6aeddcca0a0484253cc49e834413fc6c9e5baedf7f68d6da43223bd9e8386c26

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e92cab7051cbc85fe70f9f9a3c9a3ad7.exe
Size

287KB
MD5

e92cab7051cbc85fe70f9f9a3c9a3ad7
SHA1

fe5fbdfb4cdc8ef022fe11e50ab5cc6b5a3eead3
SHA256

6aeddcca0a0484253cc49e834413fc6c9e5baedf7f68d6da43223bd9e8386c26
SHA512

1288d0a0210bc6c18228a486ef1b335b85bf3970d347a0b5b5ba312b8c3bb7d6185deb75c309ac59f4b739619b026e5bfe8d61099fdd011807c51addbbdfaed9
SSDEEP

3072:DNxeaVX24ho1mtye3lFDrFDHZtOga24ho1mtye3lOT0DVWi35U0Pc9G24ho1mty8:RxeOksFj5tT3sFOggi3NArsF1

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqbpahpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnacfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eincadmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogbbqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feofmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egelgoah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqfceoje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfpell32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daollh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmngm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhdem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocmjcjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpjdiadb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknnoofg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cemeoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpnbmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocbdni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Canocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbnopbdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faqflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfbfmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pemhmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkmqed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khkdad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adnbapjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peaahmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmieae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblflp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgbonm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npmjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pndhhnda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcojoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddqbbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhegjdag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idmafc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbcbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdgdpdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mledmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhoeef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjdbda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhgbomfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haodle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bipecnkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fljcfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkcbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okolfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljopa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfkpnji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqfcbahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knhkkfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oecnmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjmlaac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dioiki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aghdco32.exe

Executes dropped EXE 64 IoCs

pid	Process
3616	Fmkgkapm.exe
2504	Fffhifdk.exe
4220	Glcaambb.exe
2628	Giinpa32.exe
2156	Gikkfqmf.exe
3320	Gkmdecbg.exe
3388	Hgdejd32.exe
2084	Hginecde.exe
3560	Icdheded.exe
3668	Icfekc32.exe
4440	Ikpjbq32.exe
4668	Icnklbmj.exe
2384	Jpaleglc.exe
3292	Jnhidk32.exe
4992	Jqhafffk.exe
1776	Kkconn32.exe
3444	Kmieae32.exe
1048	Lqikmc32.exe
4388	Lnmkfh32.exe
3088	Lqndhcdc.exe
644	Lgjijmin.exe
4204	Mjkblhfo.exe
3888	Mnkggfkb.exe
1916	Mjdebfnd.exe
3536	Naecop32.exe
320	Olfghg32.exe
5044	Phodcg32.exe
5108	Pahilmoc.exe
2556	Pkegpb32.exe
1704	Amjillkj.exe
1504	Akqfkp32.exe
3968	Albpkc32.exe
1076	Bnfihkqm.exe
2516	Bnmoijje.exe
4636	Chglab32.exe
5072	Ckeimm32.exe
4408	Cleegp32.exe
536	Cofnik32.exe
1056	Cfpffeaj.exe
224	Ddgplado.exe
2068	Dbkqfe32.exe
4416	Dmadco32.exe
2356	Eiloco32.exe
3220	Enigke32.exe
2308	Eiokinbk.exe
4500	Enpmld32.exe
3608	Eppjfgcp.exe
2488	Fngcmcfe.exe
4484	Fealin32.exe
4256	Fpgpgfmh.exe
3696	Fpkibf32.exe
4728	Gidnkkpc.exe
2408	Gldglf32.exe
2064	Glgcbf32.exe
3992	Gbalopbn.exe
2256	Geaepk32.exe
840	Gpgind32.exe
4432	Hmkigh32.exe
4572	Hblkjo32.exe
3552	Hlepcdoa.exe
3216	Ipeeobbe.exe
5064	Ifomll32.exe
4068	Ipgbdbqb.exe
4840	Iomoenej.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Albkieqj.exe	Abjfqpji.exe
File created	C:\Windows\SysWOW64\Akdake32.dll	Lokldg32.exe
File created	C:\Windows\SysWOW64\Abdfkj32.exe	Agobna32.exe
File created	C:\Windows\SysWOW64\Bjnlnaiq.dll	Dhcfleff.exe
File opened for modification	C:\Windows\SysWOW64\Jmqekg32.exe	Jggmnmmo.exe
File opened for modification	C:\Windows\SysWOW64\Hpbajp32.exe	Dcmcfeke.exe
File created	C:\Windows\SysWOW64\Bebmpc32.dll	Oqfdgn32.exe
File created	C:\Windows\SysWOW64\Jmbpjm32.dll	Ckggnp32.exe
File created	C:\Windows\SysWOW64\Cpifeb32.exe	Bedbhi32.exe
File created	C:\Windows\SysWOW64\Akamab32.dll	Nlmdml32.exe
File opened for modification	C:\Windows\SysWOW64\Cngnbfid.exe	Cgmfel32.exe
File created	C:\Windows\SysWOW64\Obbekn32.exe	Okhmnc32.exe
File created	C:\Windows\SysWOW64\Oqbagd32.exe	Ojhijjll.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbalopbn.exe
File opened for modification	C:\Windows\SysWOW64\Kfpjgi32.exe	Koeajo32.exe
File opened for modification	C:\Windows\SysWOW64\Obeikc32.exe	Omhpcm32.exe
File created	C:\Windows\SysWOW64\Mncmck32.exe	Mpoljg32.exe
File created	C:\Windows\SysWOW64\Mcgckb32.dll	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Lhnoigkk.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Jfkafocc.dll	Icdheded.exe
File created	C:\Windows\SysWOW64\Ipgkjlmg.exe	Iimcma32.exe
File created	C:\Windows\SysWOW64\Adepji32.exe	Ajmladbl.exe
File opened for modification	C:\Windows\SysWOW64\Dnngpj32.exe	Dgdncplk.exe
File opened for modification	C:\Windows\SysWOW64\Hdicggla.exe	Hjabdo32.exe
File opened for modification	C:\Windows\SysWOW64\Mppdbb32.exe	Miflehaf.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Chnlgjlb.exe
File opened for modification	C:\Windows\SysWOW64\Lofjam32.exe	Lilbdcfe.exe
File opened for modification	C:\Windows\SysWOW64\Niqnli32.exe	Nkmmbe32.exe
File created	C:\Windows\SysWOW64\Ccefbg32.dll	Dehkbkip.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Ajdggc32.dll	Hnlodjpa.exe
File created	C:\Windows\SysWOW64\Nnimkcjf.dll	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Llkjmb32.exe	Logicn32.exe
File opened for modification	C:\Windows\SysWOW64\Amfhgj32.exe	Aflpkpjm.exe
File opened for modification	C:\Windows\SysWOW64\Bcinie32.exe	Bloflk32.exe
File opened for modification	C:\Windows\SysWOW64\Lnfngj32.exe	Lfkich32.exe
File opened for modification	C:\Windows\SysWOW64\Nbfoeiei.exe	Ncenga32.exe
File created	C:\Windows\SysWOW64\Pbhafkok.dll	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Biepoi32.dll	Ngbpbjoe.exe
File opened for modification	C:\Windows\SysWOW64\Aealll32.exe	Amfhgj32.exe
File opened for modification	C:\Windows\SysWOW64\Ldlmieaa.exe	Llqhdb32.exe
File created	C:\Windows\SysWOW64\Mafnie32.dll	Ldccid32.exe
File created	C:\Windows\SysWOW64\Lckbje32.exe	Kdcicipb.exe
File created	C:\Windows\SysWOW64\Aamcngoj.dll	Eojcao32.exe
File created	C:\Windows\SysWOW64\Hhimhobl.exe	Haodle32.exe
File opened for modification	C:\Windows\SysWOW64\Icfekc32.exe	Icdheded.exe
File created	C:\Windows\SysWOW64\Bgnffj32.exe	Baannc32.exe
File created	C:\Windows\SysWOW64\Hlpihhpj.dll	Gpdennml.exe
File created	C:\Windows\SysWOW64\Komoed32.exe	Kcfnqccd.exe
File created	C:\Windows\SysWOW64\Aoldgfoo.dll	Lfnmcnjn.exe
File created	C:\Windows\SysWOW64\Qbapebjm.dll	Balfko32.exe
File created	C:\Windows\SysWOW64\Djfjodkf.dll	Jlpklg32.exe
File created	C:\Windows\SysWOW64\Momkkhch.dll	Fmkgkapm.exe
File opened for modification	C:\Windows\SysWOW64\Mibpng32.exe	Mmiccf32.exe
File created	C:\Windows\SysWOW64\Bohgljdl.dll	Kpanan32.exe
File created	C:\Windows\SysWOW64\Cieoen32.dll	Aioebj32.exe
File opened for modification	C:\Windows\SysWOW64\Elolco32.exe	Ecfhji32.exe
File created	C:\Windows\SysWOW64\Fgpplf32.exe	Fljlom32.exe
File created	C:\Windows\SysWOW64\Flebpn32.dll	Omhpcm32.exe
File created	C:\Windows\SysWOW64\Bfikka32.dll	Pnaalghe.exe
File created	C:\Windows\SysWOW64\Geaepk32.exe	Gbalopbn.exe
File opened for modification	C:\Windows\SysWOW64\Nmlhaa32.exe	Meadlo32.exe
File opened for modification	C:\Windows\SysWOW64\Dngobghg.exe	Cfljnejl.exe
File created	C:\Windows\SysWOW64\Jbieebha.exe	Icdhdfcj.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6880	9652	WerFault.exe	1057
2804	9652	WerFault.exe	1057

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclppboi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahogoog.dll"	Fnacfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blkdgheg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomgmanl.dll"	Dhkaif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebmpc32.dll"	Oqfdgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjijld32.dll"	Mbpfig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbmbiqqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chglab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofmfi32.dll"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dllffa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jelhcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gihacc32.dll"	Npgjbabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldlmieaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beaced32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhgbomfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbcieqpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cepjip32.dll"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlhcmpgk.dll"	Ihkjno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmecba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgjlgghg.dll"	Peodcmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geollfdn.dll"	Knhkkfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkieoo32.dll"	Jbqpbbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpdhj32.dll"	Gbalopbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbpedmcb.dll"	Ecfhji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbapom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nidhffef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miqlpbap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojmcej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Femcnc32.dll"	Nciahk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibjqaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbhkkpon.dll"	Cfcoblfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cohkinob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbfmgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjdadgeb.dll"	Bdkghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehlolk32.dll"	Bjmpfdhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aploae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agkqiobl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfdep32.dll"	Kdcicipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocbdni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijomapp.dll"	Mopeofjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agobna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppldflod.dll"	Klibdcjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aegidp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnjkcfod.dll"	Fnbcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olekop32.dll"	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Labnlj32.dll"	Bdeiqgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfljnejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lehhqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihfpabbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mibpng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apnndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mekdffee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjfclcpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epofikbn.dll"	Glcelq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfbbhdp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3616	2668	e92cab7051cbc85fe70f9f9a3c9a3ad7.exe	91
PID 2668 wrote to memory of 3616	2668	e92cab7051cbc85fe70f9f9a3c9a3ad7.exe	91
PID 2668 wrote to memory of 3616	2668	e92cab7051cbc85fe70f9f9a3c9a3ad7.exe	91
PID 3616 wrote to memory of 2504	3616	Fmkgkapm.exe	92
PID 3616 wrote to memory of 2504	3616	Fmkgkapm.exe	92
PID 3616 wrote to memory of 2504	3616	Fmkgkapm.exe	92
PID 2504 wrote to memory of 4220	2504	Fffhifdk.exe	93
PID 2504 wrote to memory of 4220	2504	Fffhifdk.exe	93
PID 2504 wrote to memory of 4220	2504	Fffhifdk.exe	93
PID 4220 wrote to memory of 2628	4220	Glcaambb.exe	94
PID 4220 wrote to memory of 2628	4220	Glcaambb.exe	94
PID 4220 wrote to memory of 2628	4220	Glcaambb.exe	94
PID 2628 wrote to memory of 2156	2628	Giinpa32.exe	95
PID 2628 wrote to memory of 2156	2628	Giinpa32.exe	95
PID 2628 wrote to memory of 2156	2628	Giinpa32.exe	95
PID 2156 wrote to memory of 3320	2156	Gikkfqmf.exe	96
PID 2156 wrote to memory of 3320	2156	Gikkfqmf.exe	96
PID 2156 wrote to memory of 3320	2156	Gikkfqmf.exe	96
PID 3320 wrote to memory of 3388	3320	Gkmdecbg.exe	97
PID 3320 wrote to memory of 3388	3320	Gkmdecbg.exe	97
PID 3320 wrote to memory of 3388	3320	Gkmdecbg.exe	97
PID 3388 wrote to memory of 2084	3388	Hgdejd32.exe	98
PID 3388 wrote to memory of 2084	3388	Hgdejd32.exe	98
PID 3388 wrote to memory of 2084	3388	Hgdejd32.exe	98
PID 2084 wrote to memory of 3560	2084	Hginecde.exe	99
PID 2084 wrote to memory of 3560	2084	Hginecde.exe	99
PID 2084 wrote to memory of 3560	2084	Hginecde.exe	99
PID 3560 wrote to memory of 3668	3560	Icdheded.exe	100
PID 3560 wrote to memory of 3668	3560	Icdheded.exe	100
PID 3560 wrote to memory of 3668	3560	Icdheded.exe	100
PID 3668 wrote to memory of 4440	3668	Icfekc32.exe	101
PID 3668 wrote to memory of 4440	3668	Icfekc32.exe	101
PID 3668 wrote to memory of 4440	3668	Icfekc32.exe	101
PID 4440 wrote to memory of 4668	4440	Ikpjbq32.exe	102
PID 4440 wrote to memory of 4668	4440	Ikpjbq32.exe	102
PID 4440 wrote to memory of 4668	4440	Ikpjbq32.exe	102
PID 4668 wrote to memory of 2384	4668	Icnklbmj.exe	103
PID 4668 wrote to memory of 2384	4668	Icnklbmj.exe	103
PID 4668 wrote to memory of 2384	4668	Icnklbmj.exe	103
PID 2384 wrote to memory of 3292	2384	Jpaleglc.exe	104
PID 2384 wrote to memory of 3292	2384	Jpaleglc.exe	104
PID 2384 wrote to memory of 3292	2384	Jpaleglc.exe	104
PID 3292 wrote to memory of 4992	3292	Jnhidk32.exe	105
PID 3292 wrote to memory of 4992	3292	Jnhidk32.exe	105
PID 3292 wrote to memory of 4992	3292	Jnhidk32.exe	105
PID 4992 wrote to memory of 1776	4992	Jqhafffk.exe	106
PID 4992 wrote to memory of 1776	4992	Jqhafffk.exe	106
PID 4992 wrote to memory of 1776	4992	Jqhafffk.exe	106
PID 1776 wrote to memory of 3444	1776	Kkconn32.exe	107
PID 1776 wrote to memory of 3444	1776	Kkconn32.exe	107
PID 1776 wrote to memory of 3444	1776	Kkconn32.exe	107
PID 3444 wrote to memory of 1048	3444	Kmieae32.exe	108
PID 3444 wrote to memory of 1048	3444	Kmieae32.exe	108
PID 3444 wrote to memory of 1048	3444	Kmieae32.exe	108
PID 1048 wrote to memory of 4388	1048	Lqikmc32.exe	109
PID 1048 wrote to memory of 4388	1048	Lqikmc32.exe	109
PID 1048 wrote to memory of 4388	1048	Lqikmc32.exe	109
PID 4388 wrote to memory of 3088	4388	Lnmkfh32.exe	110
PID 4388 wrote to memory of 3088	4388	Lnmkfh32.exe	110
PID 4388 wrote to memory of 3088	4388	Lnmkfh32.exe	110
PID 3088 wrote to memory of 644	3088	Lqndhcdc.exe	111
PID 3088 wrote to memory of 644	3088	Lqndhcdc.exe	111
PID 3088 wrote to memory of 644	3088	Lqndhcdc.exe	111
PID 644 wrote to memory of 4204	644	Lgjijmin.exe	112

C:\Users\Admin\AppData\Local\Temp\e92cab7051cbc85fe70f9f9a3c9a3ad7.exe
"C:\Users\Admin\AppData\Local\Temp\e92cab7051cbc85fe70f9f9a3c9a3ad7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\Fmkgkapm.exe
  C:\Windows\system32\Fmkgkapm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\SysWOW64\Fffhifdk.exe
    C:\Windows\system32\Fffhifdk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\Glcaambb.exe
      C:\Windows\system32\Glcaambb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
      - C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        23⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        24⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        25⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        26⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        27⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        28⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        29⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        31⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        32⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        33⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        34⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        35⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        37⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        38⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        39⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        40⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        41⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        42⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        43⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        44⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        45⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        46⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        47⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        48⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        49⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        50⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        51⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        52⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        54⤵
        Executes dropped EXE
        
        PID:2408
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        55⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        57⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        58⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        59⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        60⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        61⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        62⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        63⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        64⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        65⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        66⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        67⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        68⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        69⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        70⤵
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        71⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        72⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        73⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        74⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        75⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        76⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        77⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        79⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        80⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        81⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        82⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        83⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        84⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        85⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        86⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        87⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        88⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        89⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        90⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        91⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        93⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        94⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        95⤵
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        96⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        97⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        98⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        99⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        100⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        101⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        102⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        104⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        105⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        106⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        107⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        108⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        109⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        110⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        111⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        112⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        113⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        114⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        115⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        116⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        117⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        118⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        119⤵
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        120⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        121⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        122⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        123⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        124⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        125⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        126⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        127⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        129⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        130⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        131⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        132⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        133⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        134⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        135⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        136⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        137⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        138⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        139⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        140⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        142⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        143⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        144⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        145⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        146⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        147⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        148⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        149⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        150⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        151⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        152⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        153⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        154⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        155⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        156⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        157⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        158⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        159⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        160⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        161⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        163⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        164⤵
        Modifies registry class
        
        PID:6392
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        165⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        166⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        167⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        168⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        170⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        171⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        172⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        173⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        174⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        175⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        176⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        177⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        178⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        179⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        180⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        181⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        182⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        183⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        185⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        186⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        187⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        188⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        189⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        190⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        191⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        192⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        193⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        195⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        196⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        197⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        198⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        199⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        201⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        202⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        203⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        205⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        206⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        207⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        208⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        209⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        210⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        211⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        212⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        213⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        214⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        215⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        216⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        217⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        218⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        219⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        220⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        221⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        222⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        224⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        225⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        226⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        228⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        229⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        230⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        231⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        232⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        233⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        234⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        235⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        236⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        237⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        238⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        239⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        240⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        241⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        242⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        243⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        244⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        245⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        246⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        247⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        248⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        249⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        250⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        251⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        252⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        253⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        255⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        257⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        258⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        259⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        260⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        261⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        263⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        264⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        265⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        266⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        267⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        269⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        270⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        271⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        272⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        273⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        274⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        276⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        277⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        278⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        279⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        280⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        281⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        282⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        283⤵
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        285⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        286⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        287⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        288⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        290⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Hkjohi32.exe
        
        C:\Windows\system32\Hkjohi32.exe
        291⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        292⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        293⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        294⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        295⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        296⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        297⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        299⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        300⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        301⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        302⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        303⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        304⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        305⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        306⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        307⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        308⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        309⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        310⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        312⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        313⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        314⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        315⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        316⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        318⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        319⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        320⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        322⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        323⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        324⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        325⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        326⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3288
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        328⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        329⤵
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        330⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        331⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        332⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        333⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        334⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        335⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Moalil32.exe
        
        C:\Windows\system32\Moalil32.exe
        336⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        337⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        338⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        339⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        340⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        341⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        342⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        343⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        344⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        345⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        346⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        347⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        348⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        349⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        350⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        351⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        352⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        353⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        147⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        148⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pafcofcg.exe
        
        C:\Windows\system32\Pafcofcg.exe
        149⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        151⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        152⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        153⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        154⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        155⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        156⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        157⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        158⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        160⤵
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        161⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        162⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        164⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        165⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        166⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Enedio32.exe
        
        C:\Windows\system32\Enedio32.exe
        167⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        53⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Jeilne32.exe
        
        C:\Windows\system32\Jeilne32.exe
        54⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        55⤵
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        56⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        57⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        58⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        59⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        60⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Kallod32.exe
        
        C:\Windows\system32\Kallod32.exe
        61⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        62⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        63⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        64⤵
        
        PID:5196

C:\Windows\SysWOW64\Ocdgahag.exe
C:\Windows\system32\Ocdgahag.exe
1⤵
PID:10140
- C:\Windows\SysWOW64\Okolfj32.exe
  C:\Windows\system32\Okolfj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:10196
- - C:\Windows\SysWOW64\Obidcdfo.exe
    C:\Windows\system32\Obidcdfo.exe
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\Ohcmpn32.exe
      C:\Windows\system32\Ohcmpn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:9280
    - - C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        5⤵
        
        PID:9336
      - C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        6⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        7⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        8⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        9⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        10⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        11⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        12⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        13⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        14⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        15⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        16⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        17⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        18⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        19⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        20⤵
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        21⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        22⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        23⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        24⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        25⤵
        Modifies registry class
        
        PID:9568
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        26⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        27⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        28⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        29⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        30⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        31⤵
        Drops file in System32 directory
        
        PID:10180
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        32⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        33⤵
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        34⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        35⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        36⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        37⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        38⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1504
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        40⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        42⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        43⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        44⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        45⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Didqkeeq.exe
        
        C:\Windows\system32\Didqkeeq.exe
        46⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Digmqe32.exe
        
        C:\Windows\system32\Digmqe32.exe
        47⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Egknji32.exe
        
        C:\Windows\system32\Egknji32.exe
        48⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        49⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Emgblc32.exe
        
        C:\Windows\system32\Emgblc32.exe
        50⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        51⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1516
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        53⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        54⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        55⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Fnqebaog.exe
        
        C:\Windows\system32\Fnqebaog.exe
        56⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        57⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        58⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        59⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        60⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        61⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        62⤵
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Fgpplf32.exe
        
        C:\Windows\system32\Fgpplf32.exe
        63⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        64⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        65⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        66⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        67⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Gcpcgfmi.exe
        
        C:\Windows\system32\Gcpcgfmi.exe
        68⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        69⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        70⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        71⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        72⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Hcgjhega.exe
        
        C:\Windows\system32\Hcgjhega.exe
        73⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        74⤵
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        75⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Ijfkpnji.exe
        
        C:\Windows\system32\Ijfkpnji.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4404
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        77⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Iqbpahpc.exe
        
        C:\Windows\system32\Iqbpahpc.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2356
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        79⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        80⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        81⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        82⤵
        
        PID:3696

C:\Windows\SysWOW64\Lndfchdj.exe
C:\Windows\system32\Lndfchdj.exe
1⤵
PID:5176
- C:\Windows\SysWOW64\Laeoec32.exe
  C:\Windows\system32\Laeoec32.exe
  2⤵
  PID:344
- - C:\Windows\SysWOW64\Ljncnhhk.exe
    C:\Windows\system32\Ljncnhhk.exe
    3⤵
    PID:5568
  - - C:\Windows\SysWOW64\Ldfhgn32.exe
      C:\Windows\system32\Ldfhgn32.exe
      4⤵
      PID:1328
    - - C:\Windows\SysWOW64\Lokldg32.exe
        
        C:\Windows\system32\Lokldg32.exe
        5⤵
        Drops file in System32 directory
        
        PID:5304
      - C:\Windows\SysWOW64\Leedqa32.exe
        
        C:\Windows\system32\Leedqa32.exe
        6⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        7⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        8⤵
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1904
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        10⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        11⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Mmhofbma.exe
        
        C:\Windows\system32\Mmhofbma.exe
        12⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        13⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Meadlo32.exe
        
        C:\Windows\system32\Meadlo32.exe
        14⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        15⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        16⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        17⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        18⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        19⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        20⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        21⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        22⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        23⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        24⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        25⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        26⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        27⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        28⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        29⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        30⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        32⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        33⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        34⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        35⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        36⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        37⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Pkonbamc.exe
        
        C:\Windows\system32\Pkonbamc.exe
        38⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        39⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Qkakhakq.exe
        
        C:\Windows\system32\Qkakhakq.exe
        40⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Qffoejkg.exe
        
        C:\Windows\system32\Qffoejkg.exe
        41⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Qoocnpag.exe
        
        C:\Windows\system32\Qoocnpag.exe
        42⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Qhghge32.exe
        
        C:\Windows\system32\Qhghge32.exe
        43⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        44⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        45⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Abbiej32.exe
        
        C:\Windows\system32\Abbiej32.exe
        46⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        47⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10712
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        48⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        49⤵
        
        PID:10996

C:\Windows\SysWOW64\Cpbbak32.exe
C:\Windows\system32\Cpbbak32.exe
1⤵
PID:11040
- C:\Windows\SysWOW64\Cfljnejl.exe
  C:\Windows\system32\Cfljnejl.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:11084
- - C:\Windows\SysWOW64\Dngobghg.exe
    C:\Windows\system32\Dngobghg.exe
    3⤵
    PID:11132
  - - C:\Windows\SysWOW64\Dbehienn.exe
      C:\Windows\system32\Dbehienn.exe
      4⤵
      PID:11188
    - - C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        5⤵
        
        PID:11244
      - C:\Windows\SysWOW64\Dlpigk32.exe
        
        C:\Windows\system32\Dlpigk32.exe
        6⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Dpnbmi32.exe
        
        C:\Windows\system32\Dpnbmi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10304
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        8⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Eohhie32.exe
        
        C:\Windows\system32\Eohhie32.exe
        9⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Ehpmbj32.exe
        
        C:\Windows\system32\Ehpmbj32.exe
        10⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        11⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Foakpc32.exe
        
        C:\Windows\system32\Foakpc32.exe
        12⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        13⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        14⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        15⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        16⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        17⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1416
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        19⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Hfgloiqf.exe
        
        C:\Windows\system32\Hfgloiqf.exe
        20⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Iqmplbpl.exe
        
        C:\Windows\system32\Iqmplbpl.exe
        21⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        22⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        23⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        24⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        26⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        27⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        28⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        30⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        31⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        32⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        33⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        35⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        36⤵
        
        PID:6540

C:\Windows\SysWOW64\Ejkenpnp.exe
C:\Windows\system32\Ejkenpnp.exe
1⤵
PID:6576
- C:\Windows\SysWOW64\Ejnbdp32.exe
  C:\Windows\system32\Ejnbdp32.exe
  2⤵
  PID:10692
- - C:\Windows\SysWOW64\Fjpoio32.exe
    C:\Windows\system32\Fjpoio32.exe
    3⤵
    PID:10788
  - - C:\Windows\SysWOW64\Flgadake.exe
      C:\Windows\system32\Flgadake.exe
      4⤵
      PID:6516
    - - C:\Windows\SysWOW64\Feofmf32.exe
        
        C:\Windows\system32\Feofmf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
      - C:\Windows\SysWOW64\Gklnem32.exe
        
        C:\Windows\system32\Gklnem32.exe
        6⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Gimoce32.exe
        
        C:\Windows\system32\Gimoce32.exe
        7⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        8⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ihlgan32.exe
        
        C:\Windows\system32\Ihlgan32.exe
        9⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Icdhdfcj.exe
        
        C:\Windows\system32\Icdhdfcj.exe
        10⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Jbieebha.exe
        
        C:\Windows\system32\Jbieebha.exe
        11⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        12⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        14⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        15⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        16⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        17⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        18⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        19⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        20⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        21⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        22⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        23⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        24⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        25⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        26⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Mjaodkmo.exe
        
        C:\Windows\system32\Mjaodkmo.exe
        27⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        28⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Mppdbb32.exe
        
        C:\Windows\system32\Mppdbb32.exe
        29⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        30⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        31⤵
        
        PID:11208

C:\Windows\SysWOW64\Mjjbjjdd.exe
C:\Windows\system32\Mjjbjjdd.exe
1⤵
PID:6180
- C:\Windows\SysWOW64\Npgjbabk.exe
  C:\Windows\system32\Npgjbabk.exe
  2⤵
  - Modifies registry class
  PID:7900
- - C:\Windows\SysWOW64\Nipokfil.exe
    C:\Windows\system32\Nipokfil.exe
    3⤵
    PID:8108
  - - C:\Windows\SysWOW64\Njokei32.exe
      C:\Windows\system32\Njokei32.exe
      4⤵
      PID:6396
    - - C:\Windows\SysWOW64\Nidhffef.exe
        
        C:\Windows\system32\Nidhffef.exe
        5⤵
        Modifies registry class
        
        PID:6956
      - C:\Windows\SysWOW64\Oibdhd32.exe
        
        C:\Windows\system32\Oibdhd32.exe
        6⤵
        
        PID:980

C:\Windows\SysWOW64\Qpjifl32.exe
C:\Windows\system32\Qpjifl32.exe
1⤵
PID:8100
- C:\Windows\SysWOW64\Qdhalj32.exe
  C:\Windows\system32\Qdhalj32.exe
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\Apobakpn.exe
    C:\Windows\system32\Apobakpn.exe
    3⤵
    PID:6316
  - - C:\Windows\SysWOW64\Ajggjq32.exe
      C:\Windows\system32\Ajggjq32.exe
      4⤵
      PID:8292
    - - C:\Windows\SysWOW64\Akgcdc32.exe
        
        C:\Windows\system32\Akgcdc32.exe
        5⤵
        
        PID:8960
      - C:\Windows\SysWOW64\Ajlpepbi.exe
        
        C:\Windows\system32\Ajlpepbi.exe
        6⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ajnmjp32.exe
        
        C:\Windows\system32\Ajnmjp32.exe
        7⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Bgbmdd32.exe
        
        C:\Windows\system32\Bgbmdd32.exe
        8⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Bloflk32.exe
        
        C:\Windows\system32\Bloflk32.exe
        9⤵
        Drops file in System32 directory
        
        PID:8556
        
        C:\Windows\SysWOW64\Bcinie32.exe
        
        C:\Windows\system32\Bcinie32.exe
        10⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Blabakle.exe
        
        C:\Windows\system32\Blabakle.exe
        11⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bgggockk.exe
        
        C:\Windows\system32\Bgggockk.exe
        12⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Bdkghg32.exe
        
        C:\Windows\system32\Bdkghg32.exe
        13⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Bkepeaaa.exe
        
        C:\Windows\system32\Bkepeaaa.exe
        14⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Ccgjjc32.exe
        
        C:\Windows\system32\Ccgjjc32.exe
        15⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Cjcolm32.exe
        
        C:\Windows\system32\Cjcolm32.exe
        16⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Cqpdof32.exe
        
        C:\Windows\system32\Cqpdof32.exe
        17⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ddnmeejo.exe
        
        C:\Windows\system32\Ddnmeejo.exe
        18⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Dkjbgooi.exe
        
        C:\Windows\system32\Dkjbgooi.exe
        19⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Dmknog32.exe
        
        C:\Windows\system32\Dmknog32.exe
        20⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Djoohk32.exe
        
        C:\Windows\system32\Djoohk32.exe
        21⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Dqigee32.exe
        
        C:\Windows\system32\Dqigee32.exe
        22⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Dcgcaq32.exe
        
        C:\Windows\system32\Dcgcaq32.exe
        23⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Egelgoah.exe
        
        C:\Windows\system32\Egelgoah.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Faqflb32.exe
        
        C:\Windows\system32\Faqflb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Gmggac32.exe
        
        C:\Windows\system32\Gmggac32.exe
        26⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Gechnpid.exe
        
        C:\Windows\system32\Gechnpid.exe
        27⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Gjpaffhl.exe
        
        C:\Windows\system32\Gjpaffhl.exe
        28⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Geeecogb.exe
        
        C:\Windows\system32\Geeecogb.exe
        29⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Glajeiml.exe
        
        C:\Windows\system32\Glajeiml.exe
        30⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Hdmojkjg.exe
        
        C:\Windows\system32\Hdmojkjg.exe
        31⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Hmecba32.exe
        
        C:\Windows\system32\Hmecba32.exe
        32⤵
        Modifies registry class
        
        PID:8396
        
        C:\Windows\SysWOW64\Hmhphqoe.exe
        
        C:\Windows\system32\Hmhphqoe.exe
        33⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Hknmgd32.exe
        
        C:\Windows\system32\Hknmgd32.exe
        34⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Incpdodg.exe
        
        C:\Windows\system32\Incpdodg.exe
        35⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Iejgelej.exe
        
        C:\Windows\system32\Iejgelej.exe
        36⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Ioclnblj.exe
        
        C:\Windows\system32\Ioclnblj.exe
        37⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ilglgfjd.exe
        
        C:\Windows\system32\Ilglgfjd.exe
        38⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Inhion32.exe
        
        C:\Windows\system32\Inhion32.exe
        39⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Jolodqcp.exe
        
        C:\Windows\system32\Jolodqcp.exe
        40⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Jamhflqq.exe
        
        C:\Windows\system32\Jamhflqq.exe
        41⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Jhgpbf32.exe
        
        C:\Windows\system32\Jhgpbf32.exe
        42⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Joahop32.exe
        
        C:\Windows\system32\Joahop32.exe
        43⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Kkhidaeo.exe
        
        C:\Windows\system32\Kkhidaeo.exe
        44⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Kfmmajed.exe
        
        C:\Windows\system32\Kfmmajed.exe
        45⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Koeajo32.exe
        
        C:\Windows\system32\Koeajo32.exe
        46⤵
        Drops file in System32 directory
        
        PID:11232
        
        C:\Windows\SysWOW64\Kfpjgi32.exe
        
        C:\Windows\system32\Kfpjgi32.exe
        47⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Klibdcjo.exe
        
        C:\Windows\system32\Klibdcjo.exe
        48⤵
        Modifies registry class
        
        PID:9232
        
        C:\Windows\SysWOW64\Kfbfmi32.exe
        
        C:\Windows\system32\Kfbfmi32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9332
        
        C:\Windows\SysWOW64\Kbigajfc.exe
        
        C:\Windows\system32\Kbigajfc.exe
        50⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Khbpndnp.exe
        
        C:\Windows\system32\Khbpndnp.exe
        51⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Komhkn32.exe
        
        C:\Windows\system32\Komhkn32.exe
        52⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Kffphhmj.exe
        
        C:\Windows\system32\Kffphhmj.exe
        53⤵
        
        PID:10012

C:\Windows\SysWOW64\Llqhdb32.exe
C:\Windows\system32\Llqhdb32.exe
1⤵
- Drops file in System32 directory
PID:7096
- C:\Windows\SysWOW64\Ldlmieaa.exe
  C:\Windows\system32\Ldlmieaa.exe
  2⤵
  - Modifies registry class
  PID:10216
- - C:\Windows\SysWOW64\Loaafnah.exe
    C:\Windows\system32\Loaafnah.exe
    3⤵
    PID:9748
  - - C:\Windows\SysWOW64\Lfkich32.exe
      C:\Windows\system32\Lfkich32.exe
      4⤵
      Drops file in System32 directory
      PID:9996
    - - C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        5⤵
        
        PID:8104
      - C:\Windows\SysWOW64\Lilbdcfe.exe
        
        C:\Windows\system32\Lilbdcfe.exe
        6⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Lofjam32.exe
        
        C:\Windows\system32\Lofjam32.exe
        7⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ldccid32.exe
        
        C:\Windows\system32\Ldccid32.exe
        8⤵
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\Lkmkfncf.exe
        
        C:\Windows\system32\Lkmkfncf.exe
        9⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Miqlpbap.exe
        
        C:\Windows\system32\Miqlpbap.exe
        10⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Megldcgd.exe
        
        C:\Windows\system32\Megldcgd.exe
        11⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Mbpfig32.exe
        
        C:\Windows\system32\Mbpfig32.exe
        12⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Mkhkblii.exe
        
        C:\Windows\system32\Mkhkblii.exe
        13⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Npfchkop.exe
        
        C:\Windows\system32\Npfchkop.exe
        14⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Nlmdml32.exe
        
        C:\Windows\system32\Nlmdml32.exe
        15⤵
        Drops file in System32 directory
        
        PID:8428
        
        C:\Windows\SysWOW64\Nfchjddj.exe
        
        C:\Windows\system32\Nfchjddj.exe
        16⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Nehekq32.exe
        
        C:\Windows\system32\Nehekq32.exe
        17⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Npmjij32.exe
        
        C:\Windows\system32\Npmjij32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10024
        
        C:\Windows\SysWOW64\Nfgbec32.exe
        
        C:\Windows\system32\Nfgbec32.exe
        19⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Obnbjdfi.exe
        
        C:\Windows\system32\Obnbjdfi.exe
        20⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Onecof32.exe
        
        C:\Windows\system32\Onecof32.exe
        21⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Oeoklp32.exe
        
        C:\Windows\system32\Oeoklp32.exe
        22⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Olidijjf.exe
        
        C:\Windows\system32\Olidijjf.exe
        23⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        24⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Omhpcm32.exe
        
        C:\Windows\system32\Omhpcm32.exe
        25⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Obeikc32.exe
        
        C:\Windows\system32\Obeikc32.exe
        26⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Olnmdi32.exe
        
        C:\Windows\system32\Olnmdi32.exe
        27⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Plbfohbl.exe
        
        C:\Windows\system32\Plbfohbl.exe
        28⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Pfhklabb.exe
        
        C:\Windows\system32\Pfhklabb.exe
        29⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Pldcdhpi.exe
        
        C:\Windows\system32\Pldcdhpi.exe
        30⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9100
        
        C:\Windows\SysWOW64\Peodcmeg.exe
        
        C:\Windows\system32\Peodcmeg.exe
        32⤵
        Modifies registry class
        
        PID:10180
        
        C:\Windows\SysWOW64\Peaahmcd.exe
        
        C:\Windows\system32\Peaahmcd.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1916
        
        C:\Windows\SysWOW64\Qednnm32.exe
        
        C:\Windows\system32\Qednnm32.exe
        34⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Qefkcl32.exe
        
        C:\Windows\system32\Qefkcl32.exe
        35⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        36⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Aeigilml.exe
        
        C:\Windows\system32\Aeigilml.exe
        37⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Aghdco32.exe
        
        C:\Windows\system32\Aghdco32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8344
        
        C:\Windows\SysWOW64\Amblpikl.exe
        
        C:\Windows\system32\Amblpikl.exe
        39⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Agkqiobl.exe
        
        C:\Windows\system32\Agkqiobl.exe
        40⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        41⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Aikijjon.exe
        
        C:\Windows\system32\Aikijjon.exe
        42⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Apeagd32.exe
        
        C:\Windows\system32\Apeagd32.exe
        43⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Bpgnmcdh.exe
        
        C:\Windows\system32\Bpgnmcdh.exe
        44⤵
        
        PID:1248

C:\Windows\SysWOW64\Bpjkbcbe.exe
C:\Windows\system32\Bpjkbcbe.exe
1⤵
PID:4376
- C:\Windows\SysWOW64\Bckddn32.exe
  C:\Windows\system32\Bckddn32.exe
  2⤵
  PID:8844
- - C:\Windows\SysWOW64\Cgmfel32.exe
    C:\Windows\system32\Cgmfel32.exe
    3⤵
    - Drops file in System32 directory
    PID:224
  - - C:\Windows\SysWOW64\Cngnbfid.exe
      C:\Windows\system32\Cngnbfid.exe
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\Cohkinob.exe
        
        C:\Windows\system32\Cohkinob.exe
        5⤵
        Modifies registry class
        
        PID:9580
      - C:\Windows\SysWOW64\Cfbcfh32.exe
        
        C:\Windows\system32\Cfbcfh32.exe
        6⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Cllkcbnl.exe
        
        C:\Windows\system32\Cllkcbnl.exe
        7⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Cjpllgme.exe
        
        C:\Windows\system32\Cjpllgme.exe
        8⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Cpjdiadb.exe
        
        C:\Windows\system32\Cpjdiadb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Cfglahbj.exe
        
        C:\Windows\system32\Cfglahbj.exe
        10⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        11⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        12⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Djgbmffn.exe
        
        C:\Windows\system32\Djgbmffn.exe
        13⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        14⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Dfnbbg32.exe
        
        C:\Windows\system32\Dfnbbg32.exe
        15⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Dqdgop32.exe
        
        C:\Windows\system32\Dqdgop32.exe
        16⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Djlkhe32.exe
        
        C:\Windows\system32\Djlkhe32.exe
        17⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Dqfceoje.exe
        
        C:\Windows\system32\Dqfceoje.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Djnhne32.exe
        
        C:\Windows\system32\Djnhne32.exe
        19⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        20⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Fnacfp32.exe
        
        C:\Windows\system32\Fnacfp32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Fpbpmhjb.exe
        
        C:\Windows\system32\Fpbpmhjb.exe
        22⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Galonj32.exe
        
        C:\Windows\system32\Galonj32.exe
        23⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hhegjdag.exe
        
        C:\Windows\system32\Hhegjdag.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3184
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        25⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        26⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Hhjqec32.exe
        
        C:\Windows\system32\Hhjqec32.exe
        27⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Hfonfp32.exe
        
        C:\Windows\system32\Hfonfp32.exe
        28⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        29⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Hoibmmpi.exe
        
        C:\Windows\system32\Hoibmmpi.exe
        30⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Ihagfb32.exe
        
        C:\Windows\system32\Ihagfb32.exe
        31⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Iplkje32.exe
        
        C:\Windows\system32\Iplkje32.exe
        32⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Iffcgoka.exe
        
        C:\Windows\system32\Iffcgoka.exe
        33⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        34⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Idmafc32.exe
        
        C:\Windows\system32\Idmafc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7916
        
        C:\Windows\SysWOW64\Imeeohoi.exe
        
        C:\Windows\system32\Imeeohoi.exe
        36⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Ihkila32.exe
        
        C:\Windows\system32\Ihkila32.exe
        37⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Jkkbnl32.exe
        
        C:\Windows\system32\Jkkbnl32.exe
        38⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Jdhpba32.exe
        
        C:\Windows\system32\Jdhpba32.exe
        39⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Jggmnmmo.exe
        
        C:\Windows\system32\Jggmnmmo.exe
        40⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Jmqekg32.exe
        
        C:\Windows\system32\Jmqekg32.exe
        41⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Jdkmgali.exe
        
        C:\Windows\system32\Jdkmgali.exe
        42⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Jkeedk32.exe
        
        C:\Windows\system32\Jkeedk32.exe
        43⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kaonaekb.exe
        
        C:\Windows\system32\Kaonaekb.exe
        44⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Kkgbjkac.exe
        
        C:\Windows\system32\Kkgbjkac.exe
        45⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Kaajfe32.exe
        
        C:\Windows\system32\Kaajfe32.exe
        46⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Kgnbol32.exe
        
        C:\Windows\system32\Kgnbol32.exe
        47⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Knhkkfod.exe
        
        C:\Windows\system32\Knhkkfod.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Kdbchp32.exe
        
        C:\Windows\system32\Kdbchp32.exe
        49⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Koggehff.exe
        
        C:\Windows\system32\Koggehff.exe
        50⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Kddpnpdn.exe
        
        C:\Windows\system32\Kddpnpdn.exe
        51⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Knldfe32.exe
        
        C:\Windows\system32\Knldfe32.exe
        52⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        53⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Lnoalehl.exe
        
        C:\Windows\system32\Lnoalehl.exe
        54⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ldiiio32.exe
        
        C:\Windows\system32\Ldiiio32.exe
        55⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Lnanadfi.exe
        
        C:\Windows\system32\Lnanadfi.exe
        56⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Lhgbomfo.exe
        
        C:\Windows\system32\Lhgbomfo.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        58⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        59⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        60⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Mgceqh32.exe
        
        C:\Windows\system32\Mgceqh32.exe
        61⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        62⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        63⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Mbmbiqqp.exe
        
        C:\Windows\system32\Mbmbiqqp.exe
        64⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        65⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Ndbefkjk.exe
        
        C:\Windows\system32\Ndbefkjk.exe
        66⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3400
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        68⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Nojfic32.exe
        
        C:\Windows\system32\Nojfic32.exe
        69⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Ngekmf32.exe
        
        C:\Windows\system32\Ngekmf32.exe
        70⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Nejkfj32.exe
        
        C:\Windows\system32\Nejkfj32.exe
        71⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        72⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ogjdheqd.exe
        
        C:\Windows\system32\Ogjdheqd.exe
        73⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Oabiak32.exe
        
        C:\Windows\system32\Oabiak32.exe
        74⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        75⤵
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Obbekn32.exe
        
        C:\Windows\system32\Obbekn32.exe
        76⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Oilmhhfd.exe
        
        C:\Windows\system32\Oilmhhfd.exe
        77⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Onifpodl.exe
        
        C:\Windows\system32\Onifpodl.exe
        78⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Oecnmi32.exe
        
        C:\Windows\system32\Oecnmi32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Olmficce.exe
        
        C:\Windows\system32\Olmficce.exe
        80⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Obgofmjb.exe
        
        C:\Windows\system32\Obgofmjb.exe
        81⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        82⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        83⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Beaced32.exe
        
        C:\Windows\system32\Beaced32.exe
        84⤵
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Bojhnjgf.exe
        
        C:\Windows\system32\Bojhnjgf.exe
        85⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Bahdje32.exe
        
        C:\Windows\system32\Bahdje32.exe
        86⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Dcmcfeke.exe
        
        C:\Windows\system32\Dcmcfeke.exe
        87⤵
        Drops file in System32 directory
        
        PID:10656
        
        C:\Windows\SysWOW64\Hpbajp32.exe
        
        C:\Windows\system32\Hpbajp32.exe
        88⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Hpenpp32.exe
        
        C:\Windows\system32\Hpenpp32.exe
        89⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        90⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Iapjeq32.exe
        
        C:\Windows\system32\Iapjeq32.exe
        91⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ifmcmg32.exe
        
        C:\Windows\system32\Ifmcmg32.exe
        92⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        93⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        94⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        95⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Jjmhie32.exe
        
        C:\Windows\system32\Jjmhie32.exe
        96⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Jfdinf32.exe
        
        C:\Windows\system32\Jfdinf32.exe
        97⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jmnakqcc.exe
        
        C:\Windows\system32\Jmnakqcc.exe
        98⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Jidbpa32.exe
        
        C:\Windows\system32\Jidbpa32.exe
        99⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Kfhbifgq.exe
        
        C:\Windows\system32\Kfhbifgq.exe
        100⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        101⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Kbocng32.exe
        
        C:\Windows\system32\Kbocng32.exe
        102⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kapclned.exe
        
        C:\Windows\system32\Kapclned.exe
        103⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kbapdfkb.exe
        
        C:\Windows\system32\Kbapdfkb.exe
        104⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Kmgdaokh.exe
        
        C:\Windows\system32\Kmgdaokh.exe
        105⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Kcdmifip.exe
        
        C:\Windows\system32\Kcdmifip.exe
        106⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kdcicipb.exe
        
        C:\Windows\system32\Kdcicipb.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Lckbje32.exe
        
        C:\Windows\system32\Lckbje32.exe
        108⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Lkdgqbag.exe
        
        C:\Windows\system32\Lkdgqbag.exe
        109⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        110⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        111⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mjnnmn32.exe
        
        C:\Windows\system32\Mjnnmn32.exe
        112⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Majoikof.exe
        
        C:\Windows\system32\Majoikof.exe
        113⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Mkbcbp32.exe
        
        C:\Windows\system32\Mkbcbp32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Mpoljg32.exe
        
        C:\Windows\system32\Mpoljg32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        116⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        117⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        118⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        119⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Ncbaabom.exe
        
        C:\Windows\system32\Ncbaabom.exe
        120⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Nnhfokoc.exe
        
        C:\Windows\system32\Nnhfokoc.exe
        121⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ncenga32.exe
        
        C:\Windows\system32\Ncenga32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        123⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        124⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        125⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        126⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Oggqho32.exe
        
        C:\Windows\system32\Oggqho32.exe
        127⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Obmeeh32.exe
        
        C:\Windows\system32\Obmeeh32.exe
        128⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ocnampdp.exe
        
        C:\Windows\system32\Ocnampdp.exe
        129⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Ojhijjll.exe
        
        C:\Windows\system32\Ojhijjll.exe
        130⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        131⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Ogljcokf.exe
        
        C:\Windows\system32\Ogljcokf.exe
        132⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        133⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        134⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        135⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        136⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Onklkhnn.exe
        
        C:\Windows\system32\Onklkhnn.exe
        137⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Peddhb32.exe
        
        C:\Windows\system32\Peddhb32.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Pkoldl32.exe
        
        C:\Windows\system32\Pkoldl32.exe
        139⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Pbhdafdd.exe
        
        C:\Windows\system32\Pbhdafdd.exe
        140⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pcjaio32.exe
        
        C:\Windows\system32\Pcjaio32.exe
        141⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pbkagfba.exe
        
        C:\Windows\system32\Pbkagfba.exe
        142⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Pghiomqi.exe
        
        C:\Windows\system32\Pghiomqi.exe
        143⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Pnaalghe.exe
        
        C:\Windows\system32\Pnaalghe.exe
        144⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Pcojdnfm.exe
        
        C:\Windows\system32\Pcojdnfm.exe
        145⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Pabknbef.exe
        
        C:\Windows\system32\Pabknbef.exe
        146⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Pglcjl32.exe
        
        C:\Windows\system32\Pglcjl32.exe
        147⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Qnfkgfdp.exe
        
        C:\Windows\system32\Qnfkgfdp.exe
        148⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        149⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Qbddmejf.exe
        
        C:\Windows\system32\Qbddmejf.exe
        150⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Qebpipij.exe
        
        C:\Windows\system32\Qebpipij.exe
        151⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Qlmhfj32.exe
        
        C:\Windows\system32\Qlmhfj32.exe
        152⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Aaianaoo.exe
        
        C:\Windows\system32\Aaianaoo.exe
        153⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Agcikk32.exe
        
        C:\Windows\system32\Agcikk32.exe
        154⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Aegidp32.exe
        
        C:\Windows\system32\Aegidp32.exe
        155⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Anpnmele.exe
        
        C:\Windows\system32\Anpnmele.exe
        156⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Aanjiqki.exe
        
        C:\Windows\system32\Aanjiqki.exe
        157⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Aelcooap.exe
        
        C:\Windows\system32\Aelcooap.exe
        158⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ajikhfpg.exe
        
        C:\Windows\system32\Ajikhfpg.exe
        159⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Abpcicpi.exe
        
        C:\Windows\system32\Abpcicpi.exe
        160⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Bbbpnc32.exe
        
        C:\Windows\system32\Bbbpnc32.exe
        161⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        162⤵
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Bdfilkbb.exe
        
        C:\Windows\system32\Bdfilkbb.exe
        163⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Bjpaheio.exe
        
        C:\Windows\system32\Bjpaheio.exe
        164⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        165⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Blonbh32.exe
        
        C:\Windows\system32\Blonbh32.exe
        166⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Balfko32.exe
        
        C:\Windows\system32\Balfko32.exe
        167⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Bhfogiff.exe
        
        C:\Windows\system32\Bhfogiff.exe
        168⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cdolbijg.exe
        
        C:\Windows\system32\Cdolbijg.exe
        169⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        170⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Ceaealoh.exe
        
        C:\Windows\system32\Ceaealoh.exe
        171⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Cknnjcmo.exe
        
        C:\Windows\system32\Cknnjcmo.exe
        172⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        173⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        174⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        175⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Dhdkig32.exe
        
        C:\Windows\system32\Dhdkig32.exe
        176⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Donceaac.exe
        
        C:\Windows\system32\Donceaac.exe
        177⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Dehkbkip.exe
        
        C:\Windows\system32\Dehkbkip.exe
        178⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        179⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2040
        
        C:\Windows\SysWOW64\Dkgqpaed.exe
        
        C:\Windows\system32\Dkgqpaed.exe
        181⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Daaiml32.exe
        
        C:\Windows\system32\Daaiml32.exe
        182⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Dhkaif32.exe
        
        C:\Windows\system32\Dhkaif32.exe
        183⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        184⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Dkljka32.exe
        
        C:\Windows\system32\Dkljka32.exe
        185⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dafbhkhl.exe
        
        C:\Windows\system32\Dafbhkhl.exe
        186⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        187⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Ehbgjenf.exe
        
        C:\Windows\system32\Ehbgjenf.exe
        188⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        189⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ekhjgoga.exe
        
        C:\Windows\system32\Ekhjgoga.exe
        190⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Femndhgh.exe
        
        C:\Windows\system32\Femndhgh.exe
        191⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        192⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        193⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Fljcfa32.exe
        
        C:\Windows\system32\Fljcfa32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        195⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Fcfhhk32.exe
        
        C:\Windows\system32\Fcfhhk32.exe
        196⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Fdgdpdgj.exe
        
        C:\Windows\system32\Fdgdpdgj.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10176
        
        C:\Windows\SysWOW64\Fkalmn32.exe
        
        C:\Windows\system32\Fkalmn32.exe
        198⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        199⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        200⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        201⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        202⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        203⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        204⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Gcojoj32.exe
        
        C:\Windows\system32\Gcojoj32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        206⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        207⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        208⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        209⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Hicihp32.exe
        
        C:\Windows\system32\Hicihp32.exe
        210⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Hcimei32.exe
        
        C:\Windows\system32\Hcimei32.exe
        211⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Hbbdad32.exe
        
        C:\Windows\system32\Hbbdad32.exe
        212⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        213⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Imjddmpl.exe
        
        C:\Windows\system32\Imjddmpl.exe
        214⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Iiaein32.exe
        
        C:\Windows\system32\Iiaein32.exe
        215⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        216⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Iicboncn.exe
        
        C:\Windows\system32\Iicboncn.exe
        217⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ipmjkh32.exe
        
        C:\Windows\system32\Ipmjkh32.exe
        218⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        219⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Imdgjlgb.exe
        
        C:\Windows\system32\Imdgjlgb.exe
        220⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Jbqpbbfi.exe
        
        C:\Windows\system32\Jbqpbbfi.exe
        221⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Jmfdpkeo.exe
        
        C:\Windows\system32\Jmfdpkeo.exe
        222⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        223⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Jmknkk32.exe
        
        C:\Windows\system32\Jmknkk32.exe
        224⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Jfcbcp32.exe
        
        C:\Windows\system32\Jfcbcp32.exe
        225⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jlpklg32.exe
        
        C:\Windows\system32\Jlpklg32.exe
        226⤵
        Drops file in System32 directory
        
        PID:3832
        
        C:\Windows\SysWOW64\Jbjciano.exe
        
        C:\Windows\system32\Jbjciano.exe
        227⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        228⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        229⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        230⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kbceoped.exe
        
        C:\Windows\system32\Kbceoped.exe
        231⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Kpgfhddn.exe
        
        C:\Windows\system32\Kpgfhddn.exe
        232⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        233⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Lfckjnjh.exe
        
        C:\Windows\system32\Lfckjnjh.exe
        234⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Lbjlpo32.exe
        
        C:\Windows\system32\Lbjlpo32.exe
        235⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Lgkakm32.exe
        
        C:\Windows\system32\Lgkakm32.exe
        237⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        238⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Mmiccf32.exe
        
        C:\Windows\system32\Mmiccf32.exe
        239⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Mibpng32.exe
        
        C:\Windows\system32\Mibpng32.exe
        240⤵
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        241⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Mlciobhj.exe
        
        C:\Windows\system32\Mlciobhj.exe
        242⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        243⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        244⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Ndmnfofi.exe
        
        C:\Windows\system32\Ndmnfofi.exe
        245⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        246⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        247⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        248⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        250⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        251⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Nciahk32.exe
        
        C:\Windows\system32\Nciahk32.exe
        252⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Onneeceo.exe
        
        C:\Windows\system32\Onneeceo.exe
        253⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        254⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Olcbfp32.exe
        
        C:\Windows\system32\Olcbfp32.exe
        255⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        257⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        258⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ocbdni32.exe
        
        C:\Windows\system32\Ocbdni32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Pjnipc32.exe
        
        C:\Windows\system32\Pjnipc32.exe
        261⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        262⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        263⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        264⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        265⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Pqbdclak.exe
        
        C:\Windows\system32\Pqbdclak.exe
        266⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        267⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9652 -s 400
        268⤵
        Program crash
        
        PID:6880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9652 -s 400
        268⤵
        Program crash
        
        PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 9652 -ip 9652
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aimogakj.exe

Filesize
287KB

MD5
0c0a4eefc572adea9d232598557023fc

SHA1
3fe1490f9c66956e9e63a2c369890579f57f3d35

SHA256
5e21aebd7a5b046b8e0ed97682d63966698aa2070b03dd3ee661074fd2ce5070

SHA512
30faf10b21141ae7be56a0bfbf45efb749f583c363bbc9646d7ad9237420d504a554c343267b24fd19808aeebea19002d22856efb7bd81de5963bea499d693c7

Download Submit
C:\Windows\SysWOW64\Akqfkp32.exe

Filesize
287KB

MD5
88102cd100879ba41e3be74e996acda2

SHA1
8b1ef71ce98606dd469a18f7118d8d15bf9cbc0e

SHA256
21983d389c6cea085a0e60cf8e1805bd157a39b3fc087a59a7a61ec75f0665a2

SHA512
32d3b9c69995c2ebbab947d777b3f9d6ec5cdbf4783600cd6be8bc0f0b24d4841e5b5d5b33c2bb20fd3deb502cae17b1b4ed26cd625b2bec7447c84c3cf6add7

Download Submit
C:\Windows\SysWOW64\Albpkc32.exe

Filesize
287KB

MD5
05d9e45d815e62f2700db61d2e3d5b16

SHA1
7e8061b23293796709e8b3b1d3ecc077a55fa0e0

SHA256
37ff2b91a5b0513944339a9b78c7a692ab37f15897ea0bffe561cf5c9490f1bc

SHA512
8eb51746558c0f729d8ee988f4dd1749df22dfff1cc7498ed490d57723ebbc59a3d79f177be9436312a40a689ca10107be02cdcfe6babf2630207c8c6031e814

Download Submit
C:\Windows\SysWOW64\Amjillkj.exe

Filesize
287KB

MD5
27d9270719228a5667b90d3f3764ab95

SHA1
e03760711c5338ce5e79a397b211f3f4a2c8fd72

SHA256
792a29ad3fba35f4b8faf5086b001d0d75ff329798de25c810c0bea03be8d999

SHA512
e37c05bfa58ff6ca7e775906087f11903b83a323a6e14fbc628ca3fc47adc30fe5041f4b706a1138dacf196af2df14fefbb6f675d02027bca18f2d7333007f95

Download Submit
C:\Windows\SysWOW64\Bckddn32.exe

Filesize
287KB

MD5
c153e5c10a88f87dfd32603df142a43b

SHA1
7d65ac7b6124b804e5564c386e589c023d9530ed

SHA256
ed891ac331f02f6dbf38ac712eda682b39e6d605677ee082694872b943324a8f

SHA512
5340a51a32c8341cf81973bc7b535c2c1bb081652806eef40556d377c81323cd7de3dc289e77c1fc130ce98be8a2a52480f9c4a7e78d9ba9e004c1ff008f7445

Download Submit
C:\Windows\SysWOW64\Bgbpaipl.exe

Filesize
287KB

MD5
a9a1eab387768f29822416e716e60133

SHA1
79594770620f1ffd158e773553fe45edb3007215

SHA256
54e71e4d1e7a31410948689fa9475082ca40c76bf37ff7a544ec694ace36c4b7

SHA512
45c5e6debacd0cb20d2e5ef31dbad87501f0e3e29b37f711857f00571ce97f26f9227357ad592e082a2833b394503070addad70c037706fb9e49f90eaf7723fa

Download Submit
C:\Windows\SysWOW64\Bnmoijje.exe

Filesize
287KB

MD5
bc25130221a2b02abd26d312cf6bbc20

SHA1
c289b015c85d9bffd09b052cb8ad93306dd22cc2

SHA256
4d29d62bc22097a10147f8346136df10234426498714bf5be5e41977386e2e5b

SHA512
899524681250d308f58909550f7f592a39ffae48f23c80610a30ce786b59b7f69afb2a1670a9f51ddb27d7ae5756a8c4e2e03a34099ecea1df310695fbd7d54c

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
287KB

MD5
e4fb7340da988d0e042ba33fb5fa56aa

SHA1
bf9b7ddfeab3ed258fcea64f1fe3e40bdf07e9e1

SHA256
e8cf2be4fc21e013f4e3fe60096070f0d3f6886ad20485c8609b6b7712314739

SHA512
701f9df8ab0a1aaa818a511d8d226c7a50fca687f719efbedddfc4b749c8d1d848e48738eac298531344cad41a27e58a36eb2d22c59cef299e2f651aec2b42f4

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
287KB

MD5
8b286cf3fa9596bd34746a377cd9fbdc

SHA1
5e54d625840175374a12cb164a9007a85b5aa066

SHA256
4074d668d4fb7f41765a7bb984814193f3038188c1faca18f8f1d51bb25d89fe

SHA512
89214256db369b4c0f82c5125fe8b27de77ae11da1c12e0c60a6bde60dc37b47189b63700d94eb62f5f2e2e8c85cf781af1fdcd9b26eda5d76b45012e5f98cab

Download Submit
C:\Windows\SysWOW64\Fmkgkapm.exe

Filesize
287KB

MD5
d930a16fd53b5a85c1f4599352725581

SHA1
42a301cedb8da2c7a93dca77d5ae8261d2cc888f

SHA256
9313fe89777dbba56b8880e2625764a0b412dbdbc5d3f4f42fab93a6a02ae2bf

SHA512
5655423d085ea202da9ddfd9ec6676eea6f0577320d4e074770ef6777fcc8362b2efddf0c7fa83a9ee78ca3bc31a72952054cbad883f8545919991b51d7de015

Download Submit
C:\Windows\SysWOW64\Giinpa32.exe

Filesize
287KB

MD5
dd494e0b7c5a049830622bce51ba96e9

SHA1
a2f09691925715edeb34a0ebb67a96fdf8a1c24b

SHA256
483917d5f1f5e535c91601cf26a5cc349ed5172280f30f24342538180a1d9265

SHA512
2587efeefb744783e9b6e50b451a1c150aaeee9830bfa34fdb7d1d7bf669a6ca08423097b1aa61a90cd6772ed8c48aa5b40ae6dc65e8f3118afe7a98b7e9a959

Download Submit
C:\Windows\SysWOW64\Gikkfqmf.exe

Filesize
287KB

MD5
e420ed730d414eb5181a4a33b80efd7c

SHA1
d6ac98f45b58a53d11f70cf5651ad0bf63713655

SHA256
9d3b60495c2dfc9629928783306ff9e78627a97e32cd2dfa4a2efdd01efa4b01

SHA512
fe8c3bdbfd264837052eafd7ba99134f4fd36b45c87fff1078746eff4f14b3a4caf5e5f09a68a22b2bb643cc0186a40388ca20726456a75ee314658d224ddc73

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
287KB

MD5
927fc94a286967f7f042ba03d890add7

SHA1
74e88a4acc4b1f5dc1d9fccaaccd2706e216f2ee

SHA256
c7701dbe5cb3bc0e9a145bd8965d99f8de5392c22b2083634c55a45fcc6c42f5

SHA512
33b35e20dfaec085623e1854b8cea4691dc1f03c359f34dffb064542668a0f79373c2c313cc2c7e438f47b15c877af2563b7cbc2ae00c77f1d78f82897ef8776

Download Submit
C:\Windows\SysWOW64\Glcaambb.exe

Filesize
287KB

MD5
6873235c71739ac799cd5857da8e8801

SHA1
3d85c34f0449f836028857b50e02f3245c7e9d88

SHA256
6cb6e113a4d227f008a77e0a0426e989e1283416d6bd3eac6694a63ae14aaba0

SHA512
013cfd06a06a87dbf33188fb71c7eb90ed62e2d80fd23b91675263a29dd3dc735c38e7c389cab5cfab38087c351f5c72976d6cd931facf58dd8959c7066e8d27

Download Submit
C:\Windows\SysWOW64\Hgdejd32.exe

Filesize
287KB

MD5
a2c2f306d127046b83983a0bd23b722a

SHA1
6e56565d41c89f177913493630fff08846552281

SHA256
f235c8faef924d68792a6e6594e52cf6a8af2382ff4275c81b6cb3469408e89c

SHA512
20c2e55a9ee161726d399ac28a1b031999a4da378c6f5c44f6c7e40c62d929a03843eba5b56e278df4157a667e56ebed35a8c60afa6246735caf930d6bf624d4

Download Submit
C:\Windows\SysWOW64\Hginecde.exe

Filesize
287KB

MD5
150f4b0d65b484728d36ecef0176725a

SHA1
43fdfb8821cb8b12f07773dfda8e81b40bee223a

SHA256
d99521b5b98aebb265b6cb959f48ff62af7e6df2b222af3d74cd09efe3a0ef6b

SHA512
61d68c03605af360f803f959d1edda1bf9799603646f914961d1676923a9792cb5a858c032fb69d754b1b94e4bd439a3c818799be185bf06d85906e5b5b4d1bb

Download Submit
C:\Windows\SysWOW64\Icdheded.exe

Filesize
287KB

MD5
dba828e0f5bc33d51da6454693ce81a3

SHA1
4e918555c87bad48aab1c140a8e4e5d94252cd02

SHA256
1769fd39894bb977e23327bae4af316a512228955348b2aeca111b8b5fd090cb

SHA512
c10c8d9459400e2abc87fc187e278aa186ad849ac58cfbe85aa6d86f09b8c57633cc6d2e589a3863817cff888b1c71cf6fdc8042ba0feebb7bb10696b50c1eab

Download Submit
C:\Windows\SysWOW64\Icfekc32.exe

Filesize
287KB

MD5
76912fdaaba5f10b7fa78c70104b345f

SHA1
590d8e3f3d8f75b2ceb82aec672640c3584d32c1

SHA256
ca3fa98f9db793fc5057d409c58b40bde9a18492d51aa853154a4c910e3fea70

SHA512
578255fba8b3572fe78d72d41c33bfe6e7f044951dfb95539d837fefe6cabb047129c98c1874a4922ca5215894dd8e62ffae9ee08701c03e9012547b1383bec2

Download Submit
C:\Windows\SysWOW64\Icnklbmj.exe

Filesize
287KB

MD5
acb6195f8226ed794aaa27945b483a73

SHA1
a9919c4cfec3bbf6f653c63b599eed34ea67a00f

SHA256
905b5dfbb1ce61924873f98c481c0739a98390c5c376eea452716d2eaf84a78e

SHA512
39c5958590081c3040beb03fa29c6b3508f4fd7d10767cca30e53053e5ac5f8a9f2c6aabb115c5a9b6ba61e2d4a1162b85bc4bd333742acb7facfc4b64c6112c

Download Submit
C:\Windows\SysWOW64\Ikpjbq32.exe

Filesize
287KB

MD5
ac4b3f4e2d1beb9ab4d655f57e7f268b

SHA1
e15b8310c1a96ac55d79fbf38ac0e4d1675d8b70

SHA256
04230a653db2332f37fb6221a9b067104c6e4788ffaafee379994e2a6ffe5af9

SHA512
b0e516274eee1c557a8fc9cdb3fb9fbe879a7b5ba617b5529682aa09bb657f13cf030106961c7843466a6ed0c888caa814ac33c464ff0b06eff4d1af8e13687c

Download Submit
C:\Windows\SysWOW64\Jjmhie32.exe

Filesize
287KB

MD5
90b2a94308b6385694cb5afee872c6af

SHA1
daf38d912f09ef9c83e1e4e3598b5b0993b4bc03

SHA256
c05b078889916e7e4c36d201a100f8d2554b7b77f06f894fd5805f2a92d583f9

SHA512
3a9ec2060cafd71cfefda78ef0b0a54ebf9bdc42b080eb0fa598442ab05f4b20e6bff43f7d67321f09d423b0eec4daaed71a12e32a568cab1febc47b7d438eac

Download Submit
C:\Windows\SysWOW64\Jngbjd32.exe

Filesize
128KB

MD5
e1706bc463708e96671c80d6d9929a67

SHA1
480fc53c7a39443cf1687327225ea94b0d553483

SHA256
f5566dc4f15141e542ee8ea0e21acd0cd7ac629b2dc7a46c06f9b99b74780a80

SHA512
ec70e58bd49cb856c1568064433ae9f73fd5996bdfcb130ef00fcee7f16913463ce52a4f74663785227cb33fed89408e972584db864e146aad5701e212f68ec2

Download Submit
C:\Windows\SysWOW64\Jnhidk32.exe

Filesize
287KB

MD5
c7a16eb41a875ddab6834242c45842a3

SHA1
50d63d0d9ecf5065c5cb30751ce9050f8d74103e

SHA256
9b04a1c29c3e74e036f0d8dc7558e6c4fc1190a1b37e00203c0bc5915d18165f

SHA512
54a6fc03b2303bc9653b1eb33ca8a40154d6e6cbccc43c235779b28a6876ae4551f9a6c4f9c45eddc66fbf2bfc5d9bb837c804acb9bdb4b8752026d0754a7b9b

Download Submit
C:\Windows\SysWOW64\Jpaleglc.exe

Filesize
287KB

MD5
d4bf543ecb12cd1ca4dd2cd220e2b2a1

SHA1
3bcc9e644df9985a7443f4142062499ee3564e89

SHA256
421db01deca72a7e8a98860b108fa0055de6260648141ad494309fa8c191d413

SHA512
386afabc48e1c2bbb1dfea5156a6a6fe1e66e93432a45b246514a83b2a98897546f71672e32e9ba7200b7efe870a15659f12ebb01dda94cbb7b9efb05ecb1366

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
287KB

MD5
2660dd4d1e6efa00b128049db10e0b84

SHA1
2559d04f0fa0a0df20633d17dd7b2aeedbc310f3

SHA256
9cc84be5080f0a860c1e8e838ae32f27edc2ef2e132500c996bcf4a9afd3474b

SHA512
2dd3e94173970967fcd95c76ac4a0325aa203d6a1db02be8d11e79eb344465e3406e1df165e02e5fda65f4c0956f8d605b4775754fd0f2da07e67d4a11fda2bf

Download Submit
C:\Windows\SysWOW64\Kkconn32.exe

Filesize
287KB

MD5
6955aca016ede589e1c665a518319b66

SHA1
5af0a96fc5b0e297b658b4216e61b2ac72a3de00

SHA256
3a7dbe0eeec6eada9f61947d45779e18c0b367220c08a0c1039711269c86ea87

SHA512
657884c64b023e93d77275e4d74b7356970f95af7eb7eb2f411cc8afd58fb6c06595a82cda66554a8425e0612f4df94d23b1af1c0df623812394aff387ed373c

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
287KB

MD5
d48b89aaf064dfa5ff398c106c2ace21

SHA1
99ef8d82ce6bb4d402ad9ce38551b9817af24ed5

SHA256
6a9470b38e9b45f44fe4313c5b9c3f7d2e24cc77e62e4cd70c4ee8729d55ec95

SHA512
ee9af632baacc8fee0770f58778c2aa720b963736bdfb756ccef92077d1a7bf08759e9bdba285981c02c23970eeb13c5faddfc4ccc9e37cf7460b4f81c01a996

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
287KB

MD5
e29567e0254d5e8ced8609fba18ea468

SHA1
6fdbe8235fd30739a24edae6f68f6955f452f858

SHA256
cec80db1d3a60ad6f7e730db82164da429a05c6eb6f800cd61be60f780e30197

SHA512
4c0f3fb6b03a0d6233679a5d46d200710940146798ec966e4df0fd01e54bfe0e6968dd187c8b690e136fd6e2e03f2852bf4330e85030bdb3d0c14a75de95b492

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
287KB

MD5
0b4ecbf9194444ef88d564916f69568a

SHA1
01bf733de645a5bdefbe2f240be9312be0acc4a0

SHA256
bc0eaede514d952e731f52af574c45f2b72ea9d834a63af3f5ce68f061e5b9ba

SHA512
e2c373a9d47dbbf3e5821772fcbfd0d10fd98c39bb71f6ba37d0354b1a40f3515084549a5ef762796f8f9ee1c7a1a31e57bad24e20e46af17645f2ad3136a968

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
287KB

MD5
0d9fc42ef77da5310378c5ef38e44e81

SHA1
71e771f4ac72c3d6113b1704d4ec585946e34c62

SHA256
d22f62c0cd5b3c2c60bb633754f69f1499926ab4ebe8df4d9ad872caa4bedd58

SHA512
fdfa0d569b658097477ce24db113212802d0b7b1dfe049659e99ef76d7df60992fe2382e37946ff3bf109f12026cbcce9c4c0179a7fb37f843a211b8c6c9c555

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
287KB

MD5
7fcf072358c8f8c52afd9f6edb290ae5

SHA1
a8f5d232124bcc410cd01cac2c0232973fd2792b

SHA256
154051c5472c5503b3280068552f0ed341007a57b190e8de23d8dec11ffa4941

SHA512
a3a07ca474bee69673f7a634ec512c0fbe04c834948e1e684dcd9c2041e8810a2f3ce0eeb9e3df2bd96025ec06c7a81ce315a30c35739b93e0c47e59f33eaca0

Download Submit
C:\Windows\SysWOW64\Lqndhcdc.exe

Filesize
287KB

MD5
13ac55b2537173f45fc8f7b399a2c1b8

SHA1
a8b09ac376f0d2bbfbb2aefe4e72d21bda7d485c

SHA256
723ceb5e8eb064182b466733a726e9ee3f38924f682158ba3bb9369e59ba0cda

SHA512
4e670c4f3a88dbe8e7906f13572399d204f8bde2327a9c5e394087529a74686c98ad2e8f404859510e09b8419aa8395d5a1b67cae92ca497b7cdd773f3e0a3d3

Download Submit
C:\Windows\SysWOW64\Mjdebfnd.exe

Filesize
287KB

MD5
d4bb6ce3f999e5b20b1d23f656dee18f

SHA1
c57b92a96bb92b8d84e35de71c7b29c94d884a1f

SHA256
f637f6a2823065dd1f8a4c68df19159027a89b14f7d2d66abe55aa5aab603a5c

SHA512
4e3fe72a367b5e7f31246a60a33cc97617ce6405f612a2ee054cdec0540ea9289726b6c2896008457bf14df53e64bb258f5818f9a3170acd11d6b40b45d7b470

Download Submit
C:\Windows\SysWOW64\Mjkblhfo.exe

Filesize
287KB

MD5
2baf37c54339557c491b466cc78b80c1

SHA1
4481eb69cb72c6eb889cdd31d5f8e33da7670f11

SHA256
9975ae04cf9ffb6b6643e4d22e8b1156e261ffc95893bed6262faad1757b74de

SHA512
d25e1a439d685eab06581d75ee9c2fe8bc53eba296f6236df45228a4528203991dc2d4186c3430cb3508eed4d1e23f82ab207fb23742b1f29a2cabd97669eea4

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
287KB

MD5
6e8fcf079bf6ac40b60c6ca2427a5905

SHA1
b217e16db1304f1458cbefbd626161ecdeb93ef9

SHA256
1fe661f693522731d3892e64c474b6e04c6541ed29de509da54871c021e436fd

SHA512
03aec74a3c98fa7d6c8f10e18de95cd917227631d4386087ddff5731e6e1fd86555369339425e53151591a9d18304e25832f79649fae5bfa096ac2b225d44d73

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
287KB

MD5
ea639240b707b46751068415423b734d

SHA1
45dabd49befe65595037381685aa127eac59cc43

SHA256
ec53765163b02c3d26c87816fcf96605c01a74d54832d306e0c6a81caded07aa

SHA512
d82e78c2d0c680d60a99e08b95751bd1cfd3b21fdc091bacae2a57e4cfb155ad5ce416b2a3105fa753085b7370c7dca899ce80c97c0d6f5ed83b1fb748456b7b

Download Submit
C:\Windows\SysWOW64\Nclbpf32.exe

Filesize
287KB

MD5
ae5c1b8a140e965407636cead8300148

SHA1
47ac6f1c2d998d62e4d86f1ffab73742457073fd

SHA256
a20daed5fac748670a601ee0f2f18def295e7e9cc18daeebf687ecfb1d637000

SHA512
873475516b5d3cd5ebbf146818ff088184e3a1e9ff43033420bfec11d66ef6f138450acee48daafd329d8e01a395834fc0b38d6494631e0e44615d0b265a41af

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
287KB

MD5
aa4f474fc2c7ce4bdfa2292d89fcfbb5

SHA1
96c483556fdf7d684b6d59613edfe9048208d7c1

SHA256
c4377c026810faefd9f8524b792d15a1678edc5013cc1fb275a65aea956c1315

SHA512
bab49fdbf8ebb8c7235b2dee444246921505a162baafe8055eed67a014af3bb982da15b726a367a21ec295e074ec9a84a83a436e44701daa93f087425b1cdfd3

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
287KB

MD5
a2d742a89bb9a98d59719c9737b6da97

SHA1
e2671f1f7ad9b1c2ee18b139b8637abbf2adfc44

SHA256
9c0d41f7743b32a0594e99bc7522abb141fb2bc2b211df97eca48b9f56b43fd3

SHA512
4cc4fc8b994becef10f9ae98309f033f5d4b6aea39785ebdc6650535adf96668553cd7de1b2d23981887371f4f10339205e2a48649082fdb4cf3307b252a93b8

Download Submit
C:\Windows\SysWOW64\Obgohklm.exe

Filesize
287KB

MD5
50557fe6decb25b01ab60a3d89233b2d

SHA1
6bcd1ba0e33a40e1853fb4b47264fe865197d0f9

SHA256
561e39e4154d9c655b3bcf3cf53af596192b3f95053a789f1201c316fa5aca29

SHA512
55968b09da00c369cefd72fd99946e0ceebbbdd3ff75b293ba2ee29f80110488b4ce6f337e6822d7260ca030139591ebd1dd6478598e3195b38a500ccb3e0bf5

Download Submit
C:\Windows\SysWOW64\Olfghg32.exe

Filesize
287KB

MD5
60190d6b0e31ca0d48838673e6e63209

SHA1
8847800d5575c02b70a86ac975a96c494d52d924

SHA256
0c44c8fc6b5675c52929144a43935203c385bd356f88c7085d7d5f53a7680d8a

SHA512
777c9e5267e9aed6c50004b4d52f07b37c7374573c9b1ce16ba6d9d25745685a2907b9940589ebeb7c6da80faaebbcc56e27d83d1c8d1e8600e9a5a1f1ea1842

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
287KB

MD5
31f93425fb24b58a966259d23427a108

SHA1
e2d28fff2296f233e30a137efb1b4a5c36f40168

SHA256
56fd146ee6391bd567a46bcfa0153170fb4015afff20ecc15ed8d3fb9908dd0e

SHA512
ee587192d1fa82928eeafffeb0dbb5d58ed3855bd342b4aa2cb782e81281111e995098e187494f8e87a594027dadedebd04e1e75c60c1ec4f283d755450ff374

Download Submit
C:\Windows\SysWOW64\Phodcg32.exe

Filesize
287KB

MD5
42a456e726d278c16f7b83b9e82b215e

SHA1
42f6bd0b6e7b735e654649355b8538c2658de57c

SHA256
c5529b6c4e82a729598cff07c9d941063ea1653a5f35dad5e6cdb8f52f7f5d9a

SHA512
062fccd430a9ffbd7a30035cef0102f78b8f588837e9fac598daaee7b93ba79246a02f3db1d3be27dbbb4c1f976e19ab31fe850bca8aa66e52f8e477975db803

Download Submit
C:\Windows\SysWOW64\Pkegpb32.exe

Filesize
287KB

MD5
c794ceb38f86bca436f6f6ff4c722ba1

SHA1
567800f8fbcc0c9a56db39ef871e198d64bcd9a7

SHA256
57f1f80586a23de99095ef9bbbce82b1148debf1193c82f5fe2431bff6855924

SHA512
45c4454548ddd4095d6e819fad06301909db85c1304cabf9ab5556f37139401639e6931916fad003489521c1b16ccc1046fb1c5fb7cde9bfcce9ab11d70a0eec

Download Submit
C:\Windows\SysWOW64\Qfjjpf32.exe

Filesize
287KB

MD5
8f0a8b15a11ecd3bef6a340992d3405b

SHA1
2e4e1ef3c37ce27464926e911a86fbaa77bf02b3

SHA256
2ef83b5b1e6a627aae88cb2ece33717a0e9f980d6c9bb424037bc807f894c61a

SHA512
ecbbd02fb8da6bf6cc6645d617b6c5cfad3e94ae50f5fb6a410888594e7de04e9476a05ba4b2682c37693ffa3a1dc9da744293dd35554fc1b21955b8207affaf

Download Submit
memory/224-305-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/320-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/320-679-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/536-293-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-581-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/840-417-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-562-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1056-299-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1076-263-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1504-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1504-694-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-693-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-536-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1916-624-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1916-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2064-393-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-311-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2084-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2084-432-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2156-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2156-399-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2256-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2308-335-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2356-323-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-479-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2408-387-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2488-353-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-371-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2516-269-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-692-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-233-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2628-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2628-386-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3088-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3088-576-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3216-446-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3220-329-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-484-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3320-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3320-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3388-419-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3388-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3444-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3444-555-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3536-660-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3536-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3552-433-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-439-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3608-347-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3616-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3616-365-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3668-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3668-451-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3696-373-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3888-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3888-591-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3968-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3992-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-453-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4204-590-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4204-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4220-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4220-379-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4256-372-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4388-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4388-569-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4408-289-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4416-317-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4432-420-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4440-459-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4440-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4484-359-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4500-341-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4572-426-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4636-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4668-478-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4668-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4728-384-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4992-511-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4992-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-686-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5064-445-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5072-281-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5108-225-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5108-691-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads