
        394⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Khbhjheg.exe
        
        C:\Windows\system32\Khbhjheg.exe
        395⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Kpmmojbb.exe
        
        C:\Windows\system32\Kpmmojbb.exe
        396⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Khdephbd.exe
        
        C:\Windows\system32\Khdephbd.exe
        397⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Kppjdjpp.exe
        
        C:\Windows\system32\Kppjdjpp.exe
        398⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Lgjbadgl.exe
        
        C:\Windows\system32\Lgjbadgl.exe
        399⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Loqjbaho.exe
        
        C:\Windows\system32\Loqjbaho.exe
        400⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Lpbgjj32.exe
        
        C:\Windows\system32\Lpbgjj32.exe
        401⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Lhiokg32.exe
        
        C:\Windows\system32\Lhiokg32.exe
        402⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Locghafl.exe
        
        C:\Windows\system32\Locghafl.exe
        403⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Laacdmep.exe
        
        C:\Windows\system32\Laacdmep.exe
        404⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ldpophdc.exe
        
        C:\Windows\system32\Ldpophdc.exe
        405⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Lkjhmblp.exe
        
        C:\Windows\system32\Lkjhmblp.exe
        406⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Lnhdinkd.exe
        
        C:\Windows\system32\Lnhdinkd.exe
        407⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ldbleh32.exe
        
        C:\Windows\system32\Ldbleh32.exe
        408⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Lgqhac32.exe
        
        C:\Windows\system32\Lgqhac32.exe
        409⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Lohpcq32.exe
        
        C:\Windows\system32\Lohpcq32.exe
        410⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lddikg32.exe
        
        C:\Windows\system32\Lddikg32.exe
        411⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Lkoaha32.exe
        
        C:\Windows\system32\Lkoaha32.exe
        412⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Lbhidloh.exe
        
        C:\Windows\system32\Lbhidloh.exe
        413⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mhbaaf32.exe
        
        C:\Windows\system32\Mhbaaf32.exe
        414⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Mkanma32.exe
        
        C:\Windows\system32\Mkanma32.exe
        415⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Mbkfjkme.exe
        
        C:\Windows\system32\Mbkfjkme.exe
        416⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 408
        417⤵
        Program crash
        
        PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5816 -ip 5816
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kacbfnnp.exe

Filesize
248KB

MD5
1afb8b7fdf8396554802c3a28be0f0ff

SHA1
a88e36566df22f6a73dea1bcd726a7c117df5100

SHA256
e1466cff23d3cce7b61e9ebda113ae9b33c151af29996f683c9764cd5fef7626

SHA512
96a2844099833eb7fef3623219e0cf19961fc4b04ef65c08e1ceaac544ca81a41924c092b76ff78a6326634293bb85ad7f8a72f7d58b5ca80e15a2200eedf536

Download Submit
C:\Windows\SysWOW64\Kacbfnnp.exe

Filesize
248KB

MD5
1afb8b7fdf8396554802c3a28be0f0ff

SHA1
a88e36566df22f6a73dea1bcd726a7c117df5100

SHA256
e1466cff23d3cce7b61e9ebda113ae9b33c151af29996f683c9764cd5fef7626

SHA512
96a2844099833eb7fef3623219e0cf19961fc4b04ef65c08e1ceaac544ca81a41924c092b76ff78a6326634293bb85ad7f8a72f7d58b5ca80e15a2200eedf536

Download Submit
C:\Windows\SysWOW64\Kcjhaj32.exe

Filesize
248KB

MD5
30dd6c96983504525557188cfbd40ab1

SHA1
525d7538baf2ac7458470602b0a2670facd95cac

SHA256
3c9fb8b79aeb0b694ae63a3f8b6956e8b037ab4be476b11d9b88e53ea946b343

SHA512
615ee9f9924b66800ecbe21b7aec3790b49ab2cc31bd132f9c5f8d8ae6cfbfbd09b2abd4109151a19754edddc813d2bd773be880aab5809dcc67929e9f2bae41

Download Submit
C:\Windows\SysWOW64\Kcjhaj32.exe

Filesize
248KB

MD5
30dd6c96983504525557188cfbd40ab1

SHA1
525d7538baf2ac7458470602b0a2670facd95cac

SHA256
3c9fb8b79aeb0b694ae63a3f8b6956e8b037ab4be476b11d9b88e53ea946b343

SHA512
615ee9f9924b66800ecbe21b7aec3790b49ab2cc31bd132f9c5f8d8ae6cfbfbd09b2abd4109151a19754edddc813d2bd773be880aab5809dcc67929e9f2bae41

Download Submit
C:\Windows\SysWOW64\Kejekm32.exe

Filesize
248KB

MD5
5d6af2574bd0cfea306f80939a3f0942

SHA1
e060b2a1820a6910bd4f9c4403a49e889cdd6610

SHA256
b858a0df9a4cb3b421f2c4050bb15ffc84e012b82c20f57b6308d5f007704efc

SHA512
53e2aeb91c702f3a71bb119b3c42477c999849d3cec379f32556756cde6eb7227f57344961226d206b6afb658458701160831c46f30ea635ad602983593be61f

Download Submit
C:\Windows\SysWOW64\Kejekm32.exe

Filesize
248KB

MD5
5d6af2574bd0cfea306f80939a3f0942

SHA1
e060b2a1820a6910bd4f9c4403a49e889cdd6610

SHA256
b858a0df9a4cb3b421f2c4050bb15ffc84e012b82c20f57b6308d5f007704efc

SHA512
53e2aeb91c702f3a71bb119b3c42477c999849d3cec379f32556756cde6eb7227f57344961226d206b6afb658458701160831c46f30ea635ad602983593be61f

Download Submit
C:\Windows\SysWOW64\Khknmh32.exe

Filesize
248KB

MD5
e160dda46fcde436b068d7bd8539a8c9

SHA1
c10279a089a3263da8d1329adfd3f9fa43540a43

SHA256
02ad9a9dc39f38b9bec695412a2985bae853a9769db0b6b21fb7890a4c4b0026

SHA512
218154ca12b242213b9f6dddbf32d37f2555afaf7ea6375fd5b7aea7579ca104971cd1ea65c3dd9d83ffc6d08f535b48e27ff3da79a07f84f833200a403a0320

Download Submit
C:\Windows\SysWOW64\Khknmh32.exe

Filesize
248KB

MD5
e160dda46fcde436b068d7bd8539a8c9

SHA1
c10279a089a3263da8d1329adfd3f9fa43540a43

SHA256
02ad9a9dc39f38b9bec695412a2985bae853a9769db0b6b21fb7890a4c4b0026

SHA512
218154ca12b242213b9f6dddbf32d37f2555afaf7ea6375fd5b7aea7579ca104971cd1ea65c3dd9d83ffc6d08f535b48e27ff3da79a07f84f833200a403a0320

Download Submit
C:\Windows\SysWOW64\Knbidbqo.exe

Filesize
248KB

MD5
455a6469b9c1e02f764140fc455ecbb6

SHA1
7a0b50b67b282689eea04823dfe7db0a2493c619

SHA256
ee450e5faf7c41b7f9666ddf17970774f388f543ee06945dde9e5863da909221

SHA512
ed2c1184cb4fd24abebf515b7ae1a5fb67e61219306331919ac5bc29612c5fa1590c01e15c35d6dce74c97d0903538bda08235db98d41a0a7aefa0201df97376

Download Submit
C:\Windows\SysWOW64\Knbidbqo.exe

Filesize
248KB

MD5
455a6469b9c1e02f764140fc455ecbb6

SHA1
7a0b50b67b282689eea04823dfe7db0a2493c619

SHA256
ee450e5faf7c41b7f9666ddf17970774f388f543ee06945dde9e5863da909221

SHA512
ed2c1184cb4fd24abebf515b7ae1a5fb67e61219306331919ac5bc29612c5fa1590c01e15c35d6dce74c97d0903538bda08235db98d41a0a7aefa0201df97376

Download Submit
C:\Windows\SysWOW64\Ldfhmh32.exe

Filesize
248KB

MD5
b2f1c326913f34dc3108b3a220cf25d0

SHA1
ea0ca85bf05dc310b7045922a8c234f459574c36

SHA256
190ad70e6c0cc5d89af2aff37952fdcf473e919c62dcc58f2a0802ff0009318c

SHA512
a8508da9bf7a846617a21175a5e32ee7182237a32beded691a77907b7baab3a30bfcc886ce16ed29b66d90094869645fc08986882af3b0aff173f36f2e783f8f

Download Submit
C:\Windows\SysWOW64\Ldfhmh32.exe

Filesize
248KB

MD5
b2f1c326913f34dc3108b3a220cf25d0

SHA1
ea0ca85bf05dc310b7045922a8c234f459574c36

SHA256
190ad70e6c0cc5d89af2aff37952fdcf473e919c62dcc58f2a0802ff0009318c

SHA512
a8508da9bf7a846617a21175a5e32ee7182237a32beded691a77907b7baab3a30bfcc886ce16ed29b66d90094869645fc08986882af3b0aff173f36f2e783f8f

Download Submit
C:\Windows\SysWOW64\Ldkahhei.exe

Filesize
248KB

MD5
0d1f4619c32a210b2650d9e6b487903c

SHA1
d232c56fe199113d919f529f425618ad7c731cac

SHA256
b5573df3497880e32fca82d8bc10d24cfa99c386ea9bc801efaae1e7843c2b61

SHA512
49d558fe760012c770260b10bbfbe7f498c6c0aba898af04ca0c1deaf561f2de8e5a8f307dd8d695b2459c235c238793e9807fd5daa1af621d8c68d4eb187b1a

Download Submit
C:\Windows\SysWOW64\Ldkahhei.exe

Filesize
248KB

MD5
0d1f4619c32a210b2650d9e6b487903c

SHA1
d232c56fe199113d919f529f425618ad7c731cac

SHA256
b5573df3497880e32fca82d8bc10d24cfa99c386ea9bc801efaae1e7843c2b61

SHA512
49d558fe760012c770260b10bbfbe7f498c6c0aba898af04ca0c1deaf561f2de8e5a8f307dd8d695b2459c235c238793e9807fd5daa1af621d8c68d4eb187b1a

Download Submit
C:\Windows\SysWOW64\Lhdqcg32.exe

Filesize
248KB

MD5
b0412618ff15475b0e797ee32e200fc5

SHA1
32c59bc9132e739a0b1c5fb3e8c0a0f7ebe76e48

SHA256
ee9da0205b2bca4e9cdcbdb0648f5315af05ef598d4c08d5c4bddf9fca333b1f

SHA512
acb849526c6250d873ca64c4092f33c3bc63a762792c1b66448a8d05fa012ebe0a830d76200c1dfb800b400d73e45afc3a1b1fe647b487e710884ae887ed0b4c

Download Submit
C:\Windows\SysWOW64\Lhdqcg32.exe

Filesize
248KB

MD5
b0412618ff15475b0e797ee32e200fc5

SHA1
32c59bc9132e739a0b1c5fb3e8c0a0f7ebe76e48

SHA256
ee9da0205b2bca4e9cdcbdb0648f5315af05ef598d4c08d5c4bddf9fca333b1f

SHA512
acb849526c6250d873ca64c4092f33c3bc63a762792c1b66448a8d05fa012ebe0a830d76200c1dfb800b400d73e45afc3a1b1fe647b487e710884ae887ed0b4c

Download Submit
C:\Windows\SysWOW64\Lmjckocd.exe

Filesize
248KB

MD5
0a8eca5dc1c7cea0efc18eeabe37af18

SHA1
b026129939cb5616da565c4bf129cc7fa9c37769

SHA256
02f4c07beef1fcafb017c7c4edd5a9cb6041dae488f45b84439309c1573a09fa

SHA512
98ca37cfd6a7c7d5914cc37c49614d480c5ddd99f23dafb570f4e1201274b12100be2424c59dc168f68f33d8a8a8c02655bbd8663568bbe5885c70b44d7cf42f

Download Submit
C:\Windows\SysWOW64\Lmjckocd.exe

Filesize
248KB

MD5
0a8eca5dc1c7cea0efc18eeabe37af18

SHA1
b026129939cb5616da565c4bf129cc7fa9c37769

SHA256
02f4c07beef1fcafb017c7c4edd5a9cb6041dae488f45b84439309c1573a09fa

SHA512
98ca37cfd6a7c7d5914cc37c49614d480c5ddd99f23dafb570f4e1201274b12100be2424c59dc168f68f33d8a8a8c02655bbd8663568bbe5885c70b44d7cf42f

Download Submit
C:\Windows\SysWOW64\Lmlpqnaa.exe

Filesize
248KB

MD5
04364cdbff79c4c794ff128d599608cc

SHA1
f3aa334f93e6e04e35f415b0412e2de45f747946

SHA256
0050ee44a2cd3f1a10cd1f1042fbf49d7606d4bdf4afd63f881fde3d007e32b8

SHA512
32bbaea1e99fc3687afeec6c560200714fb23b5511d10cc301b29f42a038d5355971db1868a8b2987fb24a3199bc99785c327f04fc95d64490bda75bc2f26065

Download Submit
C:\Windows\SysWOW64\Lmlpqnaa.exe

Filesize
248KB

MD5
04364cdbff79c4c794ff128d599608cc

SHA1
f3aa334f93e6e04e35f415b0412e2de45f747946

SHA256
0050ee44a2cd3f1a10cd1f1042fbf49d7606d4bdf4afd63f881fde3d007e32b8

SHA512
32bbaea1e99fc3687afeec6c560200714fb23b5511d10cc301b29f42a038d5355971db1868a8b2987fb24a3199bc99785c327f04fc95d64490bda75bc2f26065

Download Submit
C:\Windows\SysWOW64\Lmnlfn32.exe

Filesize
248KB

MD5
344c6062126080537a8f4bfdad6787b4

SHA1
158df1d04ce4f49cf3e6c439f9d4ca6aad4f0a8a

SHA256
bffd3994f7e8ece77319cca77b1e33670189ea76773e54ffb9bc8a2090338b78

SHA512
9d237f8af44d1bc4f1aa6b2e203cab026dc9303b2811c561b10e85f1b9c3a98c6822f510c3af461b0d21ef124d09a91f7188755a0a7c45b3c3864329d8d56699

Download Submit
C:\Windows\SysWOW64\Lmnlfn32.exe

Filesize
248KB

MD5
344c6062126080537a8f4bfdad6787b4

SHA1
158df1d04ce4f49cf3e6c439f9d4ca6aad4f0a8a

SHA256
bffd3994f7e8ece77319cca77b1e33670189ea76773e54ffb9bc8a2090338b78

SHA512
9d237f8af44d1bc4f1aa6b2e203cab026dc9303b2811c561b10e85f1b9c3a98c6822f510c3af461b0d21ef124d09a91f7188755a0a7c45b3c3864329d8d56699

Download Submit
C:\Windows\SysWOW64\Lopeeq32.exe

Filesize
248KB

MD5
a3aecfa9ad34d5c5e7dd5cccc06d0d5a

SHA1
71f921f9d9cbb2a5f3a5406e5e0139d2698fb1a5

SHA256
6826adca4072ebd49e3954a3576a11e4fe0a276446fd690449da3bd9f71e393e

SHA512
f0aadddb0580ef79b6fabfa8c86afe9cdb6566ac3876936ac7c02ff841ef9536a53402176aae369ed42ecc14140d32b4700ad87e87156edc988cee127e732df4

Download Submit
C:\Windows\SysWOW64\Lopeeq32.exe

Filesize
248KB

MD5
a3aecfa9ad34d5c5e7dd5cccc06d0d5a

SHA1
71f921f9d9cbb2a5f3a5406e5e0139d2698fb1a5

SHA256
6826adca4072ebd49e3954a3576a11e4fe0a276446fd690449da3bd9f71e393e

SHA512
f0aadddb0580ef79b6fabfa8c86afe9cdb6566ac3876936ac7c02ff841ef9536a53402176aae369ed42ecc14140d32b4700ad87e87156edc988cee127e732df4

Download Submit
C:\Windows\SysWOW64\Mackmkpn.exe

Filesize
248KB

MD5
41453e8b0be21555cd0f25d28090605e

SHA1
ee4daa976910ff4b61129f76e082c09b8b74db95

SHA256
b129f98eac772c453a8ae1cb91a5f22cf2bc948f7550e968ef498b2073cd41b7

SHA512
32f6e4bcb8b3910c80ff1de89200c36c2c3a36f4e597809103db744f4bc4167181dad165403700dfee8d4b1da2cd1709b6294fd54ddc49a8f2959bdc2c9c4f4f

Download Submit
C:\Windows\SysWOW64\Mackmkpn.exe

Filesize
248KB

MD5
41453e8b0be21555cd0f25d28090605e

SHA1
ee4daa976910ff4b61129f76e082c09b8b74db95

SHA256
b129f98eac772c453a8ae1cb91a5f22cf2bc948f7550e968ef498b2073cd41b7

SHA512
32f6e4bcb8b3910c80ff1de89200c36c2c3a36f4e597809103db744f4bc4167181dad165403700dfee8d4b1da2cd1709b6294fd54ddc49a8f2959bdc2c9c4f4f

Download Submit
C:\Windows\SysWOW64\Mdagigoa.exe

Filesize
248KB

MD5
9062441aa94c1bdf41a0b2f6a84600b0

SHA1
81114e1e44a491927b33acdf948d5ed4fe8cce38

SHA256
fdb342ab86926229ba1464e74eaf0a310108d5a7898a76211da5025b167672ac

SHA512
77f4efe3f9115b6017acaec69b2f1b1935142b652d8e26fc95b7018cdee94a266d2a8d189018a53a3c71a6f3584e1e621fc2ace72225c4e10f09b4bc78873c53

Download Submit
C:\Windows\SysWOW64\Mdagigoa.exe

Filesize
248KB

MD5
9062441aa94c1bdf41a0b2f6a84600b0

SHA1
81114e1e44a491927b33acdf948d5ed4fe8cce38

SHA256
fdb342ab86926229ba1464e74eaf0a310108d5a7898a76211da5025b167672ac

SHA512
77f4efe3f9115b6017acaec69b2f1b1935142b652d8e26fc95b7018cdee94a266d2a8d189018a53a3c71a6f3584e1e621fc2ace72225c4e10f09b4bc78873c53

Download Submit
C:\Windows\SysWOW64\Mgempa32.exe

Filesize
248KB

MD5
36a89fed0aa1310f79c7cb93244dc357

SHA1
e36a1b3d5bcbf31981dd4c1da265facc0454a46d

SHA256
27622f3f31d58e2be04bcd6b1543aa5e801f4ca56ed0528cfedb674b63fd4c5c

SHA512
930b92c4a6869014c6620ae346d654ec1d1f8e96b0bcfa1029e4c3eaf688409d4038b563ae7490ab3d0fd9a8cf80d4c5a71ca10c7005451b85a659ad3709f6d4

Download Submit
C:\Windows\SysWOW64\Mgempa32.exe

Filesize
248KB

MD5
36a89fed0aa1310f79c7cb93244dc357

SHA1
e36a1b3d5bcbf31981dd4c1da265facc0454a46d

SHA256
27622f3f31d58e2be04bcd6b1543aa5e801f4ca56ed0528cfedb674b63fd4c5c

SHA512
930b92c4a6869014c6620ae346d654ec1d1f8e96b0bcfa1029e4c3eaf688409d4038b563ae7490ab3d0fd9a8cf80d4c5a71ca10c7005451b85a659ad3709f6d4

Download Submit
C:\Windows\SysWOW64\Mkgfkajc.exe

Filesize
248KB

MD5
1bb5ce18bb8bcf8976f55dad2755caf1

SHA1
46d49e8e672a36f3dc4aa78235edf4c8f88b24cd

SHA256
9ef6829871731c982d98ef9e3d2cf66cf7f5151dd1e368a9e78eb72891680a93

SHA512
22e3733c23b59b33bd93321ccef273ed12a832aa73a8c16a1cc4c66242de679fbcd58f1913c540762125d4cc89accd0ca31cd89cde515c0bc668508ed024046d

Download Submit
C:\Windows\SysWOW64\Mkgfkajc.exe

Filesize
248KB

MD5
1bb5ce18bb8bcf8976f55dad2755caf1

SHA1
46d49e8e672a36f3dc4aa78235edf4c8f88b24cd

SHA256
9ef6829871731c982d98ef9e3d2cf66cf7f5151dd1e368a9e78eb72891680a93

SHA512
22e3733c23b59b33bd93321ccef273ed12a832aa73a8c16a1cc4c66242de679fbcd58f1913c540762125d4cc89accd0ca31cd89cde515c0bc668508ed024046d

Download Submit
C:\Windows\SysWOW64\Mkicpahq.exe

Filesize
248KB

MD5
5aa4d5ae94a71d8e330a5b4976fa9118

SHA1
09b02cd0e75ef4eda4df58d4bb446e7a7b39ffca

SHA256
815b7de1f666c956fa39bc45cb205d00349527a112977400d3cdba78b464de16

SHA512
9ddddefff09e2bda834b786aed8e459395db2c6225d6579d6669bd2f5071b5180f9dc82a0a04951bdd969136afada3cded9571a3b0c274f9e01d28fb58cbd04b

Download Submit
C:\Windows\SysWOW64\Mkicpahq.exe

Filesize
248KB

MD5
5aa4d5ae94a71d8e330a5b4976fa9118

SHA1
09b02cd0e75ef4eda4df58d4bb446e7a7b39ffca

SHA256
815b7de1f666c956fa39bc45cb205d00349527a112977400d3cdba78b464de16

SHA512
9ddddefff09e2bda834b786aed8e459395db2c6225d6579d6669bd2f5071b5180f9dc82a0a04951bdd969136afada3cded9571a3b0c274f9e01d28fb58cbd04b

Download Submit
C:\Windows\SysWOW64\Mmjlbl32.exe

Filesize
248KB

MD5
eb5a463a2612426bda6d79ce4f16a9cf

SHA1
2b638e08e5c31f667972c42e5a872de499cbd0cc

SHA256
d060da19708b2775c934b68caae84763b4cd094cc25e8d9cfca3d186779fa6c2

SHA512
c54afd83031f7aaaf1e79e8c45471889e5012a9861799302ac501fa76b95461587c321aa7a09a2c707339a160662018cd3f5ed0ad1ad5335b42653b4279fdb43

Download Submit
C:\Windows\SysWOW64\Mmjlbl32.exe

Filesize
248KB

MD5
eb5a463a2612426bda6d79ce4f16a9cf

SHA1
2b638e08e5c31f667972c42e5a872de499cbd0cc

SHA256
d060da19708b2775c934b68caae84763b4cd094cc25e8d9cfca3d186779fa6c2

SHA512
c54afd83031f7aaaf1e79e8c45471889e5012a9861799302ac501fa76b95461587c321aa7a09a2c707339a160662018cd3f5ed0ad1ad5335b42653b4279fdb43

Download Submit
C:\Windows\SysWOW64\Mojhlold.exe

Filesize
248KB

MD5
f610c833a45097be6c9d59dd0ea7b64d

SHA1
ff5944de2df48c1dc5c8c373e0755fa9351c20ca

SHA256
947007eb1aba3e2850b8542e0b214d021aef58f035caf96f95f21ece26da4dd7

SHA512
4d4618e8d105742a51bb81a679a5e04dc33b984feec27f86aed2e2756b137dc748f4b75c7c5bc76135ec6ac595c24a1fe5d4876aa7239be0bc513557a5681a6e

Download Submit
C:\Windows\SysWOW64\Mojhlold.exe

Filesize
248KB

MD5
f610c833a45097be6c9d59dd0ea7b64d

SHA1
ff5944de2df48c1dc5c8c373e0755fa9351c20ca

SHA256
947007eb1aba3e2850b8542e0b214d021aef58f035caf96f95f21ece26da4dd7

SHA512
4d4618e8d105742a51bb81a679a5e04dc33b984feec27f86aed2e2756b137dc748f4b75c7c5bc76135ec6ac595c24a1fe5d4876aa7239be0bc513557a5681a6e

Download Submit
C:\Windows\SysWOW64\Neamjgha.exe

Filesize
248KB

MD5
4b2ff4af195ad326f5447668629420d7

SHA1
1c12286dcb472a846b00ff6e158c09c95349857f

SHA256
38e231aa004b5a367cbac63cca25a044e9a3625dda86fa19ed816e80b730f3b2

SHA512
28c745801d22d0038a377521e83e34ebdc0d2f77455009245afde6b63815ec33839285ae873a048195e1c0a21d05e7826d4e81cd0de8203efe4e761aaf431dd0

Download Submit
C:\Windows\SysWOW64\Neamjgha.exe

Filesize
248KB

MD5
4b2ff4af195ad326f5447668629420d7

SHA1
1c12286dcb472a846b00ff6e158c09c95349857f

SHA256
38e231aa004b5a367cbac63cca25a044e9a3625dda86fa19ed816e80b730f3b2

SHA512
28c745801d22d0038a377521e83e34ebdc0d2f77455009245afde6b63815ec33839285ae873a048195e1c0a21d05e7826d4e81cd0de8203efe4e761aaf431dd0

Download Submit
C:\Windows\SysWOW64\Nehjci32.exe

Filesize
248KB

MD5
038cb53d6fe299cb0e5deeb16b211057

SHA1
dfb3a132181218374e6a692eef3dd5c42e59b37d

SHA256
23e20c6ae527604985eb8e95e4b3b5f9a436a1dffc37a762f627fe759863976f

SHA512
a4c3fbce65ecec67545a68cd26969dbedaa4fcc62fb0133ad32501c05e5f6cf198431156109964a795b4fbdd9d78700e2573e37bd32af063973a3f58eab74bca

Download Submit
C:\Windows\SysWOW64\Nehjci32.exe

Filesize
248KB

MD5
038cb53d6fe299cb0e5deeb16b211057

SHA1
dfb3a132181218374e6a692eef3dd5c42e59b37d

SHA256
23e20c6ae527604985eb8e95e4b3b5f9a436a1dffc37a762f627fe759863976f

SHA512
a4c3fbce65ecec67545a68cd26969dbedaa4fcc62fb0133ad32501c05e5f6cf198431156109964a795b4fbdd9d78700e2573e37bd32af063973a3f58eab74bca

Download Submit
C:\Windows\SysWOW64\Neopdhjd.exe

Filesize
248KB

MD5
b891b396a9ea751730169691038f428f

SHA1
e1bcfce4df26fdf07d93702bf4b92bf8f21a7094

SHA256
ae826173476dfb4dd5a677f19f872d9a7f818a2b02909086031299cbc5fc5060

SHA512
f9d4c9c6c8bb699674be9be7b02ee59c09365f7eb1d66b707bacccd10918419e67f31e2ce5562adff7c1e56a34fc9c255562cdb48733c77ba0f8d5fe3eba50d2

Download Submit
C:\Windows\SysWOW64\Neopdhjd.exe

Filesize
248KB

MD5
b891b396a9ea751730169691038f428f

SHA1
e1bcfce4df26fdf07d93702bf4b92bf8f21a7094

SHA256
ae826173476dfb4dd5a677f19f872d9a7f818a2b02909086031299cbc5fc5060

SHA512
f9d4c9c6c8bb699674be9be7b02ee59c09365f7eb1d66b707bacccd10918419e67f31e2ce5562adff7c1e56a34fc9c255562cdb48733c77ba0f8d5fe3eba50d2

Download Submit
C:\Windows\SysWOW64\Ngnpfp32.exe

Filesize
248KB

MD5
918f25c4ac424221fcbd545263993ac7

SHA1
f6ae697292ff14040b4a06a54b5151e411ce06f9

SHA256
5ffabd185344581b1d3dafc4018e2378fa180a3a98b2000a97a5dc828560165f

SHA512
42ec3598c3881da9d0187776d738dc388aeb46fa83fe40b5f61fcba3185f04844bdad030fe155b6554130f55830bd2078f2f803e024d364a07d52b5b3796e8f0

Download Submit
C:\Windows\SysWOW64\Ngnpfp32.exe

Filesize
248KB

MD5
918f25c4ac424221fcbd545263993ac7

SHA1
f6ae697292ff14040b4a06a54b5151e411ce06f9

SHA256
5ffabd185344581b1d3dafc4018e2378fa180a3a98b2000a97a5dc828560165f

SHA512
42ec3598c3881da9d0187776d738dc388aeb46fa83fe40b5f61fcba3185f04844bdad030fe155b6554130f55830bd2078f2f803e024d364a07d52b5b3796e8f0

Download Submit
C:\Windows\SysWOW64\Nncohk32.exe

Filesize
248KB

MD5
d0cb247e966fc3bb721dfa4820344aaf

SHA1
e7e121fb4d71b5a9313751845093c10d7ee0302c

SHA256
9706392646febfb2fb217b98f88513217ccc34d596f8fbe59549d5940f4d08cb

SHA512
6829c19331664b1ad2416dc7f39026b5d5450e39dd16e7bd429b50e2deb255b583d29240c1d3bbc339116d6214dfce6f064272af95bca7805a531403f726cb53

Download Submit
C:\Windows\SysWOW64\Nncohk32.exe

Filesize
248KB

MD5
d0cb247e966fc3bb721dfa4820344aaf

SHA1
e7e121fb4d71b5a9313751845093c10d7ee0302c

SHA256
9706392646febfb2fb217b98f88513217ccc34d596f8fbe59549d5940f4d08cb

SHA512
6829c19331664b1ad2416dc7f39026b5d5450e39dd16e7bd429b50e2deb255b583d29240c1d3bbc339116d6214dfce6f064272af95bca7805a531403f726cb53

Download Submit
C:\Windows\SysWOW64\Nnfknk32.exe

Filesize
248KB

MD5
8a46a77dea2575022625d2ba5adda7fb

SHA1
229d70f665864a16d6d124f2d16490fd3cfd0a33

SHA256
0cf6ab34d171de694f045ba92086692d9e6cc5faaa713b5e9b3020b653999799

SHA512
25ebc9776e5e82d0226d1f3eb00bec90b4adb37a3dbf024334ac37d1bb5b6902510b5f8cebe44575e7e238adad8ed2e432f50d034209e9932b899f3928b24461

Download Submit
C:\Windows\SysWOW64\Nnfknk32.exe

Filesize
248KB

MD5
8a46a77dea2575022625d2ba5adda7fb

SHA1
229d70f665864a16d6d124f2d16490fd3cfd0a33

SHA256
0cf6ab34d171de694f045ba92086692d9e6cc5faaa713b5e9b3020b653999799

SHA512
25ebc9776e5e82d0226d1f3eb00bec90b4adb37a3dbf024334ac37d1bb5b6902510b5f8cebe44575e7e238adad8ed2e432f50d034209e9932b899f3928b24461

Download Submit
C:\Windows\SysWOW64\Nonbgo32.exe

Filesize
248KB

MD5
e6793adec4f8818271fe9b46ada401d4

SHA1
1d9c52c04c737d860f096004cc3d0b84cc5530c2

SHA256
975b47d887f30e06c5c6a8dbc4a98e944503939a0a16f3e3229bec0f4e7f7ceb

SHA512
7cc19a69cd72c88e51b2e241c445a1ab9f9a4bf0bb9b817f5e973e903374539326a5025f17969abbe55bc231ec46747bc368cedd85fca34e56f07c85c6058019

Download Submit
C:\Windows\SysWOW64\Nonbgo32.exe

Filesize
248KB

MD5
e6793adec4f8818271fe9b46ada401d4

SHA1
1d9c52c04c737d860f096004cc3d0b84cc5530c2

SHA256
975b47d887f30e06c5c6a8dbc4a98e944503939a0a16f3e3229bec0f4e7f7ceb

SHA512
7cc19a69cd72c88e51b2e241c445a1ab9f9a4bf0bb9b817f5e973e903374539326a5025f17969abbe55bc231ec46747bc368cedd85fca34e56f07c85c6058019

Download Submit
C:\Windows\SysWOW64\Oahnohme.exe

Filesize
248KB

MD5
b964d0adbe1e5fefc7192c0860ddff18

SHA1
43221d94630aefc79c2e44eeac4f96306618d111

SHA256
43bafa8268a0854f61b5f9b1650ef375b252c0bfe25e24d6d4bc919f13938af3

SHA512
94a195973af99424eecf3207eeef06a597e26c105c324ea888b50029e39f4502faac18abeb4ee33b06c23385d518a1448a946e1f741c3fa6b0913420af3ba56d

Download Submit
C:\Windows\SysWOW64\Oahnohme.exe

Filesize
248KB

MD5
b964d0adbe1e5fefc7192c0860ddff18

SHA1
43221d94630aefc79c2e44eeac4f96306618d111

SHA256
43bafa8268a0854f61b5f9b1650ef375b252c0bfe25e24d6d4bc919f13938af3

SHA512
94a195973af99424eecf3207eeef06a597e26c105c324ea888b50029e39f4502faac18abeb4ee33b06c23385d518a1448a946e1f741c3fa6b0913420af3ba56d

Download Submit
C:\Windows\SysWOW64\Odnplc32.exe

Filesize
248KB

MD5
4ff08a86ed020d6db72e7c3743dee2bc

SHA1
625abd2a32c2b1925c524983d0150a4e2fc30b0b

SHA256
f72eafdbed6874dabe6b3b24afd6ad92c0f8279aeffe31d1f3228ea79aa8f95a

SHA512
17ba03f42e6d2ad391583b6a89219400b53421a203cf657ad802b82f13cbac1182f6370920862eeb08d586ba40867cc8b513ecb0c60c00936bef29121b361b0a

Download Submit
C:\Windows\SysWOW64\Odnplc32.exe

Filesize
248KB

MD5
4ff08a86ed020d6db72e7c3743dee2bc

SHA1
625abd2a32c2b1925c524983d0150a4e2fc30b0b

SHA256
f72eafdbed6874dabe6b3b24afd6ad92c0f8279aeffe31d1f3228ea79aa8f95a

SHA512
17ba03f42e6d2ad391583b6a89219400b53421a203cf657ad802b82f13cbac1182f6370920862eeb08d586ba40867cc8b513ecb0c60c00936bef29121b361b0a

Download Submit
C:\Windows\SysWOW64\Oeicjfai.exe

Filesize
248KB

MD5
30896afea03e8c109fd4760355006947

SHA1
37f1aa8d1cdd128413afe9a6cbc6d63d76f2fbf0

SHA256
fb955039da470b759b0dd89cd3a57c0bebcc0366bc27de9446abc3eaa6aa7140

SHA512
895ca0405c627876a648019c51c00822ba87b34e69ca4df38247422dddd2457af7ce958192caeaaf24617d567a9fa90577c3c8aca735e23cf310d324e00526e9

Download Submit
C:\Windows\SysWOW64\Oeicjfai.exe

Filesize
248KB

MD5
30896afea03e8c109fd4760355006947

SHA1
37f1aa8d1cdd128413afe9a6cbc6d63d76f2fbf0

SHA256
fb955039da470b759b0dd89cd3a57c0bebcc0366bc27de9446abc3eaa6aa7140

SHA512
895ca0405c627876a648019c51c00822ba87b34e69ca4df38247422dddd2457af7ce958192caeaaf24617d567a9fa90577c3c8aca735e23cf310d324e00526e9

Download Submit
C:\Windows\SysWOW64\Ogjpbo32.exe

Filesize
248KB

MD5
d5f3be562a9f8e0dc6cb0e99eb6b69b8

SHA1
a6fd97debf71d402e7a68df3c01666415b0e5cf4

SHA256
028b48ff7358e6fc2ce497db05bef4dd7c94323f83d71b1f57189a83b61675f3

SHA512
695dcd5129342a2617cdb7cb55283df1e0e74460b273a248b0286bb4e33990e2b606365ba8bc4a1e5d4439630116eb9a154ee762643d7afb13469de5e3e17f0f

Download Submit
C:\Windows\SysWOW64\Ogjpbo32.exe

Filesize
248KB

MD5
d5f3be562a9f8e0dc6cb0e99eb6b69b8

SHA1
a6fd97debf71d402e7a68df3c01666415b0e5cf4

SHA256
028b48ff7358e6fc2ce497db05bef4dd7c94323f83d71b1f57189a83b61675f3

SHA512
695dcd5129342a2617cdb7cb55283df1e0e74460b273a248b0286bb4e33990e2b606365ba8bc4a1e5d4439630116eb9a154ee762643d7afb13469de5e3e17f0f

Download Submit
C:\Windows\SysWOW64\Oolnhmlo.exe

Filesize
248KB

MD5
67021a8129254ca7f8ca3e3939aa5af0

SHA1
03c24566ba3b1640ca713ff417d4b9ce7bca82be

SHA256
6188cffb7a87c4ed97c505f261709b6ad73db9a30dbe28a82144bfd296344524

SHA512
b04433a1bf347f0328068f75d90bbdae1877ac26065e82b415accedc5df81bccb6a03c2aac41d4685ce6fd6d04d0e3a57ac36001d9ff3e7111e3be55b50d5a4a

Download Submit
C:\Windows\SysWOW64\Oolnhmlo.exe

Filesize
248KB

MD5
67021a8129254ca7f8ca3e3939aa5af0

SHA1
03c24566ba3b1640ca713ff417d4b9ce7bca82be

SHA256
6188cffb7a87c4ed97c505f261709b6ad73db9a30dbe28a82144bfd296344524

SHA512
b04433a1bf347f0328068f75d90bbdae1877ac26065e82b415accedc5df81bccb6a03c2aac41d4685ce6fd6d04d0e3a57ac36001d9ff3e7111e3be55b50d5a4a

Download Submit
C:\Windows\SysWOW64\Oooknl32.exe

Filesize
248KB

MD5
fd99b7483b075c299637bc0eace3a1d2

SHA1
ae4716f07d711d405da2197d4a80bdd9519332a7

SHA256
20387343dc6bb6cfde51b0e0306b6221cc460a19488b9a6d3222614d86f124c6

SHA512
5b669c7077f73ddc7613e7946cb9dc33847bed651fafdf4acaf36930363718b727dda88fc094d6a228438e87549f65eaf8dbed37c196d580e8ba48723b86004a

Download Submit
C:\Windows\SysWOW64\Oooknl32.exe

Filesize
248KB

MD5
fd99b7483b075c299637bc0eace3a1d2

SHA1
ae4716f07d711d405da2197d4a80bdd9519332a7

SHA256
20387343dc6bb6cfde51b0e0306b6221cc460a19488b9a6d3222614d86f124c6

SHA512
5b669c7077f73ddc7613e7946cb9dc33847bed651fafdf4acaf36930363718b727dda88fc094d6a228438e87549f65eaf8dbed37c196d580e8ba48723b86004a

Download Submit
memory/396-316-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/408-313-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/652-293-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/720-298-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/916-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/936-218-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/964-178-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1072-227-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1076-280-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1228-300-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1476-164-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1512-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1520-281-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1580-282-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1660-317-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1716-174-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1756-220-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1808-266-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1836-321-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1852-270-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1868-234-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1884-269-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1940-268-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2004-292-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2008-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2024-322-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2080-161-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2140-299-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2220-225-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2260-318-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2332-215-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2500-169-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2504-224-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3264-273-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3284-278-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3488-277-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3504-279-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3528-283-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3636-276-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3676-223-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3740-238-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3896-216-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3908-295-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3916-294-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4048-286-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-271-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4248-296-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4268-264-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4320-214-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4324-267-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4348-274-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4480-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4484-315-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4688-228-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4788-160-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4792-162-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4804-217-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4816-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4844-284-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4860-297-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4908-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4940-319-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-173-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5036-232-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download