dd4031c86072658368de537e1ed2cb0193235c692e68746db157b1f740567acd

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5b094378063d4717a452284c7ce1f450.exe
Size

111KB
MD5

5b094378063d4717a452284c7ce1f450
SHA1

c4250a17a6447467143262e0a63e91450837f1e0
SHA256

dd4031c86072658368de537e1ed2cb0193235c692e68746db157b1f740567acd
SHA512

d7e589d8961f318edd2b0d1b23ba0902700039916d231d782cbc71fe5642f5d8068f010c4f41c45c7d1d4fed7d490d489f96bc99a64822e80976bf82c61a2f7d
SSDEEP

3072:gAkL6YnOCKqB7V55e9w0v0wnJcefSXQHPTTAkvB5Ddj:gdnOCKeDMvtnJfKXqPTX7DB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knpmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enedio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fqeioiam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klddlckd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkgnalep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enemaimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iajmmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjpgmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mhoind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kjcccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgekdq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhdicjfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdklebje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gimoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcfbkpab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjeplijj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hjjldpdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhcbidcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icooig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpenmadn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbgfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eincadmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jffokn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gegchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kjpgmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdddhlbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Okpkgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halhfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opmcod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mldhacpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djegekil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enemaimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqbohocd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eimelg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jemfhacc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnoacp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbniai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcfmneaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ggdigekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdapehop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gedfblql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djklgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnkbcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkapelka.exe

Executes dropped EXE 64 IoCs

pid	Process
4672	Emmdom32.exe
4228	Eejeiocj.exe
1452	Fihnomjp.exe
3260	Fijkdmhn.exe
1032	Fbbpmb32.exe
2124	Fpgpgfmh.exe
2224	Ffceip32.exe
5016	Fnnjmbpm.exe
828	Gidnkkpc.exe
4536	Gldglf32.exe
940	Gpbpbecj.exe
3128	Gmfplibd.exe
4660	Geaepk32.exe
4468	Gbeejp32.exe
1288	Hfcnpn32.exe
1328	Hoobdp32.exe
2452	Hfhgkmpj.exe
3120	Hoclopne.exe
4552	Ifomll32.exe
4668	Iojbpo32.exe
4848	Iefgbh32.exe
1488	Igfclkdj.exe
4872	Jcmdaljn.exe
4300	Jpaekqhh.exe
476	Jlgepanl.exe
1280	Jepjhg32.exe
4580	Jcdjbk32.exe
3640	Jcfggkac.exe
5000	Klahfp32.exe
3580	Kcmmhj32.exe
1460	Klfaapbl.exe
736	Kcbfcigf.exe
5024	Lpfgmnfp.exe
2672	Lokdnjkg.exe
4712	Lqkqhm32.exe
1756	Lckiihok.exe
1072	Lflbkcll.exe
4104	Mgloefco.exe
2064	Mfqlfb32.exe
2920	Mgphpe32.exe
1512	Monjjgkb.exe
5084	Nqmfdj32.exe
3380	Ngjkfd32.exe
4304	Nglhld32.exe
2892	Nfcabp32.exe
2784	Oakbehfe.exe
1908	Ojdgnn32.exe
4116	Ohlqcagj.exe
1340	Ppgegd32.exe
3812	Pjmjdm32.exe
4068	Pmnbfhal.exe
2856	Qhhpop32.exe
3152	Qacameaj.exe
3624	Amjbbfgo.exe
2100	Aagkhd32.exe
2600	Amnlme32.exe
1780	Akblfj32.exe
3660	Amcehdod.exe
4776	Bobabg32.exe
4040	Bmhocd32.exe
4200	Bphgeo32.exe
2168	Bgbpaipl.exe
4188	Bgelgi32.exe
1652	Cpmapodj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nbhcdl32.exe	Nmkkle32.exe
File created	C:\Windows\SysWOW64\Obhmcdfq.dll	Djegekil.exe
File created	C:\Windows\SysWOW64\Keebjojo.dll	Epbkhhel.exe
File created	C:\Windows\SysWOW64\Efpcfibk.dll	Dmbiackg.exe
File opened for modification	C:\Windows\SysWOW64\Ihaidhgf.exe	Hcljmj32.exe
File opened for modification	C:\Windows\SysWOW64\Oooaah32.exe	Odjmdocp.exe
File created	C:\Windows\SysWOW64\Fepade32.dll	Kjlcmdbb.exe
File created	C:\Windows\SysWOW64\Bkpdml32.dll	Hkgnalep.exe
File created	C:\Windows\SysWOW64\Idknpoad.dll	Iogopi32.exe
File created	C:\Windows\SysWOW64\Gckcap32.exe	Gegchl32.exe
File created	C:\Windows\SysWOW64\Odqpha32.dll	Mjafoapj.exe
File opened for modification	C:\Windows\SysWOW64\Bhgjcmfi.exe	Bjfjee32.exe
File created	C:\Windows\SysWOW64\Baampdgc.dll	Fqgedh32.exe
File created	C:\Windows\SysWOW64\Cgnhmg32.dll	Bpdfpmoo.exe
File opened for modification	C:\Windows\SysWOW64\Clmckmcq.exe	Becknc32.exe
File created	C:\Windows\SysWOW64\Dioiki32.exe	Djmima32.exe
File created	C:\Windows\SysWOW64\Ohfkgknc.dll	Mhjhmhhd.exe
File opened for modification	C:\Windows\SysWOW64\Kmlgcf32.exe	Khonkogj.exe
File created	C:\Windows\SysWOW64\Kkghpa32.dll	Hjabdo32.exe
File created	C:\Windows\SysWOW64\Mnbinagj.dll	Jeneidji.exe
File created	C:\Windows\SysWOW64\Lqlmkp32.dll	Bgeadjai.exe
File opened for modification	C:\Windows\SysWOW64\Mlbllc32.exe	Mfeccm32.exe
File opened for modification	C:\Windows\SysWOW64\Klfaapbl.exe	Kcmmhj32.exe
File opened for modification	C:\Windows\SysWOW64\Ajaelc32.exe	Aplaoj32.exe
File created	C:\Windows\SysWOW64\Eincadmf.exe	Eljchpnl.exe
File opened for modification	C:\Windows\SysWOW64\Joekag32.exe	Jemfhacc.exe
File created	C:\Windows\SysWOW64\Inmdohhp.dll	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Nockkcjg.exe	Nncoaq32.exe
File opened for modification	C:\Windows\SysWOW64\Jeolckne.exe	Jnedgq32.exe
File opened for modification	C:\Windows\SysWOW64\Mhpgca32.exe	Mccokj32.exe
File created	C:\Windows\SysWOW64\Ggjjlk32.exe	Gkcigjel.exe
File created	C:\Windows\SysWOW64\Jgekdq32.exe	Jakchf32.exe
File created	C:\Windows\SysWOW64\Aclghpae.dll	Mdlgmgdh.exe
File opened for modification	C:\Windows\SysWOW64\Hhlnjpdi.exe	Hkgnalep.exe
File created	C:\Windows\SysWOW64\Mofmobmo.exe	Mlhqcgnk.exe
File created	C:\Windows\SysWOW64\Ghfqhkbn.dll	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Nbphglbe.exe	Nqoloc32.exe
File created	C:\Windows\SysWOW64\Nodeaima.dll	Baepolni.exe
File created	C:\Windows\SysWOW64\Lfmghdpl.exe	Lpbokjho.exe
File opened for modification	C:\Windows\SysWOW64\Nglhld32.exe	Ngjkfd32.exe
File created	C:\Windows\SysWOW64\Bmggingc.exe	Bpcgpihi.exe
File opened for modification	C:\Windows\SysWOW64\Jclljaei.exe	Jnocakfb.exe
File created	C:\Windows\SysWOW64\Diamko32.exe	Dolinf32.exe
File opened for modification	C:\Windows\SysWOW64\Egbken32.exe	Enjfli32.exe
File created	C:\Windows\SysWOW64\Dbfabk32.dll	Fljlom32.exe
File created	C:\Windows\SysWOW64\Igjhce32.dll	Iiaggc32.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gmfplibd.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Ppdbgncl.exe
File opened for modification	C:\Windows\SysWOW64\Lelajb32.exe	Kjfmminc.exe
File created	C:\Windows\SysWOW64\Nmbhgjoi.exe	Nhfoocaa.exe
File opened for modification	C:\Windows\SysWOW64\Gkdpbpih.exe	Ganldgib.exe
File opened for modification	C:\Windows\SysWOW64\Mljmhflh.exe	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Jjgkan32.dll	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Ioeiam32.dll	Dinjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Gjnlha32.exe	Fljlom32.exe
File created	C:\Windows\SysWOW64\Oknnanhj.exe	Odcfdc32.exe
File created	C:\Windows\SysWOW64\Fijkdmhn.exe	Fihnomjp.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Naennejb.dll	Dhgjll32.exe
File opened for modification	C:\Windows\SysWOW64\Mcfbkpab.exe	Mfbaalbi.exe
File created	C:\Windows\SysWOW64\Jnbgaa32.exe	Jdmcdhhe.exe
File created	C:\Windows\SysWOW64\Boijog32.dll	Fbnmkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ofijnbkb.exe	Oooaah32.exe
File created	C:\Windows\SysWOW64\Igadaq32.dll	Ainnhdbp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12100	12044	WerFault.exe	826

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	NEAS.5b094378063d4717a452284c7ce1f450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkpjdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ioicnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fekclnif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmggingc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeiam32.dll"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjdhlc32.dll"	Engaon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnefdf32.dll"	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcfkpjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nonhbi32.dll"	Pehjfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcfmneaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Icklhnop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnenchoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgnqqq32.dll"	Cnhlgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpnkbfj.dll"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhapb32.dll"	Nblolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bqdlmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djbbhafj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adokoq32.dll"	Imknli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhbqalle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopaik32.dll"	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghijbq32.dll"	Egdqph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoldgfoo.dll"	Limioiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nmkkle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajbnn32.dll"	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppfhnh32.dll"	Hifaic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnfdnnbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogefqeaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Icmbcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbhkkpon.dll"	Cbhbbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kceoppmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Llpchaqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gdmcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afdmjk32.dll"	Kanbjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opjgidfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gdhjpjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jjhalkjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpodkdll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ihaidhgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clmckmcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhemcq32.dll"	Efjgpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Epbkhhel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agqhik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjkbnfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Flaiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmagch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dioiki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ccblbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ggjjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aeglbeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neaglfck.dll"	Jqmicpbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ebifmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpcpfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcodk32.dll"	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Halhfe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4672	4772	NEAS.5b094378063d4717a452284c7ce1f450.exe	91
PID 4772 wrote to memory of 4672	4772	NEAS.5b094378063d4717a452284c7ce1f450.exe	91
PID 4772 wrote to memory of 4672	4772	NEAS.5b094378063d4717a452284c7ce1f450.exe	91
PID 4672 wrote to memory of 4228	4672	Emmdom32.exe	92
PID 4672 wrote to memory of 4228	4672	Emmdom32.exe	92
PID 4672 wrote to memory of 4228	4672	Emmdom32.exe	92
PID 4228 wrote to memory of 1452	4228	Eejeiocj.exe	93
PID 4228 wrote to memory of 1452	4228	Eejeiocj.exe	93
PID 4228 wrote to memory of 1452	4228	Eejeiocj.exe	93
PID 1452 wrote to memory of 3260	1452	Fihnomjp.exe	94
PID 1452 wrote to memory of 3260	1452	Fihnomjp.exe	94
PID 1452 wrote to memory of 3260	1452	Fihnomjp.exe	94
PID 3260 wrote to memory of 1032	3260	Fijkdmhn.exe	96
PID 3260 wrote to memory of 1032	3260	Fijkdmhn.exe	96
PID 3260 wrote to memory of 1032	3260	Fijkdmhn.exe	96
PID 1032 wrote to memory of 2124	1032	Fbbpmb32.exe	97
PID 1032 wrote to memory of 2124	1032	Fbbpmb32.exe	97
PID 1032 wrote to memory of 2124	1032	Fbbpmb32.exe	97
PID 2124 wrote to memory of 2224	2124	Fpgpgfmh.exe	98
PID 2124 wrote to memory of 2224	2124	Fpgpgfmh.exe	98
PID 2124 wrote to memory of 2224	2124	Fpgpgfmh.exe	98
PID 2224 wrote to memory of 5016	2224	Ffceip32.exe	99
PID 2224 wrote to memory of 5016	2224	Ffceip32.exe	99
PID 2224 wrote to memory of 5016	2224	Ffceip32.exe	99
PID 5016 wrote to memory of 828	5016	Fnnjmbpm.exe	100
PID 5016 wrote to memory of 828	5016	Fnnjmbpm.exe	100
PID 5016 wrote to memory of 828	5016	Fnnjmbpm.exe	100
PID 828 wrote to memory of 4536	828	Gidnkkpc.exe	101
PID 828 wrote to memory of 4536	828	Gidnkkpc.exe	101
PID 828 wrote to memory of 4536	828	Gidnkkpc.exe	101
PID 4536 wrote to memory of 940	4536	Gldglf32.exe	102
PID 4536 wrote to memory of 940	4536	Gldglf32.exe	102
PID 4536 wrote to memory of 940	4536	Gldglf32.exe	102
PID 940 wrote to memory of 3128	940	Gpbpbecj.exe	103
PID 940 wrote to memory of 3128	940	Gpbpbecj.exe	103
PID 940 wrote to memory of 3128	940	Gpbpbecj.exe	103
PID 3128 wrote to memory of 4660	3128	Gmfplibd.exe	104
PID 3128 wrote to memory of 4660	3128	Gmfplibd.exe	104
PID 3128 wrote to memory of 4660	3128	Gmfplibd.exe	104
PID 4660 wrote to memory of 4468	4660	Geaepk32.exe	106
PID 4660 wrote to memory of 4468	4660	Geaepk32.exe	106
PID 4660 wrote to memory of 4468	4660	Geaepk32.exe	106
PID 4468 wrote to memory of 1288	4468	Gbeejp32.exe	107
PID 4468 wrote to memory of 1288	4468	Gbeejp32.exe	107
PID 4468 wrote to memory of 1288	4468	Gbeejp32.exe	107
PID 1288 wrote to memory of 1328	1288	Hfcnpn32.exe	108
PID 1288 wrote to memory of 1328	1288	Hfcnpn32.exe	108
PID 1288 wrote to memory of 1328	1288	Hfcnpn32.exe	108
PID 1328 wrote to memory of 2452	1328	Hoobdp32.exe	109
PID 1328 wrote to memory of 2452	1328	Hoobdp32.exe	109
PID 1328 wrote to memory of 2452	1328	Hoobdp32.exe	109
PID 2452 wrote to memory of 3120	2452	Hfhgkmpj.exe	110
PID 2452 wrote to memory of 3120	2452	Hfhgkmpj.exe	110
PID 2452 wrote to memory of 3120	2452	Hfhgkmpj.exe	110
PID 3120 wrote to memory of 4552	3120	Hoclopne.exe	111
PID 3120 wrote to memory of 4552	3120	Hoclopne.exe	111
PID 3120 wrote to memory of 4552	3120	Hoclopne.exe	111
PID 4552 wrote to memory of 4668	4552	Ifomll32.exe	112
PID 4552 wrote to memory of 4668	4552	Ifomll32.exe	112
PID 4552 wrote to memory of 4668	4552	Ifomll32.exe	112
PID 4668 wrote to memory of 4848	4668	Iojbpo32.exe	113
PID 4668 wrote to memory of 4848	4668	Iojbpo32.exe	113
PID 4668 wrote to memory of 4848	4668	Iojbpo32.exe	113
PID 4848 wrote to memory of 1488	4848	Iefgbh32.exe	114

C:\Users\Admin\AppData\Local\Temp\NEAS.5b094378063d4717a452284c7ce1f450.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5b094378063d4717a452284c7ce1f450.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\Emmdom32.exe
  C:\Windows\system32\Emmdom32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\Eejeiocj.exe
    C:\Windows\system32\Eejeiocj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\SysWOW64\Fihnomjp.exe
      C:\Windows\system32\Fihnomjp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3260
      - C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        23⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        24⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        25⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        26⤵
        Executes dropped EXE
        
        PID:476
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        27⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        28⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        29⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        30⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        32⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        33⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        34⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        35⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        37⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        38⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        39⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        40⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        41⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        42⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3380
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        45⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        46⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        47⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        49⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        50⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        51⤵
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        52⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        54⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        55⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        59⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        60⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        61⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        62⤵
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        63⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        64⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        65⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        66⤵
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        67⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        68⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        69⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        70⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        71⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        73⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        74⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        75⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        76⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        79⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        80⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        81⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        82⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        84⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        85⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        86⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        87⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        88⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        89⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        90⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        91⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        93⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        94⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        95⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        96⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        98⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        99⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        100⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        101⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        102⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        103⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        104⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        105⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        107⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        108⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        109⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        110⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        111⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        113⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        114⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        115⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        117⤵
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        118⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        119⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        120⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        121⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        122⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        123⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        124⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        125⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        126⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        127⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        128⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        129⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        130⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        131⤵
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        132⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        133⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        134⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        136⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        138⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        139⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        140⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        141⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        143⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        145⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        146⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        147⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        148⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        149⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        150⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        152⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        154⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        155⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        156⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        157⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        158⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        159⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        160⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        161⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        162⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        163⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        164⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        165⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        166⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        167⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        168⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        169⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        170⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        171⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        173⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        174⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        175⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        176⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        177⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        178⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        179⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        181⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        182⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        183⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        184⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        185⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        186⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        187⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        188⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        189⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        190⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        191⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        192⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        194⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        195⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        196⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        197⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        198⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        200⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        201⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        202⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        204⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        205⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        206⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        208⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        209⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        210⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        213⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        214⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        215⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        216⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        217⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        218⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        219⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        220⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        221⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        222⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        223⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        224⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        225⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        226⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        227⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        229⤵
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        231⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        232⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        233⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        234⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        236⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        237⤵
        Drops file in System32 directory
        
        PID:1768
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        238⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        240⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        241⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7464
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        243⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        246⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        247⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        248⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        249⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        250⤵
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        251⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        252⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        253⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        254⤵
        Modifies registry class
        
        PID:8284
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        255⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        256⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        257⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        258⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        259⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        260⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        261⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        263⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        264⤵
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8788
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        266⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        267⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        268⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        269⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        270⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        271⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        272⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        273⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        274⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        275⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        276⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        277⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        278⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        279⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        280⤵
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        282⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        283⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        284⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2844
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        286⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Pofhbgmn.exe
        
        C:\Windows\system32\Pofhbgmn.exe
        287⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        288⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        289⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        290⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        291⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        293⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        294⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        295⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        297⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        298⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        299⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        300⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        301⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        302⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        303⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        304⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        305⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        306⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        307⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        308⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        309⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        310⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        311⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        312⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        313⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        314⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        315⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        316⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        317⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        318⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        319⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        320⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        321⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        322⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        323⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        324⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        325⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9508
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        327⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        328⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        329⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        330⤵
        Drops file in System32 directory
        
        PID:9724
        
        C:\Windows\SysWOW64\Egknji32.exe
        
        C:\Windows\system32\Egknji32.exe
        331⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        332⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        333⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        334⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        336⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Enllgbcl.exe
        
        C:\Windows\system32\Enllgbcl.exe
        337⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Egdqph32.exe
        
        C:\Windows\system32\Egdqph32.exe
        338⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        339⤵
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        340⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        341⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Fgijkgeh.exe
        
        C:\Windows\system32\Fgijkgeh.exe
        342⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        343⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        344⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        345⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9452
        
        C:\Windows\SysWOW64\Gjnlha32.exe
        
        C:\Windows\system32\Gjnlha32.exe
        347⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        348⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        349⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9624
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        352⤵
        Modifies registry class
        
        PID:9752
        
        C:\Windows\SysWOW64\Gfjfhbpb.exe
        
        C:\Windows\system32\Gfjfhbpb.exe
        353⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ggicbe32.exe
        
        C:\Windows\system32\Ggicbe32.exe
        354⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        355⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        356⤵
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        358⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        359⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        360⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        361⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        362⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        363⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9520
        
        C:\Windows\SysWOW64\Hqkjaifk.exe
        
        C:\Windows\system32\Hqkjaifk.exe
        365⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        366⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        367⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ifjoop32.exe
        
        C:\Windows\system32\Ifjoop32.exe
        368⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        369⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        370⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        371⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        372⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Igneda32.exe
        
        C:\Windows\system32\Igneda32.exe
        373⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        374⤵
        Modifies registry class
        
        PID:10220
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        375⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Jffokn32.exe
        
        C:\Windows\system32\Jffokn32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        377⤵
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Jgekdq32.exe
        
        C:\Windows\system32\Jgekdq32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:500
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        379⤵
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        380⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        381⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        382⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        383⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Jeneidji.exe
        
        C:\Windows\system32\Jeneidji.exe
        384⤵
        Drops file in System32 directory
        
        PID:3712
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        385⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        386⤵
        Drops file in System32 directory
        
        PID:10204
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        387⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        388⤵
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2144
        
        C:\Windows\SysWOW64\Keekjc32.exe
        
        C:\Windows\system32\Keekjc32.exe
        390⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Knmpbi32.exe
        
        C:\Windows\system32\Knmpbi32.exe
        391⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        392⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Knpmhh32.exe
        
        C:\Windows\system32\Knpmhh32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9884
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        394⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        395⤵
        Drops file in System32 directory
        
        PID:3860
        
        C:\Windows\SysWOW64\Lelajb32.exe
        
        C:\Windows\system32\Lelajb32.exe
        396⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        397⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        398⤵
        
        PID:476
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        399⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Ldckan32.exe
        
        C:\Windows\system32\Ldckan32.exe
        400⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        401⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Lokldg32.exe
        
        C:\Windows\system32\Lokldg32.exe
        402⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        403⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        404⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        405⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        406⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        407⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        408⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        409⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Mmjlkb32.exe
        
        C:\Windows\system32\Mmjlkb32.exe
        410⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3752
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        412⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        413⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Najagp32.exe
        
        C:\Windows\system32\Najagp32.exe
        414⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:824
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        416⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        417⤵
        Drops file in System32 directory
        
        PID:5028
        
        C:\Windows\SysWOW64\Nockkcjg.exe
        
        C:\Windows\system32\Nockkcjg.exe
        418⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        419⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Nkjlqd32.exe
        
        C:\Windows\system32\Nkjlqd32.exe
        420⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        421⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        422⤵
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Ononmo32.exe
        
        C:\Windows\system32\Ononmo32.exe
        423⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        424⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        425⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Okeklcen.exe
        
        C:\Windows\system32\Okeklcen.exe
        426⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Philfgdh.exe
        
        C:\Windows\system32\Philfgdh.exe
        427⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        428⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Phlikg32.exe
        
        C:\Windows\system32\Phlikg32.exe
        429⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Poeahaib.exe
        
        C:\Windows\system32\Poeahaib.exe
        430⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        431⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        432⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        433⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        434⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        435⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        436⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Qnbdjl32.exe
        
        C:\Windows\system32\Qnbdjl32.exe
        437⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        438⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        439⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Adnilfnl.exe
        
        C:\Windows\system32\Adnilfnl.exe
        440⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        441⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Abbiej32.exe
        
        C:\Windows\system32\Abbiej32.exe
        442⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        443⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        444⤵
        Drops file in System32 directory
        
        PID:10548
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        445⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        446⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        447⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        448⤵
        Modifies registry class
        
        PID:10716
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        449⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        450⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10840
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        452⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        453⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        454⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        455⤵
        Drops file in System32 directory
        
        PID:11008
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        456⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        457⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11144
        
        C:\Windows\SysWOW64\Clmckmcq.exe
        
        C:\Windows\system32\Clmckmcq.exe
        459⤵
        Modifies registry class
        
        PID:11188
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        460⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        461⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        462⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Cicqja32.exe
        
        C:\Windows\system32\Cicqja32.exe
        463⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        464⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        465⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Cppelkeb.exe
        
        C:\Windows\system32\Cppelkeb.exe
        466⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Cemndbci.exe
        
        C:\Windows\system32\Cemndbci.exe
        467⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        468⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        469⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        470⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        471⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        472⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        473⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        474⤵
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Dolinf32.exe
        
        C:\Windows\system32\Dolinf32.exe
        475⤵
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        476⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        477⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        478⤵
        Drops file in System32 directory
        
        PID:1412
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        479⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        480⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        481⤵
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        482⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        483⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        484⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        485⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        486⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        487⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Fhefmjlp.exe
        
        C:\Windows\system32\Fhefmjlp.exe
        488⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        489⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        490⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        491⤵
        Modifies registry class
        
        PID:10936
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        492⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        493⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        494⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        495⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Fpeaeedg.exe
        
        C:\Windows\system32\Fpeaeedg.exe
        496⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        497⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Gedfblql.exe
        
        C:\Windows\system32\Gedfblql.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        499⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10704
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        501⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Gjdknjep.exe
        
        C:\Windows\system32\Gjdknjep.exe
        502⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Gpodkdll.exe
        
        C:\Windows\system32\Gpodkdll.exe
        503⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        504⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        505⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        506⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        507⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        508⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        509⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        510⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        511⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        512⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Hfgloiqf.exe
        
        C:\Windows\system32\Hfgloiqf.exe
        513⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        514⤵
        Modifies registry class
        
        PID:10904
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        515⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        516⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        517⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        518⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        519⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        520⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        521⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Iiaggc32.exe
        
        C:\Windows\system32\Iiaggc32.exe
        522⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        523⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        524⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        525⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        526⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        527⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        528⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        529⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Jginej32.exe
        
        C:\Windows\system32\Jginej32.exe
        530⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        531⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        532⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        533⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        534⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        535⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Kgqdfi32.exe
        
        C:\Windows\system32\Kgqdfi32.exe
        536⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        537⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        538⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        539⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        540⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        541⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        542⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        543⤵
        Drops file in System32 directory
        
        PID:10652
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        544⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        545⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        546⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        547⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        548⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        549⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        550⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        551⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        552⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        553⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        554⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        555⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        556⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        557⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        558⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        559⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        561⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Nmpkakak.exe
        
        C:\Windows\system32\Nmpkakak.exe
        563⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        564⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        565⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Npadcfnl.exe
        
        C:\Windows\system32\Npadcfnl.exe
        566⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        567⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        568⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        569⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        570⤵
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        571⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        572⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        573⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Okbhlm32.exe
        
        C:\Windows\system32\Okbhlm32.exe
        575⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Pdklebje.exe
        
        C:\Windows\system32\Pdklebje.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        577⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        578⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        579⤵
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Pdofpb32.exe
        
        C:\Windows\system32\Pdofpb32.exe
        580⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        581⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        582⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        583⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        584⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        585⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        586⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Qgehml32.exe
        
        C:\Windows\system32\Qgehml32.exe
        587⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        588⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Qjeaog32.exe
        
        C:\Windows\system32\Qjeaog32.exe
        589⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        590⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        591⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        592⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        593⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        594⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        595⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        596⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Akopoi32.exe
        
        C:\Windows\system32\Akopoi32.exe
        597⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        598⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        599⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        600⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        601⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Bjfjee32.exe
        
        C:\Windows\system32\Bjfjee32.exe
        602⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        603⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        604⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        605⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800

C:\Windows\SysWOW64\Bglgdi32.exe
C:\Windows\system32\Bglgdi32.exe
1⤵
PID:6620
- C:\Windows\SysWOW64\Bqdlmo32.exe
  C:\Windows\system32\Bqdlmo32.exe
  2⤵
  - Modifies registry class
  PID:6776
- - C:\Windows\SysWOW64\Bgodjiio.exe
    C:\Windows\system32\Bgodjiio.exe
    3⤵
    PID:6640
  - - C:\Windows\SysWOW64\Cnhlgc32.exe
      C:\Windows\system32\Cnhlgc32.exe
      4⤵
      Modifies registry class
      PID:3420
    - - C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        5⤵
        
        PID:6732
      - C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        6⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ceeaim32.exe
        
        C:\Windows\system32\Ceeaim32.exe
        7⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        8⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        9⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        10⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        11⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        12⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        13⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        14⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        15⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        17⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        18⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        19⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        21⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        22⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        23⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        24⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        25⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        26⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        27⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Ehklmd32.exe
        
        C:\Windows\system32\Ehklmd32.exe
        28⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Enedio32.exe
        
        C:\Windows\system32\Enedio32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Engaon32.exe
        
        C:\Windows\system32\Engaon32.exe
        30⤵
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Ejnbdp32.exe
        
        C:\Windows\system32\Ejnbdp32.exe
        32⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        33⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Fjpoio32.exe
        
        C:\Windows\system32\Fjpoio32.exe
        34⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Fhdocc32.exe
        
        C:\Windows\system32\Fhdocc32.exe
        35⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        36⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Fhflhcfa.exe
        
        C:\Windows\system32\Fhflhcfa.exe
        37⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Fejlbgek.exe
        
        C:\Windows\system32\Fejlbgek.exe
        38⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Flddoa32.exe
        
        C:\Windows\system32\Flddoa32.exe
        39⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Fbnmkk32.exe
        
        C:\Windows\system32\Fbnmkk32.exe
        40⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Fhkecb32.exe
        
        C:\Windows\system32\Fhkecb32.exe
        41⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        42⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Gbcffk32.exe
        
        C:\Windows\system32\Gbcffk32.exe
        43⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gimoce32.exe
        
        C:\Windows\system32\Gimoce32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        45⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        46⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        47⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Ghdhja32.exe
        
        C:\Windows\system32\Ghdhja32.exe
        48⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        49⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gehice32.exe
        
        C:\Windows\system32\Gehice32.exe
        50⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        51⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        52⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        53⤵
        Modifies registry class
        
        PID:4388
        
        C:\Windows\SysWOW64\Hkgnalep.exe
        
        C:\Windows\system32\Hkgnalep.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Hhlnjpdi.exe
        
        C:\Windows\system32\Hhlnjpdi.exe
        55⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        56⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        57⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        58⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Hhpheo32.exe
        
        C:\Windows\system32\Hhpheo32.exe
        59⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Hcflch32.exe
        
        C:\Windows\system32\Hcflch32.exe
        60⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        61⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        62⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Iefedcmk.exe
        
        C:\Windows\system32\Iefedcmk.exe
        63⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        64⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Icmbcg32.exe
        
        C:\Windows\system32\Icmbcg32.exe
        65⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Ijgjpaao.exe
        
        C:\Windows\system32\Ijgjpaao.exe
        66⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Icooig32.exe
        
        C:\Windows\system32\Icooig32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Ifnkeb32.exe
        
        C:\Windows\system32\Ifnkeb32.exe
        68⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ikjcmi32.exe
        
        C:\Windows\system32\Ikjcmi32.exe
        69⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Ifphkbep.exe
        
        C:\Windows\system32\Ifphkbep.exe
        70⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        71⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jbghpc32.exe
        
        C:\Windows\system32\Jbghpc32.exe
        72⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Jllmml32.exe
        
        C:\Windows\system32\Jllmml32.exe
        73⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        74⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        75⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Jjbjlpga.exe
        
        C:\Windows\system32\Jjbjlpga.exe
        76⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        77⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        78⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        79⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        80⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        81⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        82⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Kofheeoq.exe
        
        C:\Windows\system32\Kofheeoq.exe
        83⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        84⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        85⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        86⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        88⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        89⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Lmcldhfp.exe
        
        C:\Windows\system32\Lmcldhfp.exe
        90⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        91⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Lmfhjhdm.exe
        
        C:\Windows\system32\Lmfhjhdm.exe
        92⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        93⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        94⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        95⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        96⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        97⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        98⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        99⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        100⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Mlbllc32.exe
        
        C:\Windows\system32\Mlbllc32.exe
        101⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        102⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        103⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Mldhacpj.exe
        
        C:\Windows\system32\Mldhacpj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11372
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        105⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Mpbaga32.exe
        
        C:\Windows\system32\Mpbaga32.exe
        106⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        107⤵
        Modifies registry class
        
        PID:11504
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        108⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11588
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        110⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Npgjbabk.exe
        
        C:\Windows\system32\Npgjbabk.exe
        111⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Nfabok32.exe
        
        C:\Windows\system32\Nfabok32.exe
        112⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11748
        
        C:\Windows\SysWOW64\Nbhcdl32.exe
        
        C:\Windows\system32\Nbhcdl32.exe
        114⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Nmmgae32.exe
        
        C:\Windows\system32\Nmmgae32.exe
        115⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Nbjpjl32.exe
        
        C:\Windows\system32\Nbjpjl32.exe
        116⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Nidhffef.exe
        
        C:\Windows\system32\Nidhffef.exe
        117⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Npnqcpmc.exe
        
        C:\Windows\system32\Npnqcpmc.exe
        118⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Njceqili.exe
        
        C:\Windows\system32\Njceqili.exe
        119⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        120⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12044 -s 412
        121⤵
        Program crash
        
        PID:12100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 12044 -ip 12044
1⤵
PID:12068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amfhgj32.exe

Filesize
111KB

MD5
16b2f7d72d7668477c9fff2c7c3dccb6

SHA1
89536ca41c804338c8e305c0679ef0494270bd2f

SHA256
12b6dc23b403a185c93708997a26821fd46ff49a4650571d7301d8d22ae41489

SHA512
c3e5156d865da4778ca067c31333c4ce25494cd23cb097f4b5ea3ec9d46d597c8efccced33f27748af44962d6463aca604e05ed77b2b83ad0004bd2ba1c6a4a3

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
111KB

MD5
35255444cc89a741458f065bd2b743d9

SHA1
8565c038273b4b2fc22428a623eebaed06be13cf

SHA256
cc3e551fb4ebd8e35d51f13dbb6125040290518c0a27ba4823f82164cba48be3

SHA512
9fee946f87bc63c03e711a0b6a77a536e06585992e8aab9ce12af225d2033cb45084b48ad60b458084bc78a0371e3e708c3cbc627e0b5b8cdd9ff067aede44c2

Download Submit
C:\Windows\SysWOW64\Dbhlikpf.exe

Filesize
111KB

MD5
cc7926d62f367a525654ea32b5f2da07

SHA1
f5a67fa69e86c1327b5b645b0ef8a15df2cb5363

SHA256
da43c3e102c5ff1add020545e58b8c6863b26a93dff3b3a47d385d38d6d033ca

SHA512
d39db3956465abd9f82b9b4afd864847ac3fe2e448b0c74ebbad3d2ab6fcc45b5ae75e7f775308f2d4696fe41a447cd798045bda67e248777f6e7745e11a3e1f

Download Submit
C:\Windows\SysWOW64\Dgbanq32.exe

Filesize
111KB

MD5
8f566361416d2c7ef060c169a02ef707

SHA1
2d910f35eceaadf10f4b3d2d18e3d3b0b5c8cb9c

SHA256
049a21a8816522e927c6a8a662c9d734191fa506b3ce6c9ba0f61737cdec7e78

SHA512
ae034c83c5ca8bf3af2f3ffe54dd8d6675ad1c9f97fbca5c76c2c0793a6ef29c4602e309fd6f96d8536a8b2ee27d59e6915dcfe63961cc4dd6a0ee3deca6efba

Download Submit
C:\Windows\SysWOW64\Dpoiho32.exe

Filesize
111KB

MD5
8881be04da77f2df2b0c07d6a90bd261

SHA1
e32fbd7f84eca32ea90be85bccbfaa197aea7bc1

SHA256
5fcdee5ae108fa23d1bbb60d10edbef3f28b1ebf925195df3ac80d89ad1c8180

SHA512
c8121bb25433ebf1488bd1ad3dd58d7783e1cd9c46687316a8b6496fd2d4364d62cf3da3660ec845329f63faee236899788d46356ff1eb1a6d290a02dbe86f93

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
111KB

MD5
e1e0588c94925f38b3ccc3d2b6f24280

SHA1
d26f1a417cfa0abc46899e46c95077bb97f9457d

SHA256
14437938a38d76cb35ccef77d6ae9ed33fa477553c697a94c2a36ca6ee4d6c06

SHA512
23846f0cc7e4afed0cbe64408207fbb270a13854c6bbe82643879801ea342ad8f73bfe2caf739c300a1b59002538793c950d84ba48f734d92afdb25ddd5ef44f

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
111KB

MD5
e1e0588c94925f38b3ccc3d2b6f24280

SHA1
d26f1a417cfa0abc46899e46c95077bb97f9457d

SHA256
14437938a38d76cb35ccef77d6ae9ed33fa477553c697a94c2a36ca6ee4d6c06

SHA512
23846f0cc7e4afed0cbe64408207fbb270a13854c6bbe82643879801ea342ad8f73bfe2caf739c300a1b59002538793c950d84ba48f734d92afdb25ddd5ef44f

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
111KB

MD5
6ac174e6fdced9d80904b5441ef2b6a9

SHA1
fea37baf010a131e274ca44d083d80ee41ccda4c

SHA256
0eb31b54c4e5ef6419d5dea12388a6a1e1c2adde2726b099f94652495f0e09e8

SHA512
0a9b8b0f945b963775fb54a3c88a99f78212cdc6614af53404521c830fd3d2b7f1ff9264dca94614eea77e9ae9fccf55941d8ac363d4f9f23d52dae14d695cd1

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
111KB

MD5
6ac174e6fdced9d80904b5441ef2b6a9

SHA1
fea37baf010a131e274ca44d083d80ee41ccda4c

SHA256
0eb31b54c4e5ef6419d5dea12388a6a1e1c2adde2726b099f94652495f0e09e8

SHA512
0a9b8b0f945b963775fb54a3c88a99f78212cdc6614af53404521c830fd3d2b7f1ff9264dca94614eea77e9ae9fccf55941d8ac363d4f9f23d52dae14d695cd1

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
111KB

MD5
2fc68850bdc62513f85469b6b16ca820

SHA1
c361775dcf7991ea04482cfc5421ae7d25c29dda

SHA256
0d0796ce9e28217f8651fcf916583a26b8b61a582cf55086b7258c94a4ea0539

SHA512
0600ead87bb53c504a8d5dd96bb1bb9c1d07fd51a612334f348192320320e710b986974eb8ec3d3d5d5712e3b4f2f2d1f32a4af874036ec8d9a89fda93fbef9d

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
111KB

MD5
2fc68850bdc62513f85469b6b16ca820

SHA1
c361775dcf7991ea04482cfc5421ae7d25c29dda

SHA256
0d0796ce9e28217f8651fcf916583a26b8b61a582cf55086b7258c94a4ea0539

SHA512
0600ead87bb53c504a8d5dd96bb1bb9c1d07fd51a612334f348192320320e710b986974eb8ec3d3d5d5712e3b4f2f2d1f32a4af874036ec8d9a89fda93fbef9d

Download Submit
C:\Windows\SysWOW64\Ffceip32.exe

Filesize
111KB

MD5
c12f28c0786a5f40f65b1d0894f87726

SHA1
16e0043eaab76bb38b6a7500c8e7026569ce8445

SHA256
26f1dac39b6079b9ea12357a6c7acd203dd8d110874e890328a7882adfa261bf

SHA512
748a3e6a0b7777c52662b49cc5e7f1d8778ea627eecac253856dbbf18308d1de1a92239882dfb9134e348fc120c0a30f262bf3862a41e8a66e541421a2c8392b

Download Submit
C:\Windows\SysWOW64\Ffceip32.exe

Filesize
111KB

MD5
c12f28c0786a5f40f65b1d0894f87726

SHA1
16e0043eaab76bb38b6a7500c8e7026569ce8445

SHA256
26f1dac39b6079b9ea12357a6c7acd203dd8d110874e890328a7882adfa261bf

SHA512
748a3e6a0b7777c52662b49cc5e7f1d8778ea627eecac253856dbbf18308d1de1a92239882dfb9134e348fc120c0a30f262bf3862a41e8a66e541421a2c8392b

Download Submit
C:\Windows\SysWOW64\Fihnomjp.exe

Filesize
111KB

MD5
a00911e514bbc782f1c36fdd54e0f876

SHA1
9be93e905ad9f88b8a8dd359ca2ff02a4887e43b

SHA256
1177ea946660c286259bed6e31cdfb8d8c36dac9ef91ff4f18975c56bdf0210d

SHA512
00d6e1a3ce8c13564bc33441aa6144fdcf2950378742da1abfbf51aa355a590fa7d3a72c6b1bf8321192e8da5b35eb675f2ee3cd74da3a59e401036528d62d1c

Download Submit
C:\Windows\SysWOW64\Fihnomjp.exe

Filesize
111KB

MD5
a00911e514bbc782f1c36fdd54e0f876

SHA1
9be93e905ad9f88b8a8dd359ca2ff02a4887e43b

SHA256
1177ea946660c286259bed6e31cdfb8d8c36dac9ef91ff4f18975c56bdf0210d

SHA512
00d6e1a3ce8c13564bc33441aa6144fdcf2950378742da1abfbf51aa355a590fa7d3a72c6b1bf8321192e8da5b35eb675f2ee3cd74da3a59e401036528d62d1c

Download Submit
C:\Windows\SysWOW64\Fijkdmhn.exe

Filesize
111KB

MD5
a549d13ea9dd89bb91ca14c9f4fc2164

SHA1
91d1538129ea395fee7256eb3430e3176639421a

SHA256
00ce952b6796b0542985910dac28cc4dcf2124ccb23857dad5cc637e8fcbd412

SHA512
87f19a4b55bdd9118a0cc0c99e8e4fe0b6303aa9526a0f57a17e6d170dfd361d7fefb35ab25f8ded4701cac2cccbdc57ef545bd3548b54b8da5ada02de27284c

Download Submit
C:\Windows\SysWOW64\Fijkdmhn.exe

Filesize
111KB

MD5
a549d13ea9dd89bb91ca14c9f4fc2164

SHA1
91d1538129ea395fee7256eb3430e3176639421a

SHA256
00ce952b6796b0542985910dac28cc4dcf2124ccb23857dad5cc637e8fcbd412

SHA512
87f19a4b55bdd9118a0cc0c99e8e4fe0b6303aa9526a0f57a17e6d170dfd361d7fefb35ab25f8ded4701cac2cccbdc57ef545bd3548b54b8da5ada02de27284c

Download Submit
C:\Windows\SysWOW64\Fkmjaa32.exe

Filesize
111KB

MD5
2082fce054c0fb09bf81a3e470141154

SHA1
315fc2c3ac9154fa1010261200f7325370fe0ed5

SHA256
db8341f3c7bb4b3afe1e45e1b8ee62be14bd577b86416740b3c37eaa76867818

SHA512
152f93d4c4e1f31bc16949c3c0ec2700e1e2d678c0192040fec84ddf6bbf6e2cae76acb848720d3fa91503ddd69c6d7fac982a0c1da0dfae04e8b741dd6a8817

Download Submit
C:\Windows\SysWOW64\Fnnjmbpm.exe

Filesize
111KB

MD5
53198f570b181f1ec1ec3189ebf476b2

SHA1
195059510779fdd43afca5456555be15564ca4c6

SHA256
28a47f960f7c387dbf38755b5240294ea5b5c6bb066265097bd90838d9a999c4

SHA512
1aa662ae164bfb4ce7113135ebc9432e7a4451cb868b199a1970bc7bbb77df970d91a5b34341b09caa9f752084de4b43a6c68549abbfe05fd48eae927d211c7f

Download Submit
C:\Windows\SysWOW64\Fnnjmbpm.exe

Filesize
111KB

MD5
53198f570b181f1ec1ec3189ebf476b2

SHA1
195059510779fdd43afca5456555be15564ca4c6

SHA256
28a47f960f7c387dbf38755b5240294ea5b5c6bb066265097bd90838d9a999c4

SHA512
1aa662ae164bfb4ce7113135ebc9432e7a4451cb868b199a1970bc7bbb77df970d91a5b34341b09caa9f752084de4b43a6c68549abbfe05fd48eae927d211c7f

Download Submit
C:\Windows\SysWOW64\Fpgpgfmh.exe

Filesize
111KB

MD5
eeb4125154466dad0ae09882e44110ae

SHA1
87c01a7ddc2386f0acebebf819c2a45a4d7be52b

SHA256
3443cc51225de7c10982d17861cc1f8a447b5319eac7b5be5dadd57320909609

SHA512
485ee9eab4ecdeb27af0eccd717a2350a6fff75a3e8763a0e25a405926243add79af9ff33b9f39988ffac85a0251666fbda678c949a1ba1e12e496039e566c46

Download Submit
C:\Windows\SysWOW64\Fpgpgfmh.exe

Filesize
111KB

MD5
eeb4125154466dad0ae09882e44110ae

SHA1
87c01a7ddc2386f0acebebf819c2a45a4d7be52b

SHA256
3443cc51225de7c10982d17861cc1f8a447b5319eac7b5be5dadd57320909609

SHA512
485ee9eab4ecdeb27af0eccd717a2350a6fff75a3e8763a0e25a405926243add79af9ff33b9f39988ffac85a0251666fbda678c949a1ba1e12e496039e566c46

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
111KB

MD5
2cab515f3a8cbb51a6867fd83497e8a8

SHA1
16903532189bf7c787a920bc37d94954c1b694c4

SHA256
3f1c041775d6a296feafd3acdfe5cc5999260b3472f08856560aa76276b6c0de

SHA512
2b2e503b46ae55d26f593ab557fee4407d46d35aa0d3ee0786f1ba938e4712e09d97a892e81e88b7db2d648d1fda54375077afdb5a68cb2b5c4019756ca303fa

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
111KB

MD5
2cab515f3a8cbb51a6867fd83497e8a8

SHA1
16903532189bf7c787a920bc37d94954c1b694c4

SHA256
3f1c041775d6a296feafd3acdfe5cc5999260b3472f08856560aa76276b6c0de

SHA512
2b2e503b46ae55d26f593ab557fee4407d46d35aa0d3ee0786f1ba938e4712e09d97a892e81e88b7db2d648d1fda54375077afdb5a68cb2b5c4019756ca303fa

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
111KB

MD5
6268ef20347fd0255065d08434b822c3

SHA1
cb01403b548942bce188b1c145b732b7e955bf36

SHA256
5ca6c235144f26ec7c4084f7b96542e0b4730171960d777bdde06fccf9795f13

SHA512
0b839901ca54e2f5ae0fd34990cdcbb29944cbbb54af7df6642dcdef2722ec6be81fd97131baffd1dc9c8a64c98747365f72b0111d693d7e01ec5227d1b205f3

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
111KB

MD5
6268ef20347fd0255065d08434b822c3

SHA1
cb01403b548942bce188b1c145b732b7e955bf36

SHA256
5ca6c235144f26ec7c4084f7b96542e0b4730171960d777bdde06fccf9795f13

SHA512
0b839901ca54e2f5ae0fd34990cdcbb29944cbbb54af7df6642dcdef2722ec6be81fd97131baffd1dc9c8a64c98747365f72b0111d693d7e01ec5227d1b205f3

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
111KB

MD5
48a91a681832579354826a69e201636b

SHA1
c9d62fd0d4a5aaf8fdccaa103e7cca2b6bda2530

SHA256
cf6bbe96c17679ee41b4e8db712931de5dba03180f7bfbc92d471292e1358ea1

SHA512
9d346cfd827a2d4be8f9e98faa37c64c207b8a5b0739fa05ae5b1ef2c5c7de200337f04bc972cf1f696a81b0ea8ae70ea0877478521743aaa8a6fe29947666a5

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
111KB

MD5
48a91a681832579354826a69e201636b

SHA1
c9d62fd0d4a5aaf8fdccaa103e7cca2b6bda2530

SHA256
cf6bbe96c17679ee41b4e8db712931de5dba03180f7bfbc92d471292e1358ea1

SHA512
9d346cfd827a2d4be8f9e98faa37c64c207b8a5b0739fa05ae5b1ef2c5c7de200337f04bc972cf1f696a81b0ea8ae70ea0877478521743aaa8a6fe29947666a5

Download Submit
C:\Windows\SysWOW64\Gjnlha32.exe

Filesize
111KB

MD5
0e5b05ef40fb0235ff9f6811196bd90a

SHA1
65a2c8d22884b0bbfac407d9ff45f22b8d94b983

SHA256
cfea82b11389f4fdcde9cef60d49ef04c4a56f52723b080c990c5199471e0429

SHA512
e3374e05ff1df7583f11f653b4a8548e650da393a528afbac352bc690faa0ddd4c0c4bd21df2cde721792d30d89671d4aaa59b02f46099d6caf74716f1d39dc5

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
111KB

MD5
4eb537474a32b3e63c79b7990aa08915

SHA1
a0e8becf61e60b70fffe0d2451df44b5656efb0d

SHA256
beb809a0e9f65220b3466dea78f489b704a92a2c0706bfa6c1ec82d54a90814d

SHA512
ac6547cd0fe189656edaf80af0fe9188bbeb8501ea83e5556d91e3d9a1bc4fb2d0ff2fdd9c633be9be926ec51747924b4257cb0a3678f1967dcd0fa2f232c34b

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
111KB

MD5
4eb537474a32b3e63c79b7990aa08915

SHA1
a0e8becf61e60b70fffe0d2451df44b5656efb0d

SHA256
beb809a0e9f65220b3466dea78f489b704a92a2c0706bfa6c1ec82d54a90814d

SHA512
ac6547cd0fe189656edaf80af0fe9188bbeb8501ea83e5556d91e3d9a1bc4fb2d0ff2fdd9c633be9be926ec51747924b4257cb0a3678f1967dcd0fa2f232c34b

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
111KB

MD5
35419851e37e7a7c7f12d24a15d035b2

SHA1
53402ebb52f98cb46a4641a289d64ec0462f93a3

SHA256
2981bcbc2fbfe677394513ef8acebc0b8b4344de44dc20bcc1ed4a89ee73aa6a

SHA512
c00b7754f160cd81f3de5e0e7be5737af794d6c5b6e848b50c48f655ffa15e648ecc224e151ca9c8fb75c97f1ae6ac0e88d7c902a86afdb47e5b68b669270b7e

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
111KB

MD5
35419851e37e7a7c7f12d24a15d035b2

SHA1
53402ebb52f98cb46a4641a289d64ec0462f93a3

SHA256
2981bcbc2fbfe677394513ef8acebc0b8b4344de44dc20bcc1ed4a89ee73aa6a

SHA512
c00b7754f160cd81f3de5e0e7be5737af794d6c5b6e848b50c48f655ffa15e648ecc224e151ca9c8fb75c97f1ae6ac0e88d7c902a86afdb47e5b68b669270b7e

Download Submit
C:\Windows\SysWOW64\Gpbpbecj.exe

Filesize
111KB

MD5
69c3d53bf4ed2cdd78197126f4eeac31

SHA1
3cb357c4f32a4e4a525956c663d295a739d2f939

SHA256
0cb6abbc25daa09c3db7ca96bda0ffa1fbbdc166305d2234383b1c51572954a3

SHA512
2f591a0e4776afd7bb03cb1d88196957228c41aa4d0a0af9067999100c02c79b66c7af3dd87d015994247e20f94f28016d4a4208a8308c9b665035740fbfc1c3

Download Submit
C:\Windows\SysWOW64\Gpbpbecj.exe

Filesize
111KB

MD5
69c3d53bf4ed2cdd78197126f4eeac31

SHA1
3cb357c4f32a4e4a525956c663d295a739d2f939

SHA256
0cb6abbc25daa09c3db7ca96bda0ffa1fbbdc166305d2234383b1c51572954a3

SHA512
2f591a0e4776afd7bb03cb1d88196957228c41aa4d0a0af9067999100c02c79b66c7af3dd87d015994247e20f94f28016d4a4208a8308c9b665035740fbfc1c3

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
111KB

MD5
6e740854212cc5a184939b77ef04d2b7

SHA1
11d9cdb512ae86d229897af91bdc4ece95a01d89

SHA256
a561f8f64804203150593dca3ddc593f26c2b90a3fced2b6aa59a9a6395005e0

SHA512
4de97d5fc42daa94bf2202f228b024f727859aec15d784cd4a94770c15dd433e370981e698e01e3c771c07ed2ba8dc38e6551d7f0bf869da32723a57e9cf0b49

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
111KB

MD5
6e740854212cc5a184939b77ef04d2b7

SHA1
11d9cdb512ae86d229897af91bdc4ece95a01d89

SHA256
a561f8f64804203150593dca3ddc593f26c2b90a3fced2b6aa59a9a6395005e0

SHA512
4de97d5fc42daa94bf2202f228b024f727859aec15d784cd4a94770c15dd433e370981e698e01e3c771c07ed2ba8dc38e6551d7f0bf869da32723a57e9cf0b49

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
111KB

MD5
b254691608c2e52e3126965ec2b9737b

SHA1
549aef49c8bc17e94a63dace2997e6eb44cdc423

SHA256
692a5c10fe2e35d1e1dd377363c3270868b046dadf8ca971aa4cc95b0997bc41

SHA512
fa43dfe0972a8bda5e1785c4f68502e52dd71b27984a0cf3c5d3587d73cd9fa5d6300d925c98f9c2a372a6291b1ffabb5d25ad6124404712b5e7e2d7bd190c75

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
111KB

MD5
b254691608c2e52e3126965ec2b9737b

SHA1
549aef49c8bc17e94a63dace2997e6eb44cdc423

SHA256
692a5c10fe2e35d1e1dd377363c3270868b046dadf8ca971aa4cc95b0997bc41

SHA512
fa43dfe0972a8bda5e1785c4f68502e52dd71b27984a0cf3c5d3587d73cd9fa5d6300d925c98f9c2a372a6291b1ffabb5d25ad6124404712b5e7e2d7bd190c75

Download Submit
C:\Windows\SysWOW64\Hoclopne.exe

Filesize
111KB

MD5
658713ef2cc8f1a07e5d934e016b882a

SHA1
417a97dafcb900eda99a1296233181f7fb234ef8

SHA256
6d766372af21cb51f244a576cc3d18dcd7b4d4eb3d3a0886cdf5f8634cb5ac68

SHA512
9d2f56fdaeb861c7df3bdd298183665795c59bc57a35c16fab1c25ef4ec76bf45d7361e7737d398e834a7b24897564c2d9ca8e8ee923a0b51d33a155147c7d9b

Download Submit
C:\Windows\SysWOW64\Hoclopne.exe

Filesize
111KB

MD5
658713ef2cc8f1a07e5d934e016b882a

SHA1
417a97dafcb900eda99a1296233181f7fb234ef8

SHA256
6d766372af21cb51f244a576cc3d18dcd7b4d4eb3d3a0886cdf5f8634cb5ac68

SHA512
9d2f56fdaeb861c7df3bdd298183665795c59bc57a35c16fab1c25ef4ec76bf45d7361e7737d398e834a7b24897564c2d9ca8e8ee923a0b51d33a155147c7d9b

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
111KB

MD5
fddabdc25997db3be78a92aa7e9fb4f5

SHA1
5265bcd5e671e50684cb64474926a938440cca96

SHA256
2982fd3f92c115e55450322a98f1912b984725326c7150ea057cea3e0a1d0f51

SHA512
30dc2e090785ef2ce2f7eb915feba1dec611919c2357dd92198dd24838ea14288e8e839545659e20e86ec8ad5fb5a1f1fbe4194bc12434752b8f42948828ca15

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
111KB

MD5
fddabdc25997db3be78a92aa7e9fb4f5

SHA1
5265bcd5e671e50684cb64474926a938440cca96

SHA256
2982fd3f92c115e55450322a98f1912b984725326c7150ea057cea3e0a1d0f51

SHA512
30dc2e090785ef2ce2f7eb915feba1dec611919c2357dd92198dd24838ea14288e8e839545659e20e86ec8ad5fb5a1f1fbe4194bc12434752b8f42948828ca15

Download Submit
C:\Windows\SysWOW64\Iefgbh32.exe

Filesize
111KB

MD5
6ab1749fb8eda1718c8f166c6b014c92

SHA1
11a2119f67903f771b08d0a04386647d4101d9d3

SHA256
04dfb98d24021d1c591dac6d841943416fcec5235c1814ab306000898172b6e1

SHA512
328f1d23a78b3afbf132bf7717186929c0790c4136b6db55a9c5baa550c4a54c0308308286546311314b362b53e3de8c972dcf576633ecb0b531acbf483eca4b

Download Submit
C:\Windows\SysWOW64\Iefgbh32.exe

Filesize
111KB

MD5
6ab1749fb8eda1718c8f166c6b014c92

SHA1
11a2119f67903f771b08d0a04386647d4101d9d3

SHA256
04dfb98d24021d1c591dac6d841943416fcec5235c1814ab306000898172b6e1

SHA512
328f1d23a78b3afbf132bf7717186929c0790c4136b6db55a9c5baa550c4a54c0308308286546311314b362b53e3de8c972dcf576633ecb0b531acbf483eca4b

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
111KB

MD5
bdde84153feb773efa32b9c5aae6bd2f

SHA1
d49d636b1c93bef854891bd4e5270a382774823a

SHA256
e302feaddc1a5ef486a382ed5e246a546f3cc7243a748c55b86c82f472d89511

SHA512
ad00acb6fdbeca3876cebc3d3e29adfe5a4b5860511b1756beff60831d6be7fbd752f16beefd5a2e124c50c11c7e3424a47dad6deaf1cf928a2a819dba7c561e

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
111KB

MD5
bdde84153feb773efa32b9c5aae6bd2f

SHA1
d49d636b1c93bef854891bd4e5270a382774823a

SHA256
e302feaddc1a5ef486a382ed5e246a546f3cc7243a748c55b86c82f472d89511

SHA512
ad00acb6fdbeca3876cebc3d3e29adfe5a4b5860511b1756beff60831d6be7fbd752f16beefd5a2e124c50c11c7e3424a47dad6deaf1cf928a2a819dba7c561e

Download Submit
C:\Windows\SysWOW64\Igfclkdj.exe

Filesize
111KB

MD5
f05ca269f045eeaf8148b7049d0e5424

SHA1
c73094c4fff581d75ac4e60e5e840c7add0ceba4

SHA256
47aae22e5db5affa439fd4e00c77c1872505a36b76d276e1227bafa33aeb157f

SHA512
519b2bfccd4b28d926b67702b2e0a63afae26df3da90ce1e8f99e6adca4a9dad738758bb53b855b3ef9ae5b675f559d231ab13fd45373941ff2d3c657d25c303

Download Submit
C:\Windows\SysWOW64\Igfclkdj.exe

Filesize
111KB

MD5
f05ca269f045eeaf8148b7049d0e5424

SHA1
c73094c4fff581d75ac4e60e5e840c7add0ceba4

SHA256
47aae22e5db5affa439fd4e00c77c1872505a36b76d276e1227bafa33aeb157f

SHA512
519b2bfccd4b28d926b67702b2e0a63afae26df3da90ce1e8f99e6adca4a9dad738758bb53b855b3ef9ae5b675f559d231ab13fd45373941ff2d3c657d25c303

Download Submit
C:\Windows\SysWOW64\Inkjfk32.exe

Filesize
111KB

MD5
b1a8ea4d1335eb98f574e970c5ced0eb

SHA1
82d280d68823b7f40d4b00fc719ccc93c3af0399

SHA256
6b828331c0e7f06b997be569db0768f0acda06c96f3e1ad6706dc19d42add7a4

SHA512
9b5c546c6302d4122374f02e96b272432e39b5a88960ac772757483a6091dc762343a24d97bdcaae8d0cd342f7574af467777eecb4ed41c45ea1388a036b2c3c

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
111KB

MD5
3dd43d3ce6086c62fac3c38c0302b9dd

SHA1
bcc4e75e65ecff785c878674062f60c977125bb4

SHA256
b232c290626c6ba0f3f4a0d1dc90957282709049eead7f491682471dc2d46f1b

SHA512
a86827b71c04d6742a68e0c5eaa09613b42fb231b3b541d21b1f8134534d5e377c0ef5a094ff894f722519c11711236574a940ac13671fada27aeae824884bf8

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
111KB

MD5
3dd43d3ce6086c62fac3c38c0302b9dd

SHA1
bcc4e75e65ecff785c878674062f60c977125bb4

SHA256
b232c290626c6ba0f3f4a0d1dc90957282709049eead7f491682471dc2d46f1b

SHA512
a86827b71c04d6742a68e0c5eaa09613b42fb231b3b541d21b1f8134534d5e377c0ef5a094ff894f722519c11711236574a940ac13671fada27aeae824884bf8

Download Submit
C:\Windows\SysWOW64\Jcdjbk32.exe

Filesize
111KB

MD5
e274b6b13e97c2888e7702622db832ba

SHA1
08ed48cbba501152864b71f914884933a3937f42

SHA256
fe7016c2a3dc71670dcebd661a549ad9bafc6c40142eed29f18d4b904c58f3a6

SHA512
6c2beb3c78c287f4fc6787bc44ac04e01adbdbb94720d9a65a673e288742ce269578c44d14a5ce65ef9e48e7f540da4a2ab327a223e6760cdebedc868defe60c

Download Submit
C:\Windows\SysWOW64\Jcdjbk32.exe

Filesize
111KB

MD5
e274b6b13e97c2888e7702622db832ba

SHA1
08ed48cbba501152864b71f914884933a3937f42

SHA256
fe7016c2a3dc71670dcebd661a549ad9bafc6c40142eed29f18d4b904c58f3a6

SHA512
6c2beb3c78c287f4fc6787bc44ac04e01adbdbb94720d9a65a673e288742ce269578c44d14a5ce65ef9e48e7f540da4a2ab327a223e6760cdebedc868defe60c

Download Submit
C:\Windows\SysWOW64\Jcfggkac.exe

Filesize
111KB

MD5
4c4bfaddb69596228f29ac82bc5e9789

SHA1
fdc71eeed3c885b0c22b6c63265f95684dd531b2

SHA256
2b3a0dbb1c56924ae437cc8147e1cedbe814384178b5b4176152d32ae8611115

SHA512
7cbb55b6791bcfd5c25243a45befd8e001f2af0692dddf44803fbabad253fe2fe61a92fccaf8a673468009f8a6346f20a5ca1524ae0c3426e9b33c59f9d9f5d3

Download Submit
C:\Windows\SysWOW64\Jcfggkac.exe

Filesize
111KB

MD5
4c4bfaddb69596228f29ac82bc5e9789

SHA1
fdc71eeed3c885b0c22b6c63265f95684dd531b2

SHA256
2b3a0dbb1c56924ae437cc8147e1cedbe814384178b5b4176152d32ae8611115

SHA512
7cbb55b6791bcfd5c25243a45befd8e001f2af0692dddf44803fbabad253fe2fe61a92fccaf8a673468009f8a6346f20a5ca1524ae0c3426e9b33c59f9d9f5d3

Download Submit
C:\Windows\SysWOW64\Jcmdaljn.exe

Filesize
111KB

MD5
879424cf51e58061920440712f9633a3

SHA1
9c419653069aaa62625d7ac415d1f1c9cffcaccc

SHA256
2bc1caac38e00799e5cc97b8d4369eb70b32bc554ac77a9540a1435cf13b524e

SHA512
586803681ea840d75334526aaec5c88c5743a25ff72c281b6675793528dc299bb9d7baedf69b5a7bff17dc8d6f3f6099a31e303b0a593a2c7980b9f2130280ed

Download Submit
C:\Windows\SysWOW64\Jcmdaljn.exe

Filesize
111KB

MD5
879424cf51e58061920440712f9633a3

SHA1
9c419653069aaa62625d7ac415d1f1c9cffcaccc

SHA256
2bc1caac38e00799e5cc97b8d4369eb70b32bc554ac77a9540a1435cf13b524e

SHA512
586803681ea840d75334526aaec5c88c5743a25ff72c281b6675793528dc299bb9d7baedf69b5a7bff17dc8d6f3f6099a31e303b0a593a2c7980b9f2130280ed

Download Submit
C:\Windows\SysWOW64\Jepjhg32.exe

Filesize
111KB

MD5
4e71dd2f7176777a4644c221f6189f4e

SHA1
a3a003fbc0f130a69dd13cf1f9d119d8d0ccabc8

SHA256
a712c277ec51b83c875c5051c40dd75a2ef70dd45bf4d9cbad1948de8709314c

SHA512
f4cff774f0973f513468d0f66acc41cc81ceab05d3f3b6fc54407cf8bb3e904844a9b5d09483eb6d549c0f3789849478463feb54fc21436c6baf7fe1509e5486

Download Submit
C:\Windows\SysWOW64\Jepjhg32.exe

Filesize
111KB

MD5
4e71dd2f7176777a4644c221f6189f4e

SHA1
a3a003fbc0f130a69dd13cf1f9d119d8d0ccabc8

SHA256
a712c277ec51b83c875c5051c40dd75a2ef70dd45bf4d9cbad1948de8709314c

SHA512
f4cff774f0973f513468d0f66acc41cc81ceab05d3f3b6fc54407cf8bb3e904844a9b5d09483eb6d549c0f3789849478463feb54fc21436c6baf7fe1509e5486

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
111KB

MD5
2b30849c8eb883af3cd7435dabee7b4c

SHA1
7b02496f5cba9bab17f1835f210aaa712edaa2ca

SHA256
c50c482e876bdd3d2a133f837904dd7bca933617fc2544f77fcb97db40c0b25e

SHA512
9879a75d49f82926c397b9c762a3c7d295d3bab899f42c9265abb81bd9e73f3ab43d4f1b62313ac3e506e703465e4af034520184f7c594264a22e3aac734e5e9

Download Submit
C:\Windows\SysWOW64\Jlgepanl.exe

Filesize
111KB

MD5
8e73bedf09a50d9a2c4711954ba98508

SHA1
1de8babca29cfb34241bae6797af1b0227073011

SHA256
28d0bf038ec2dd2c9c4f0a331865efcb1f13d57355dfb3f11262383bc2f1c2f9

SHA512
93717c90c8d88a450b75de844f8b1abea94b46c2fd9767eabd72743d74ab6f7d90f342c7147234d6c2fa151087b6e61b9fe9d0517cd07e7f9a39dc046c32ec95

Download Submit
C:\Windows\SysWOW64\Jlgepanl.exe

Filesize
111KB

MD5
8e73bedf09a50d9a2c4711954ba98508

SHA1
1de8babca29cfb34241bae6797af1b0227073011

SHA256
28d0bf038ec2dd2c9c4f0a331865efcb1f13d57355dfb3f11262383bc2f1c2f9

SHA512
93717c90c8d88a450b75de844f8b1abea94b46c2fd9767eabd72743d74ab6f7d90f342c7147234d6c2fa151087b6e61b9fe9d0517cd07e7f9a39dc046c32ec95

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
111KB

MD5
d0c5192afb9232bad75bd40617dc3261

SHA1
1b1e083298e85461717ea2fe02e24920a4ffb29f

SHA256
d85603a83ba4b0ec9e6524afb2ddb3d6262cf535833c98bee388e8bc91ad1627

SHA512
aa4f0b02605f2916afec4050bc00e4899f981d1327f07967ae61dbebe8a9dc458e338f372a0ca7d96f4a0d61f67de8e23dcc532cd6fd2d1c3a343440d98ba29f

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
111KB

MD5
d0c5192afb9232bad75bd40617dc3261

SHA1
1b1e083298e85461717ea2fe02e24920a4ffb29f

SHA256
d85603a83ba4b0ec9e6524afb2ddb3d6262cf535833c98bee388e8bc91ad1627

SHA512
aa4f0b02605f2916afec4050bc00e4899f981d1327f07967ae61dbebe8a9dc458e338f372a0ca7d96f4a0d61f67de8e23dcc532cd6fd2d1c3a343440d98ba29f

Download Submit
C:\Windows\SysWOW64\Kcbfcigf.exe

Filesize
111KB

MD5
8d6727ec8184b31f295aeec7a8882347

SHA1
4fc287358eb2eec8b0c5eaa9e7fe4e692ef653fd

SHA256
cfdd881d6c89801240c9a5a974e1b56cbda71ee7868ce20a86abe06573da3197

SHA512
db64827a48cb6b281dcc434211af6ce81a2b8973ca180f6b2c24156ecb85489e401d1dc264f5a3c35b51faa42532cd682db482c7a9f73505adb484ea00de42bc

Download Submit
C:\Windows\SysWOW64\Kcbfcigf.exe

Filesize
111KB

MD5
8d6727ec8184b31f295aeec7a8882347

SHA1
4fc287358eb2eec8b0c5eaa9e7fe4e692ef653fd

SHA256
cfdd881d6c89801240c9a5a974e1b56cbda71ee7868ce20a86abe06573da3197

SHA512
db64827a48cb6b281dcc434211af6ce81a2b8973ca180f6b2c24156ecb85489e401d1dc264f5a3c35b51faa42532cd682db482c7a9f73505adb484ea00de42bc

Download Submit
C:\Windows\SysWOW64\Kcmmhj32.exe

Filesize
111KB

MD5
c8da2deb6620c1a1fc10496f9de8edf4

SHA1
e2bbb0c1326204e8e89f0851407d05d7603d04b4

SHA256
b0a219092a3357b91d72a67c2f961a35b15bfff90984c8d5ca9b8002ba454e94

SHA512
0e95af08645b17dd63d46d49a5d88f74fd9c651b510eeedfc14b4b44517220d1b71b7c781b78cda24d4d24772fd522944b8d90633838feb0de69a6316f5dd969

Download Submit
C:\Windows\SysWOW64\Kcmmhj32.exe

Filesize
111KB

MD5
c8da2deb6620c1a1fc10496f9de8edf4

SHA1
e2bbb0c1326204e8e89f0851407d05d7603d04b4

SHA256
b0a219092a3357b91d72a67c2f961a35b15bfff90984c8d5ca9b8002ba454e94

SHA512
0e95af08645b17dd63d46d49a5d88f74fd9c651b510eeedfc14b4b44517220d1b71b7c781b78cda24d4d24772fd522944b8d90633838feb0de69a6316f5dd969

Download Submit
C:\Windows\SysWOW64\Kfbmgo32.exe

Filesize
111KB

MD5
a0de33a13bfcb40af22c2b3375c5b12a

SHA1
46962c4e8362ba1ddc0c5c588e5c7a015243cfd2

SHA256
e20670103ad6607ab690ee11e7d3d6afb6bfc328a271fde1c5964c6d12747200

SHA512
89138d76e1ba6fe1c129c238640b4977140dd232282b0b988178bd0768717d9561f88b09f8784aafabb1550522b0fc2631f4d011835ab3b1198bcf697f761d24

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
111KB

MD5
d250cc5eb4527be3ad1ee10360ad237e

SHA1
e75e7ef392a566fe3333dbb53649b0c0158c13d1

SHA256
161f73e9085ddf7fdcdb63f57205d9b6f5fe8398beaafb785c966f75876d51d7

SHA512
05b36bf31c4a9a759999b881acb970a0f8cf991477da36c53dbfcaba4c0fe6b8e0664856aa502db8beed5bec65232841a90edc0adaf1ae2c4e2c19c98dafd16e

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
111KB

MD5
d250cc5eb4527be3ad1ee10360ad237e

SHA1
e75e7ef392a566fe3333dbb53649b0c0158c13d1

SHA256
161f73e9085ddf7fdcdb63f57205d9b6f5fe8398beaafb785c966f75876d51d7

SHA512
05b36bf31c4a9a759999b881acb970a0f8cf991477da36c53dbfcaba4c0fe6b8e0664856aa502db8beed5bec65232841a90edc0adaf1ae2c4e2c19c98dafd16e

Download Submit
C:\Windows\SysWOW64\Klfaapbl.exe

Filesize
111KB

MD5
35dbda3f99da13161f8bd1525e0c50cf

SHA1
8cdf46b5fa5adc7dd8b455821a0bd93f10a54e42

SHA256
39dda4a2d086ec906bcaf99b8c9d8e05663a831ebd447eaec25a1d7a0648dc9a

SHA512
43968d47393728462947f9023c3f7a957c5289f9957946eef4e2d92caaaae6b412b504d440ac0fdfb1bc71466f28505d1af674bd86e4df322f496f4dbe21ac5c

Download Submit
C:\Windows\SysWOW64\Klfaapbl.exe

Filesize
111KB

MD5
35dbda3f99da13161f8bd1525e0c50cf

SHA1
8cdf46b5fa5adc7dd8b455821a0bd93f10a54e42

SHA256
39dda4a2d086ec906bcaf99b8c9d8e05663a831ebd447eaec25a1d7a0648dc9a

SHA512
43968d47393728462947f9023c3f7a957c5289f9957946eef4e2d92caaaae6b412b504d440ac0fdfb1bc71466f28505d1af674bd86e4df322f496f4dbe21ac5c

Download Submit
C:\Windows\SysWOW64\Mhjhmhhd.exe

Filesize
111KB

MD5
cecfdae823bfcbcdb97b480fda3948d7

SHA1
1b04a74fba1b159283e706d69b37a0d0f9fadcff

SHA256
3aed340b760534ddac745db9bc43ac8c495f8173e4621fabf1d035cfbba647ba

SHA512
0f03e4ba7db6ba71c089d47be1d3fc7451ec0f4cc32821198dc9c3559f966da38c31b1c77b541ff5760b4b62ad22075b10f62d4cad150a14b6e3aea84a151816

Download Submit
C:\Windows\SysWOW64\Nfmifiap.dll

Filesize
7KB

MD5
6b41b3beb643aa9755efdb0949934b5d

SHA1
755b23c248e334c2a7b3ef0dd7ca12d7b80b025c

SHA256
2aa2393363656930d9daceb695477f08cc7fc1949bae8611572c3a1e16376dcf

SHA512
73b4c317eef3e509919d2654ff0bcd001543cd23467818a2c56be31707e6864b5ce95deeaabb69b53aecae9d3ed018ce72ba9d158b3686774dca6d58f680018b

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
111KB

MD5
b860131b6c0fa84913cae304494e34c1

SHA1
b92ea268b3db23da0504fe804ea69ff8ecaebabd

SHA256
5130f176dafa89080b64a499f701cd934531efeba4c80c8aeb8411f133b2b9c0

SHA512
00b6acfd632089cd81816d7209bb93add6889f5c9c34dbf52e49b9a1d1ecd424b96f83e293eb38cf66f19553c514fdd99cb85101da5df6bd843998a287b27985

Download Submit
C:\Windows\SysWOW64\Ofijnbkb.exe

Filesize
111KB

MD5
2a51678f49ed36cc517ad70c39b68afb

SHA1
9ade6f1497f3a3aaa5bdffcb6b41d39c5902c3c6

SHA256
1163a2226aa182ea7839f56f1f44b47a4b3b0fff77c034e3bde1ed981fc369b8

SHA512
3b7e6e48eb5db1e55230e59756dc6b5ccdd88ca2c539c05230c0cb4a69d81cf0dd56a25ed8e78e1d7972ee3bffd88586c7161eae1ae567d1fb222abb3dbabd3c

Download Submit
C:\Windows\SysWOW64\Pfppoa32.exe

Filesize
111KB

MD5
cd5f6ce74bd1d89df4dd55f47436f4c7

SHA1
80ec67d5612dfb8fab39aad39663283d8a41227e

SHA256
bfb233c97c55ed113dc925b7f8df4cf334d1dea9388f7087a8a0440909dc8fc5

SHA512
dbed1121e61c9ad67513e5efa3687ed508380aeb6b6c5708f111d93e96805fabb260bcebd5dc04d09263c001e1b2bd0dc6e1bd50d5eb47f9e08b5c241d17c844

Download Submit
C:\Windows\SysWOW64\Pgcbbc32.exe

Filesize
111KB

MD5
9c881831499719622b60f99c5e6ba82b

SHA1
09d9db45be3daeebf06789412ae646dba195ac1d

SHA256
8a5a649c478ce619072df6d42ea4070a7a9c99508654aaff426fdcdbfe0f242a

SHA512
8a28c2490af8c710d47c9647729e45e9b915726ce8466644135d406e5f0b55f7df5673588aad3f329c2d66d3ef2e74f24577274a4d82f297d19cccf7b3c9158e

Download Submit
memory/476-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/736-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/828-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/940-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1032-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1072-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1280-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1288-124-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1340-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1460-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1488-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1512-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1756-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1780-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1908-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2064-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2100-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2124-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2168-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2224-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2452-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2600-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2672-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2784-344-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2856-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2892-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2920-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3128-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3152-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3260-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3380-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3624-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3640-223-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3660-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3812-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4040-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4068-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4104-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4188-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4200-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4228-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4300-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4304-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4468-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4536-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4552-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4580-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4660-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4668-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4672-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4712-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4776-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4848-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4872-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5000-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5016-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5024-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5084-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads