62a9d177a2ebf22b78659f01a4819b50e462e0e1518d50ec8376de1376ac3e56

Analysis

max time kernel
108s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50fbf997f4901b38fcd776a7cd79b9e3.exe
Size

110KB
MD5

50fbf997f4901b38fcd776a7cd79b9e3
SHA1

635109ddd28e5acc7f86c167c49eea537c10f643
SHA256

62a9d177a2ebf22b78659f01a4819b50e462e0e1518d50ec8376de1376ac3e56
SHA512

16d05c3fa7174b4ef7b89c5568e58c4cf2c5260a57a6fc7a2ba4a69445c915023dbceea96f05782b41e4785bcd7f632a64bf60a13d115151521b80746cb72ee0
SSDEEP

1536:a/rUvBumdHPaLbmUMwWX+0xm2Lw5/9RKnMRsErZJkAw5uEPam/lIi2L1:aYdvaLSNwWh1wAnFMkoEPam/qv1

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjkqpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogoncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkalbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbjhph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hplimpdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ollgiplp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhdlbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqkajk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccfmef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnochl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjkigojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peonhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijcecgnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogdofo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfmmajed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqifkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pllggbje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmnjan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecpknke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmijnfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbihmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmopmalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnbjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igmoih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flfbcndo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgphggpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbdgmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkqepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paennh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhfaddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhbciqln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feimadoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fehplggn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ileflmpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpidhmoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diccal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Albkieqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anncek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hchqbkkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maoifh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogmiepcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfbebpdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklffq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfoaam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfnmcnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnaghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqhbgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebbinp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaqgop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okneldkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klekfinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klekfinp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmaciefp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhenai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjaioe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bngfli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogbbqo32.exe

Executes dropped EXE 64 IoCs

pid	Process
4272	Kcpjnjii.exe
3968	Lfgipd32.exe
3712	Mmhgmmbf.exe
2352	Mgeakekd.exe
5080	Nmdgikhi.exe
340	Onkidm32.exe
3308	Ogjdmbil.exe
1188	Pdenmbkk.exe
1224	Ppahmb32.exe
1660	Bdmmeo32.exe
2936	Bajqda32.exe
2376	Ckgohf32.exe
4176	Doojec32.exe
3064	Ddnobj32.exe
396	Eoepebho.exe
1580	Enkmfolf.exe
4660	Edionhpn.exe
4360	Fdlkdhnk.exe
1704	Fqbliicp.exe
2060	Fkhpfbce.exe
3096	Gicgpelg.exe
1364	Giecfejd.exe
3724	Geldkfpi.exe
3468	Gacepg32.exe
2996	Ghojbq32.exe
4988	Hecjke32.exe
1352	Hhdcmp32.exe
1448	Hhfpbpdo.exe
1376	Hnbeeiji.exe
4672	Ihmfco32.exe
3188	Iojkeh32.exe
3332	Ibgdlg32.exe
4916	Jekjcaef.exe
4216	Jikoopij.exe
2544	Kedlip32.exe
4640	Kplmliko.exe
3796	Klbnajqc.exe
4432	Klekfinp.exe
4312	Lpepbgbd.exe
5100	Llnnmhfe.exe
1380	Lhenai32.exe
4152	Modpib32.exe
3024	Mohidbkl.exe
2812	Mlljnf32.exe
3520	Mqjbddpl.exe
2144	Nfgklkoc.exe
4344	Nmaciefp.exe
2100	Ommceclc.exe
4352	Ojcpdg32.exe
4332	Pjoppf32.exe
720	Pjaleemj.exe
2000	Pfhmjf32.exe
5020	Qjffpe32.exe
1936	Qapnmopa.exe
3988	Afockelf.exe
3144	Abfdpfaj.exe
1124	Amkhmoap.exe
2232	Aaiqcnhg.exe
3556	Ampaho32.exe
956	Afhfaddk.exe
4976	Bpcgpihi.exe
5032	Bfolacnc.exe
2532	Cmnnimak.exe
2940	Cbkfbcpb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lmnjan32.exe	Lcifde32.exe
File created	C:\Windows\SysWOW64\Apocmn32.dll	Gqkhda32.exe
File created	C:\Windows\SysWOW64\Cqinng32.exe	Cklffq32.exe
File opened for modification	C:\Windows\SysWOW64\Bplhhc32.exe	Bgdcom32.exe
File created	C:\Windows\SysWOW64\Cohdoh32.exe	Cbofdg32.exe
File created	C:\Windows\SysWOW64\Hgebnc32.exe	Hfamia32.exe
File opened for modification	C:\Windows\SysWOW64\Eoekde32.exe	Eihcln32.exe
File created	C:\Windows\SysWOW64\Jihngboe.exe	Jckeokan.exe
File created	C:\Windows\SysWOW64\Nlnlqocc.dll	Eapmedef.exe
File created	C:\Windows\SysWOW64\Ihmfco32.exe	Hnbeeiji.exe
File opened for modification	C:\Windows\SysWOW64\Leedqa32.exe	Lkppchfi.exe
File opened for modification	C:\Windows\SysWOW64\Dlbfmjqi.exe	Dolinf32.exe
File created	C:\Windows\SysWOW64\Libadidb.dll	Akipic32.exe
File opened for modification	C:\Windows\SysWOW64\Nnbfjf32.exe	Nmajbnha.exe
File opened for modification	C:\Windows\SysWOW64\Mnapnl32.exe	Mkbcbp32.exe
File created	C:\Windows\SysWOW64\Cmmbgpmq.dll	Cofemg32.exe
File created	C:\Windows\SysWOW64\Fgkfqgce.exe	Flfbcndo.exe
File opened for modification	C:\Windows\SysWOW64\Cbihmg32.exe	Chddpn32.exe
File opened for modification	C:\Windows\SysWOW64\Kfidgk32.exe	Keghocao.exe
File created	C:\Windows\SysWOW64\Nefmgogl.exe	Mopeofjl.exe
File opened for modification	C:\Windows\SysWOW64\Omgjhc32.exe	Odnfonag.exe
File created	C:\Windows\SysWOW64\Akdameeh.dll	Kdalni32.exe
File created	C:\Windows\SysWOW64\Hodbhp32.dll	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Klbnajqc.exe	Kplmliko.exe
File opened for modification	C:\Windows\SysWOW64\Nklfho32.exe	Nkijbooo.exe
File opened for modification	C:\Windows\SysWOW64\Nlqloo32.exe	Nefdbekh.exe
File created	C:\Windows\SysWOW64\Mcckpooc.dll	Kpnepk32.exe
File created	C:\Windows\SysWOW64\Aqdbfa32.exe	Ahinbo32.exe
File created	C:\Windows\SysWOW64\Pgphggpe.exe	Ppepkmhi.exe
File created	C:\Windows\SysWOW64\Dknnoofg.exe	Cigkdmel.exe
File created	C:\Windows\SysWOW64\Aeeomegd.exe	Agobna32.exe
File created	C:\Windows\SysWOW64\Onaieifh.exe	Cofemg32.exe
File created	C:\Windows\SysWOW64\Adabbe32.dll	Pgphggpe.exe
File opened for modification	C:\Windows\SysWOW64\Jddggb32.exe	Iplkje32.exe
File opened for modification	C:\Windows\SysWOW64\Jcihjl32.exe	Jmopmalc.exe
File created	C:\Windows\SysWOW64\Bkglkapo.exe	Bjhpqn32.exe
File created	C:\Windows\SysWOW64\Ehedic32.dll	Ebbinp32.exe
File opened for modification	C:\Windows\SysWOW64\Jepbodhg.exe	Jmijnfgd.exe
File created	C:\Windows\SysWOW64\Akdake32.dll	Lkppchfi.exe
File opened for modification	C:\Windows\SysWOW64\Bhdbaihi.exe	Bhaeli32.exe
File created	C:\Windows\SysWOW64\Ocoick32.dll	Giecfejd.exe
File opened for modification	C:\Windows\SysWOW64\Bcfkiock.exe	Aochga32.exe
File opened for modification	C:\Windows\SysWOW64\Bjhpqn32.exe	Bqokhi32.exe
File created	C:\Windows\SysWOW64\Ilqmam32.exe	Hchihhng.exe
File opened for modification	C:\Windows\SysWOW64\Qmlmjq32.exe	Pphlpl32.exe
File created	C:\Windows\SysWOW64\Jmijnfgd.exe	Jfoaam32.exe
File opened for modification	C:\Windows\SysWOW64\Gfcgpkhk.exe	Gcdkdpih.exe
File opened for modification	C:\Windows\SysWOW64\Mgdklb32.exe	Idahcm32.exe
File created	C:\Windows\SysWOW64\Aqjpajgi.dll	Bajqda32.exe
File created	C:\Windows\SysWOW64\Eeeaodnk.dll	Lpepbgbd.exe
File created	C:\Windows\SysWOW64\Flhoinbl.exe	Fgkfqgce.exe
File opened for modification	C:\Windows\SysWOW64\Bngfli32.exe	Bgmnooom.exe
File opened for modification	C:\Windows\SysWOW64\Gflapl32.exe	Gmclgghc.exe
File created	C:\Windows\SysWOW64\Lfgipd32.exe	Kcpjnjii.exe
File opened for modification	C:\Windows\SysWOW64\Hchqbkkm.exe	Hgapmj32.exe
File created	C:\Windows\SysWOW64\Bhnbgoib.dll	Gkalbj32.exe
File created	C:\Windows\SysWOW64\Jaljaoii.exe	Jfffcf32.exe
File created	C:\Windows\SysWOW64\Fdmepl32.dll	Enfjdh32.exe
File created	C:\Windows\SysWOW64\Nmhglopl.exe	Meobeb32.exe
File created	C:\Windows\SysWOW64\Iogangnn.dll	Dfqogfjo.exe
File created	C:\Windows\SysWOW64\Lnhdbc32.exe	Lqdcio32.exe
File created	C:\Windows\SysWOW64\Hgapmj32.exe	Hqdkkp32.exe
File opened for modification	C:\Windows\SysWOW64\Jifabb32.exe	Jcihjl32.exe
File created	C:\Windows\SysWOW64\Lnmajl32.dll	Blkdgheg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gacepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dijgjpip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Diafqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anmagenh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naompiea.dll"	Kpdjbapj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbjhjdf.dll"	Nogngp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfgipd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edionhpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmhibi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkebekgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjdipap.dll"	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efepln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcifde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbcbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkpqlc32.dll"	Fdlkdhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnnldhi.dll"	Cmnnimak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhgpg32.dll"	Hmecba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgekepjo.dll"	Opbcdieb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhhdpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cipebqij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dolinf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnefjjd.dll"	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgokikan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qkjlpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkpbai32.dll"	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfidgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apimodmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqddqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogdofo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maoifh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iebfmfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifphkbep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnkcdoia.dll"	Dijgjpip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnofpqff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djojepof.dll"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilkhog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dalkek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpanmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbcbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgimjd32.dll"	Gggmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paaidf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhcmbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfangk32.dll"	Lfnmcnjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjnoggoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egeemiml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agobna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkhidaeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhenpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apkhfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcnhmeg.dll"	Fqhbgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnkemhbc.dll"	Fehplggn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Addahh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbkfbcpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgkaip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eahjqicj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elepei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjhpdofp.dll"	Bopgdcnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqbcqnph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaljaoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpelbap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4272	4652	50fbf997f4901b38fcd776a7cd79b9e3.exe	92
PID 4652 wrote to memory of 4272	4652	50fbf997f4901b38fcd776a7cd79b9e3.exe	92
PID 4652 wrote to memory of 4272	4652	50fbf997f4901b38fcd776a7cd79b9e3.exe	92
PID 4272 wrote to memory of 3968	4272	Kcpjnjii.exe	93
PID 4272 wrote to memory of 3968	4272	Kcpjnjii.exe	93
PID 4272 wrote to memory of 3968	4272	Kcpjnjii.exe	93
PID 3968 wrote to memory of 3712	3968	Lfgipd32.exe	94
PID 3968 wrote to memory of 3712	3968	Lfgipd32.exe	94
PID 3968 wrote to memory of 3712	3968	Lfgipd32.exe	94
PID 3712 wrote to memory of 2352	3712	Mmhgmmbf.exe	95
PID 3712 wrote to memory of 2352	3712	Mmhgmmbf.exe	95
PID 3712 wrote to memory of 2352	3712	Mmhgmmbf.exe	95
PID 2352 wrote to memory of 5080	2352	Mgeakekd.exe	96
PID 2352 wrote to memory of 5080	2352	Mgeakekd.exe	96
PID 2352 wrote to memory of 5080	2352	Mgeakekd.exe	96
PID 5080 wrote to memory of 340	5080	Nmdgikhi.exe	97
PID 5080 wrote to memory of 340	5080	Nmdgikhi.exe	97
PID 5080 wrote to memory of 340	5080	Nmdgikhi.exe	97
PID 340 wrote to memory of 3308	340	Onkidm32.exe	98
PID 340 wrote to memory of 3308	340	Onkidm32.exe	98
PID 340 wrote to memory of 3308	340	Onkidm32.exe	98
PID 3308 wrote to memory of 1188	3308	Ogjdmbil.exe	99
PID 3308 wrote to memory of 1188	3308	Ogjdmbil.exe	99
PID 3308 wrote to memory of 1188	3308	Ogjdmbil.exe	99
PID 1188 wrote to memory of 1224	1188	Pdenmbkk.exe	100
PID 1188 wrote to memory of 1224	1188	Pdenmbkk.exe	100
PID 1188 wrote to memory of 1224	1188	Pdenmbkk.exe	100
PID 1224 wrote to memory of 1660	1224	Ppahmb32.exe	101
PID 1224 wrote to memory of 1660	1224	Ppahmb32.exe	101
PID 1224 wrote to memory of 1660	1224	Ppahmb32.exe	101
PID 1660 wrote to memory of 2936	1660	Bdmmeo32.exe	102
PID 1660 wrote to memory of 2936	1660	Bdmmeo32.exe	102
PID 1660 wrote to memory of 2936	1660	Bdmmeo32.exe	102
PID 2936 wrote to memory of 2376	2936	Bajqda32.exe	103
PID 2936 wrote to memory of 2376	2936	Bajqda32.exe	103
PID 2936 wrote to memory of 2376	2936	Bajqda32.exe	103
PID 2376 wrote to memory of 4176	2376	Ckgohf32.exe	104
PID 2376 wrote to memory of 4176	2376	Ckgohf32.exe	104
PID 2376 wrote to memory of 4176	2376	Ckgohf32.exe	104
PID 4176 wrote to memory of 3064	4176	Doojec32.exe	105
PID 4176 wrote to memory of 3064	4176	Doojec32.exe	105
PID 4176 wrote to memory of 3064	4176	Doojec32.exe	105
PID 3064 wrote to memory of 396	3064	Ddnobj32.exe	106
PID 3064 wrote to memory of 396	3064	Ddnobj32.exe	106
PID 3064 wrote to memory of 396	3064	Ddnobj32.exe	106
PID 396 wrote to memory of 1580	396	Eoepebho.exe	107
PID 396 wrote to memory of 1580	396	Eoepebho.exe	107
PID 396 wrote to memory of 1580	396	Eoepebho.exe	107
PID 1580 wrote to memory of 4660	1580	Enkmfolf.exe	108
PID 1580 wrote to memory of 4660	1580	Enkmfolf.exe	108
PID 1580 wrote to memory of 4660	1580	Enkmfolf.exe	108
PID 4660 wrote to memory of 4360	4660	Edionhpn.exe	109
PID 4660 wrote to memory of 4360	4660	Edionhpn.exe	109
PID 4660 wrote to memory of 4360	4660	Edionhpn.exe	109
PID 4360 wrote to memory of 1704	4360	Fdlkdhnk.exe	110
PID 4360 wrote to memory of 1704	4360	Fdlkdhnk.exe	110
PID 4360 wrote to memory of 1704	4360	Fdlkdhnk.exe	110
PID 1704 wrote to memory of 2060	1704	Fqbliicp.exe	111
PID 1704 wrote to memory of 2060	1704	Fqbliicp.exe	111
PID 1704 wrote to memory of 2060	1704	Fqbliicp.exe	111
PID 2060 wrote to memory of 3096	2060	Fkhpfbce.exe	112
PID 2060 wrote to memory of 3096	2060	Fkhpfbce.exe	112
PID 2060 wrote to memory of 3096	2060	Fkhpfbce.exe	112
PID 3096 wrote to memory of 1364	3096	Gicgpelg.exe	114

C:\Users\Admin\AppData\Local\Temp\50fbf997f4901b38fcd776a7cd79b9e3.exe
"C:\Users\Admin\AppData\Local\Temp\50fbf997f4901b38fcd776a7cd79b9e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\Kcpjnjii.exe
  C:\Windows\system32\Kcpjnjii.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\Lfgipd32.exe
    C:\Windows\system32\Lfgipd32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\SysWOW64\Mmhgmmbf.exe
      C:\Windows\system32\Mmhgmmbf.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:340
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        24⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        26⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        27⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        28⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1376
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        31⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        32⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        33⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        35⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        36⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4640
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        38⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        43⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        44⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        45⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        46⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        49⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        50⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        51⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        52⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        53⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        54⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        55⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        56⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        57⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        58⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        59⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        60⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        62⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        63⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        66⤵
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        67⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        68⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        69⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        70⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1112
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        73⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        74⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        76⤵
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        77⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Gkefmjcj.exe
        
        C:\Windows\system32\Gkefmjcj.exe
        78⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        79⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        83⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        84⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        86⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        87⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        88⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        89⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        90⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        91⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        92⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        93⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        94⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5920
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        96⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        97⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        98⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        99⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        100⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        101⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        102⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        104⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        107⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        108⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        109⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        110⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        111⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        112⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        113⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        115⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        116⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        117⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        118⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        120⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        121⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        122⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        123⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        124⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        125⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        126⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        127⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        128⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        129⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        130⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Deidjf32.exe
        
        C:\Windows\system32\Deidjf32.exe
        131⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        132⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dekapfke.exe
        
        C:\Windows\system32\Dekapfke.exe
        133⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        134⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        137⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Flhoinbl.exe
        
        C:\Windows\system32\Flhoinbl.exe
        138⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        139⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        140⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        142⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        143⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        144⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        146⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        147⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        148⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        149⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Iebfmfdg.exe
        
        C:\Windows\system32\Iebfmfdg.exe
        150⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        151⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jghhjq32.exe
        
        C:\Windows\system32\Jghhjq32.exe
        152⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        153⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jfoaam32.exe
        
        C:\Windows\system32\Jfoaam32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        156⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Keghocao.exe
        
        C:\Windows\system32\Keghocao.exe
        157⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        158⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        159⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        160⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        161⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Leedqa32.exe
        
        C:\Windows\system32\Leedqa32.exe
        162⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Mdkabmjf.exe
        
        C:\Windows\system32\Mdkabmjf.exe
        163⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        164⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        165⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        166⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Okneldkf.exe
        
        C:\Windows\system32\Okneldkf.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Pdpmkhjl.exe
        
        C:\Windows\system32\Pdpmkhjl.exe
        168⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        169⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        170⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        172⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Bichcc32.exe
        
        C:\Windows\system32\Bichcc32.exe
        174⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bomppneg.exe
        
        C:\Windows\system32\Bomppneg.exe
        175⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        176⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        177⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        178⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        179⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Bgkaip32.exe
        
        C:\Windows\system32\Bgkaip32.exe
        180⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        181⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Beobcdoi.exe
        
        C:\Windows\system32\Beobcdoi.exe
        182⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        183⤵
        Drops file in System32 directory
        
        PID:5080
        
        C:\Windows\SysWOW64\Bngfli32.exe
        
        C:\Windows\system32\Bngfli32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        185⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        186⤵
        Drops file in System32 directory
        
        PID:2004
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        188⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        189⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Diopep32.exe
        
        C:\Windows\system32\Diopep32.exe
        190⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Dolinf32.exe
        
        C:\Windows\system32\Dolinf32.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        192⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        194⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        195⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        196⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        197⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        198⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        199⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        200⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        201⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Fpeaeedg.exe
        
        C:\Windows\system32\Fpeaeedg.exe
        202⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        203⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        204⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        205⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        206⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        207⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Ggfobofl.exe
        
        C:\Windows\system32\Ggfobofl.exe
        208⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        209⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        210⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        211⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        212⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Hllkqdli.exe
        
        C:\Windows\system32\Hllkqdli.exe
        213⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        214⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        215⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Jgbhdkml.exe
        
        C:\Windows\system32\Jgbhdkml.exe
        216⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:468
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        218⤵
        Drops file in System32 directory
        
        PID:1492
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        219⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Jckeokan.exe
        
        C:\Windows\system32\Jckeokan.exe
        220⤵
        Drops file in System32 directory
        
        PID:4116
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        221⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        222⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        223⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        224⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        225⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        226⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        227⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        228⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        229⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        230⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        231⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        232⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3428
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        235⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Ogdofo32.exe
        
        C:\Windows\system32\Ogdofo32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        237⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        238⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        239⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Pdklebje.exe
        
        C:\Windows\system32\Pdklebje.exe
        240⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        241⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        242⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        243⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        244⤵
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        245⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        246⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        247⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Pnlcdg32.exe
        
        C:\Windows\system32\Pnlcdg32.exe
        248⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        249⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        251⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Agnkck32.exe
        
        C:\Windows\system32\Agnkck32.exe
        252⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        253⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        254⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        255⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        256⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        257⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        258⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        259⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        260⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        261⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        262⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        263⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        264⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Elfhmc32.exe
        
        C:\Windows\system32\Elfhmc32.exe
        265⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Eahjqicj.exe
        
        C:\Windows\system32\Eahjqicj.exe
        266⤵
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        267⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Fehplggn.exe
        
        C:\Windows\system32\Fehplggn.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Fbqiak32.exe
        
        C:\Windows\system32\Fbqiak32.exe
        269⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Glkkop32.exe
        
        C:\Windows\system32\Glkkop32.exe
        270⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        271⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        272⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Golcak32.exe
        
        C:\Windows\system32\Golcak32.exe
        273⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        274⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        275⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        276⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hklglk32.exe
        
        C:\Windows\system32\Hklglk32.exe
        277⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        278⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        279⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        280⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Hlnqln32.exe
        
        C:\Windows\system32\Hlnqln32.exe
        281⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Hchihhng.exe
        
        C:\Windows\system32\Hchihhng.exe
        282⤵
        Drops file in System32 directory
        
        PID:8108
        
        C:\Windows\SysWOW64\Ilqmam32.exe
        
        C:\Windows\system32\Ilqmam32.exe
        283⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Icjengld.exe
        
        C:\Windows\system32\Icjengld.exe
        284⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ilcjgm32.exe
        
        C:\Windows\system32\Ilcjgm32.exe
        285⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        286⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Ileflmpb.exe
        
        C:\Windows\system32\Ileflmpb.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Ifphkbep.exe
        
        C:\Windows\system32\Ifphkbep.exe
        288⤵
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        289⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Jbghpc32.exe
        
        C:\Windows\system32\Jbghpc32.exe
        290⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        291⤵
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        292⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        293⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        294⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Kfggbope.exe
        
        C:\Windows\system32\Kfggbope.exe
        295⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        296⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        297⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        299⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        300⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        301⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Mppdbb32.exe
        
        C:\Windows\system32\Mppdbb32.exe
        302⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        303⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Mlgegcng.exe
        
        C:\Windows\system32\Mlgegcng.exe
        304⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        305⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Mcpjnp32.exe
        
        C:\Windows\system32\Mcpjnp32.exe
        306⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        307⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Nidhffef.exe
        
        C:\Windows\system32\Nidhffef.exe
        308⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Odnfonag.exe
        
        C:\Windows\system32\Odnfonag.exe
        309⤵
        Drops file in System32 directory
        
        PID:4948
        
        C:\Windows\SysWOW64\Omgjhc32.exe
        
        C:\Windows\system32\Omgjhc32.exe
        310⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Odqbdnod.exe
        
        C:\Windows\system32\Odqbdnod.exe
        311⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ojkkah32.exe
        
        C:\Windows\system32\Ojkkah32.exe
        312⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ollgiplp.exe
        
        C:\Windows\system32\Ollgiplp.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Ofalfi32.exe
        
        C:\Windows\system32\Ofalfi32.exe
        314⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Pignccea.exe
        
        C:\Windows\system32\Pignccea.exe
        315⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Pilgnb32.exe
        
        C:\Windows\system32\Pilgnb32.exe
        316⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ppepkmhi.exe
        
        C:\Windows\system32\Ppepkmhi.exe
        317⤵
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Pgphggpe.exe
        
        C:\Windows\system32\Pgphggpe.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Pphlpl32.exe
        
        C:\Windows\system32\Pphlpl32.exe
        319⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Qmlmjq32.exe
        
        C:\Windows\system32\Qmlmjq32.exe
        320⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Qgdabflp.exe
        
        C:\Windows\system32\Qgdabflp.exe
        321⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Adohmidb.exe
        
        C:\Windows\system32\Adohmidb.exe
        322⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Akipic32.exe
        
        C:\Windows\system32\Akipic32.exe
        323⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Angleokb.exe
        
        C:\Windows\system32\Angleokb.exe
        324⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Acdeneij.exe
        
        C:\Windows\system32\Acdeneij.exe
        325⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ajnmjp32.exe
        
        C:\Windows\system32\Ajnmjp32.exe
        326⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Addahh32.exe
        
        C:\Windows\system32\Addahh32.exe
        327⤵
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Bknidbhi.exe
        
        C:\Windows\system32\Bknidbhi.exe
        328⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Bdfnmhnj.exe
        
        C:\Windows\system32\Bdfnmhnj.exe
        329⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Bjcfeola.exe
        
        C:\Windows\system32\Bjcfeola.exe
        330⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Bckknd32.exe
        
        C:\Windows\system32\Bckknd32.exe
        331⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Bjeckojo.exe
        
        C:\Windows\system32\Bjeckojo.exe
        332⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Bqokhi32.exe
        
        C:\Windows\system32\Bqokhi32.exe
        333⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Bjhpqn32.exe
        
        C:\Windows\system32\Bjhpqn32.exe
        334⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Bkglkapo.exe
        
        C:\Windows\system32\Bkglkapo.exe
        335⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        336⤵
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Ccendc32.exe
        
        C:\Windows\system32\Ccendc32.exe
        337⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cklffq32.exe
        
        C:\Windows\system32\Cklffq32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Cqinng32.exe
        
        C:\Windows\system32\Cqinng32.exe
        339⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Cjabgm32.exe
        
        C:\Windows\system32\Cjabgm32.exe
        340⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Cqmgigfk.exe
        
        C:\Windows\system32\Cqmgigfk.exe
        341⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Dqigee32.exe
        
        C:\Windows\system32\Dqigee32.exe
        342⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Djalnkbo.exe
        
        C:\Windows\system32\Djalnkbo.exe
        343⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Eegpkcbd.exe
        
        C:\Windows\system32\Eegpkcbd.exe
        344⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Enoddi32.exe
        
        C:\Windows\system32\Enoddi32.exe
        345⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Eapmedef.exe
        
        C:\Windows\system32\Eapmedef.exe
        346⤵
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Enfjdh32.exe
        
        C:\Windows\system32\Enfjdh32.exe
        347⤵
        Drops file in System32 directory
        
        PID:100
        
        C:\Windows\SysWOW64\Egoomnin.exe
        
        C:\Windows\system32\Egoomnin.exe
        348⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fhchhm32.exe
        
        C:\Windows\system32\Fhchhm32.exe
        349⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Fhfenmbe.exe
        
        C:\Windows\system32\Fhfenmbe.exe
        350⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Fmbnfcam.exe
        
        C:\Windows\system32\Fmbnfcam.exe
        351⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Fnbjpf32.exe
        
        C:\Windows\system32\Fnbjpf32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Fndgfffm.exe
        
        C:\Windows\system32\Fndgfffm.exe
        353⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Gdaonmdd.exe
        
        C:\Windows\system32\Gdaonmdd.exe
        354⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Gaepgacn.exe
        
        C:\Windows\system32\Gaepgacn.exe
        355⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Goipae32.exe
        
        C:\Windows\system32\Goipae32.exe
        356⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Hmecba32.exe
        
        C:\Windows\system32\Hmecba32.exe
        357⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Heohinog.exe
        
        C:\Windows\system32\Heohinog.exe
        358⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Hklpaeno.exe
        
        C:\Windows\system32\Hklpaeno.exe
        359⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Headon32.exe
        
        C:\Windows\system32\Headon32.exe
        360⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ikechced.exe
        
        C:\Windows\system32\Ikechced.exe
        361⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        362⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Jdnqgg32.exe
        
        C:\Windows\system32\Jdnqgg32.exe
        363⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Kkhidaeo.exe
        
        C:\Windows\system32\Kkhidaeo.exe
        364⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Kfmmajed.exe
        
        C:\Windows\system32\Kfmmajed.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Kkaljpmd.exe
        
        C:\Windows\system32\Kkaljpmd.exe
        366⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Lkfeeo32.exe
        
        C:\Windows\system32\Lkfeeo32.exe
        367⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Lfkich32.exe
        
        C:\Windows\system32\Lfkich32.exe
        368⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Lmeapbpa.exe
        
        C:\Windows\system32\Lmeapbpa.exe
        369⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        370⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Lbdgmh32.exe
        
        C:\Windows\system32\Lbdgmh32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Lkmkfncf.exe
        
        C:\Windows\system32\Lkmkfncf.exe
        372⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Mkfnlmkl.exe
        
        C:\Windows\system32\Mkfnlmkl.exe
        373⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Meobeb32.exe
        
        C:\Windows\system32\Meobeb32.exe
        374⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Nmhglopl.exe
        
        C:\Windows\system32\Nmhglopl.exe
        375⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Nlmdml32.exe
        
        C:\Windows\system32\Nlmdml32.exe
        376⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Nmajbnha.exe
        
        C:\Windows\system32\Nmajbnha.exe
        377⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Nnbfjf32.exe
        
        C:\Windows\system32\Nnbfjf32.exe
        378⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Oihkgo32.exe
        
        C:\Windows\system32\Oihkgo32.exe
        379⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Opbcdieb.exe
        
        C:\Windows\system32\Opbcdieb.exe
        380⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Oijgmokc.exe
        
        C:\Windows\system32\Oijgmokc.exe
        381⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Omhpcm32.exe
        
        C:\Windows\system32\Omhpcm32.exe
        382⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Ofadlbhj.exe
        
        C:\Windows\system32\Ofadlbhj.exe
        383⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Omkmhlpf.exe
        
        C:\Windows\system32\Omkmhlpf.exe
        384⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Olpjii32.exe
        
        C:\Windows\system32\Olpjii32.exe
        385⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pmpfcl32.exe
        
        C:\Windows\system32\Pmpfcl32.exe
        386⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        387⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Pmbcik32.exe
        
        C:\Windows\system32\Pmbcik32.exe
        388⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Qlnfkgho.exe
        
        C:\Windows\system32\Qlnfkgho.exe
        389⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ampojimo.exe
        
        C:\Windows\system32\Ampojimo.exe
        390⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Aochga32.exe
        
        C:\Windows\system32\Aochga32.exe
        391⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Bcfkiock.exe
        
        C:\Windows\system32\Bcfkiock.exe
        392⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        393⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bgdcom32.exe
        
        C:\Windows\system32\Bgdcom32.exe
        394⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Bplhhc32.exe
        
        C:\Windows\system32\Bplhhc32.exe
        395⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Beippj32.exe
        
        C:\Windows\system32\Beippj32.exe
        396⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Bodano32.exe
        
        C:\Windows\system32\Bodano32.exe
        397⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Cjnoggoh.exe
        
        C:\Windows\system32\Cjnoggoh.exe
        398⤵
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Cgdlfk32.exe
        
        C:\Windows\system32\Cgdlfk32.exe
        399⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Claenb32.exe
        
        C:\Windows\system32\Claenb32.exe
        400⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Dlcaca32.exe
        
        C:\Windows\system32\Dlcaca32.exe
        401⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Djgbmffn.exe
        
        C:\Windows\system32\Djgbmffn.exe
        402⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Dcpffk32.exe
        
        C:\Windows\system32\Dcpffk32.exe
        403⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Djjobedk.exe
        
        C:\Windows\system32\Djjobedk.exe
        404⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Dofgklcb.exe
        
        C:\Windows\system32\Dofgklcb.exe
        405⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Dfqogfjo.exe
        
        C:\Windows\system32\Dfqogfjo.exe
        406⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Dmjgdq32.exe
        
        C:\Windows\system32\Dmjgdq32.exe
        407⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Djnhne32.exe
        
        C:\Windows\system32\Djnhne32.exe
        408⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Dgbhgi32.exe
        
        C:\Windows\system32\Dgbhgi32.exe
        409⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Emoaopnf.exe
        
        C:\Windows\system32\Emoaopnf.exe
        410⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Egeemiml.exe
        
        C:\Windows\system32\Egeemiml.exe
        411⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Eckfaj32.exe
        
        C:\Windows\system32\Eckfaj32.exe
        412⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        413⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        414⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ejhkdc32.exe
        
        C:\Windows\system32\Ejhkdc32.exe
        415⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Eqbcqnph.exe
        
        C:\Windows\system32\Eqbcqnph.exe
        416⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Efolidno.exe
        
        C:\Windows\system32\Efolidno.exe
        417⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        418⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ffahnd32.exe
        
        C:\Windows\system32\Ffahnd32.exe
        419⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Fqfmlm32.exe
        
        C:\Windows\system32\Fqfmlm32.exe
        420⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        421⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        422⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        423⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Fppchile.exe
        
        C:\Windows\system32\Fppchile.exe
        424⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Ffjkdc32.exe
        
        C:\Windows\system32\Ffjkdc32.exe
        425⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        426⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gjkqpa32.exe
        
        C:\Windows\system32\Gjkqpa32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Gnkflo32.exe
        
        C:\Windows\system32\Gnkflo32.exe
        428⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Gnmbao32.exe
        
        C:\Windows\system32\Gnmbao32.exe
        429⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        430⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Hhhdpd32.exe
        
        C:\Windows\system32\Hhhdpd32.exe
        431⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Hpchdf32.exe
        
        C:\Windows\system32\Hpchdf32.exe
        432⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        433⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hjkigojc.exe
        
        C:\Windows\system32\Hjkigojc.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2032
        
        C:\Windows\SysWOW64\Iplkje32.exe
        
        C:\Windows\system32\Iplkje32.exe
        435⤵
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        436⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        437⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Jajdff32.exe
        
        C:\Windows\system32\Jajdff32.exe
        438⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Jhdlbp32.exe
        
        C:\Windows\system32\Jhdlbp32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1344
        
        C:\Windows\SysWOW64\Jondojna.exe
        
        C:\Windows\system32\Jondojna.exe
        440⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        441⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Kgkfil32.exe
        
        C:\Windows\system32\Kgkfil32.exe
        442⤵
        
        PID:6376

C:\Windows\SysWOW64\Kpdjbapj.exe
C:\Windows\system32\Kpdjbapj.exe
1⤵
- Modifies registry class
PID:6408
- C:\Windows\SysWOW64\Kacgld32.exe
  C:\Windows\system32\Kacgld32.exe
  2⤵
  PID:7152
- - C:\Windows\SysWOW64\Kojdkhdd.exe
    C:\Windows\system32\Kojdkhdd.exe
    3⤵
    PID:5308
  - - C:\Windows\SysWOW64\Kpkqbq32.exe
      C:\Windows\system32\Kpkqbq32.exe
      4⤵
      PID:4380
    - - C:\Windows\SysWOW64\Kkqepi32.exe
        
        C:\Windows\system32\Kkqepi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2308
      - C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        6⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        7⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        8⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        9⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Lnhdbc32.exe
        
        C:\Windows\system32\Lnhdbc32.exe
        10⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        11⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mddidm32.exe
        
        C:\Windows\system32\Mddidm32.exe
        12⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        13⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Mdgejmdi.exe
        
        C:\Windows\system32\Mdgejmdi.exe
        14⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Mhenpk32.exe
        
        C:\Windows\system32\Mhenpk32.exe
        15⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        17⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mndcnafd.exe
        
        C:\Windows\system32\Mndcnafd.exe
        18⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        19⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Nqifkl32.exe
        
        C:\Windows\system32\Nqifkl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Oapllk32.exe
        
        C:\Windows\system32\Oapllk32.exe
        21⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Oabiak32.exe
        
        C:\Windows\system32\Oabiak32.exe
        22⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        23⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Oeqagi32.exe
        
        C:\Windows\system32\Oeqagi32.exe
        24⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ogoncd32.exe
        
        C:\Windows\system32\Ogoncd32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Oagbljcp.exe
        
        C:\Windows\system32\Oagbljcp.exe
        26⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Picchg32.exe
        
        C:\Windows\system32\Picchg32.exe
        27⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ppmleagi.exe
        
        C:\Windows\system32\Ppmleagi.exe
        28⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Piepnfnj.exe
        
        C:\Windows\system32\Piepnfnj.exe
        29⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Peonhg32.exe
        
        C:\Windows\system32\Peonhg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Paennh32.exe
        
        C:\Windows\system32\Paennh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:772
        
        C:\Windows\SysWOW64\Qhofjbnl.exe
        
        C:\Windows\system32\Qhofjbnl.exe
        32⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        33⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Apkhfo32.exe
        
        C:\Windows\system32\Apkhfo32.exe
        34⤵
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        35⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Apndloif.exe
        
        C:\Windows\system32\Apndloif.exe
        36⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Aaoadg32.exe
        
        C:\Windows\system32\Aaoadg32.exe
        37⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Ahiiqafa.exe
        
        C:\Windows\system32\Ahiiqafa.exe
        38⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Aacjofkp.exe
        
        C:\Windows\system32\Aacjofkp.exe
        39⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        40⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        41⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Bpidhmoi.exe
        
        C:\Windows\system32\Bpidhmoi.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3024
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        43⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Bidefbcg.exe
        
        C:\Windows\system32\Bidefbcg.exe
        44⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Bpnncl32.exe
        
        C:\Windows\system32\Bpnncl32.exe
        45⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Baojkdqb.exe
        
        C:\Windows\system32\Baojkdqb.exe
        46⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        47⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Cbofdg32.exe
        
        C:\Windows\system32\Cbofdg32.exe
        48⤵
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\Cohdoh32.exe
        
        C:\Windows\system32\Cohdoh32.exe
        49⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Cebllbcc.exe
        
        C:\Windows\system32\Cebllbcc.exe
        50⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Clldhljp.exe
        
        C:\Windows\system32\Clldhljp.exe
        51⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Ccfmef32.exe
        
        C:\Windows\system32\Ccfmef32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3616
        
        C:\Windows\SysWOW64\Cipebqij.exe
        
        C:\Windows\system32\Cipebqij.exe
        53⤵
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Commjgga.exe
        
        C:\Windows\system32\Commjgga.exe
        54⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Cefega32.exe
        
        C:\Windows\system32\Cefega32.exe
        55⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Clqncl32.exe
        
        C:\Windows\system32\Clqncl32.exe
        56⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Dcjfpfnh.exe
        
        C:\Windows\system32\Dcjfpfnh.exe
        57⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Deiblamk.exe
        
        C:\Windows\system32\Deiblamk.exe
        58⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Dapcab32.exe
        
        C:\Windows\system32\Dapcab32.exe
        59⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Dpqcoj32.exe
        
        C:\Windows\system32\Dpqcoj32.exe
        60⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dadlmanj.exe
        
        C:\Windows\system32\Dadlmanj.exe
        61⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dhndil32.exe
        
        C:\Windows\system32\Dhndil32.exe
        62⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Dfbebpdq.exe
        
        C:\Windows\system32\Dfbebpdq.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7336
        
        C:\Windows\SysWOW64\Dhqaokcd.exe
        
        C:\Windows\system32\Dhqaokcd.exe
        64⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Ebifha32.exe
        
        C:\Windows\system32\Ebifha32.exe
        65⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Epjfehbd.exe
        
        C:\Windows\system32\Epjfehbd.exe
        66⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ebkbmqhb.exe
        
        C:\Windows\system32\Ebkbmqhb.exe
        67⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Elagjihh.exe
        
        C:\Windows\system32\Elagjihh.exe
        68⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Ehhgpj32.exe
        
        C:\Windows\system32\Ehhgpj32.exe
        69⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Ecmlmcmb.exe
        
        C:\Windows\system32\Ecmlmcmb.exe
        70⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Elepei32.exe
        
        C:\Windows\system32\Elepei32.exe
        71⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Ebbinp32.exe
        
        C:\Windows\system32\Ebbinp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4640
        
        C:\Windows\SysWOW64\Fcbehbim.exe
        
        C:\Windows\system32\Fcbehbim.exe
        73⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Fhonpi32.exe
        
        C:\Windows\system32\Fhonpi32.exe
        74⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Fbgbione.exe
        
        C:\Windows\system32\Fbgbione.exe
        75⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Fqhbgf32.exe
        
        C:\Windows\system32\Fqhbgf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        77⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Fmapag32.exe
        
        C:\Windows\system32\Fmapag32.exe
        78⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        79⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Gmclgghc.exe
        
        C:\Windows\system32\Gmclgghc.exe
        80⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Gflapl32.exe
        
        C:\Windows\system32\Gflapl32.exe
        81⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gcbnopkj.exe
        
        C:\Windows\system32\Gcbnopkj.exe
        82⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Gcdkdpih.exe
        
        C:\Windows\system32\Gcdkdpih.exe
        83⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Gfcgpkhk.exe
        
        C:\Windows\system32\Gfcgpkhk.exe
        84⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Gpkliaol.exe
        
        C:\Windows\system32\Gpkliaol.exe
        85⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Hidpbf32.exe
        
        C:\Windows\system32\Hidpbf32.exe
        86⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Hbldkllm.exe
        
        C:\Windows\system32\Hbldkllm.exe
        87⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Hclaeocp.exe
        
        C:\Windows\system32\Hclaeocp.exe
        88⤵
        
        PID:7444

C:\Windows\SysWOW64\Hihimfag.exe
C:\Windows\system32\Hihimfag.exe
1⤵
PID:5272
- C:\Windows\SysWOW64\Hcnnjoam.exe
  C:\Windows\system32\Hcnnjoam.exe
  2⤵
  PID:7448
- - C:\Windows\SysWOW64\Hikfbeod.exe
    C:\Windows\system32\Hikfbeod.exe
    3⤵
    PID:6520
  - - C:\Windows\SysWOW64\Hpenpp32.exe
      C:\Windows\system32\Hpenpp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:456
    - - C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        5⤵
        
        PID:6576
      - C:\Windows\SysWOW64\Imklncch.exe
        
        C:\Windows\system32\Imklncch.exe
        6⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Ifcpgiji.exe
        
        C:\Windows\system32\Ifcpgiji.exe
        7⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Ibjqlj32.exe
        
        C:\Windows\system32\Ibjqlj32.exe
        8⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ijcecgnl.exe
        
        C:\Windows\system32\Ijcecgnl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        10⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Ipckqnja.exe
        
        C:\Windows\system32\Ipckqnja.exe
        11⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Jpgdlm32.exe
        
        C:\Windows\system32\Jpgdlm32.exe
        12⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jjmhie32.exe
        
        C:\Windows\system32\Jjmhie32.exe
        13⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jmnakqcc.exe
        
        C:\Windows\system32\Jmnakqcc.exe
        14⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        15⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        16⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Kkdnjd32.exe
        
        C:\Windows\system32\Kkdnjd32.exe
        17⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Kilhqq32.exe
        
        C:\Windows\system32\Kilhqq32.exe
        18⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Kdalni32.exe
        
        C:\Windows\system32\Kdalni32.exe
        19⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Kkkdjcjb.exe
        
        C:\Windows\system32\Kkkdjcjb.exe
        20⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Kaemgn32.exe
        
        C:\Windows\system32\Kaemgn32.exe
        21⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Lcifde32.exe
        
        C:\Windows\system32\Lcifde32.exe
        22⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3048
        
        C:\Windows\SysWOW64\Lgfojd32.exe
        
        C:\Windows\system32\Lgfojd32.exe
        24⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Lpocciba.exe
        
        C:\Windows\system32\Lpocciba.exe
        25⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Lkdgqbag.exe
        
        C:\Windows\system32\Lkdgqbag.exe
        26⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Lpapiipo.exe
        
        C:\Windows\system32\Lpapiipo.exe
        27⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        28⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Laqlclga.exe
        
        C:\Windows\system32\Laqlclga.exe
        29⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Lcbikd32.exe
        
        C:\Windows\system32\Lcbikd32.exe
        30⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Lkiqla32.exe
        
        C:\Windows\system32\Lkiqla32.exe
        31⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        32⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Mknjgajl.exe
        
        C:\Windows\system32\Mknjgajl.exe
        33⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Mahbck32.exe
        
        C:\Windows\system32\Mahbck32.exe
        34⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Mgdklb32.exe
        
        C:\Windows\system32\Mgdklb32.exe
        35⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Mnochl32.exe
        
        C:\Windows\system32\Mnochl32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Mkbcbp32.exe
        
        C:\Windows\system32\Mkbcbp32.exe
        37⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        38⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Mdkhkflh.exe
        
        C:\Windows\system32\Mdkhkflh.exe
        39⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Mkepgp32.exe
        
        C:\Windows\system32\Mkepgp32.exe
        40⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Nqaipgal.exe
        
        C:\Windows\system32\Nqaipgal.exe
        41⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        42⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Njjmil32.exe
        
        C:\Windows\system32\Njjmil32.exe
        43⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Nkijbooo.exe
        
        C:\Windows\system32\Nkijbooo.exe
        44⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Nklfho32.exe
        
        C:\Windows\system32\Nklfho32.exe
        45⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Nnmojj32.exe
        
        C:\Windows\system32\Nnmojj32.exe
        46⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Ndfgfd32.exe
        
        C:\Windows\system32\Ndfgfd32.exe
        47⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        48⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Ocldhqgb.exe
        
        C:\Windows\system32\Ocldhqgb.exe
        50⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Onaieifh.exe
        
        C:\Windows\system32\Onaieifh.exe
        51⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Odkaac32.exe
        
        C:\Windows\system32\Odkaac32.exe
        52⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Oboakhmo.exe
        
        C:\Windows\system32\Oboakhmo.exe
        53⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        54⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Ojjfpjjj.exe
        
        C:\Windows\system32\Ojjfpjjj.exe
        55⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Odpjmcjp.exe
        
        C:\Windows\system32\Odpjmcjp.exe
        56⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        57⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        58⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Pkebekgo.exe
        
        C:\Windows\system32\Pkebekgo.exe
        59⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Pglcjl32.exe
        
        C:\Windows\system32\Pglcjl32.exe
        60⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Qnfkgfdp.exe
        
        C:\Windows\system32\Qnfkgfdp.exe
        61⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Qcccom32.exe
        
        C:\Windows\system32\Qcccom32.exe
        62⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        63⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Agcikk32.exe
        
        C:\Windows\system32\Agcikk32.exe
        64⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Anmagenh.exe
        
        C:\Windows\system32\Anmagenh.exe
        65⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Aanjiqki.exe
        
        C:\Windows\system32\Aanjiqki.exe
        66⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Alcofi32.exe
        
        C:\Windows\system32\Alcofi32.exe
        67⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Aaqgop32.exe
        
        C:\Windows\system32\Aaqgop32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Ahjoljqc.exe
        
        C:\Windows\system32\Ahjoljqc.exe
        69⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Ajikhfpg.exe
        
        C:\Windows\system32\Ajikhfpg.exe
        70⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Adapqk32.exe
        
        C:\Windows\system32\Adapqk32.exe
        71⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Beqljn32.exe
        
        C:\Windows\system32\Beqljn32.exe
        72⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        73⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        74⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Bhdbaihi.exe
        
        C:\Windows\system32\Bhdbaihi.exe
        75⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Bopgdcnc.exe
        
        C:\Windows\system32\Bopgdcnc.exe
        76⤵
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Bejoqm32.exe
        
        C:\Windows\system32\Bejoqm32.exe
        77⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        78⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Ceaealoh.exe
        
        C:\Windows\system32\Ceaealoh.exe
        79⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        80⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        81⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Dhdkig32.exe
        
        C:\Windows\system32\Dhdkig32.exe
        82⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        83⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Dlbcoe32.exe
        
        C:\Windows\system32\Dlbcoe32.exe
        84⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Dhidcffq.exe
        
        C:\Windows\system32\Dhidcffq.exe
        85⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Docmqp32.exe
        
        C:\Windows\system32\Docmqp32.exe
        86⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        87⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Dlgmjdlg.exe
        
        C:\Windows\system32\Dlgmjdlg.exe
        88⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Dacebkko.exe
        
        C:\Windows\system32\Dacebkko.exe
        89⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Dhnnoe32.exe
        
        C:\Windows\system32\Dhnnoe32.exe
        90⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        91⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        92⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ehbgjenf.exe
        
        C:\Windows\system32\Ehbgjenf.exe
        93⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Echkgnnl.exe
        
        C:\Windows\system32\Echkgnnl.exe
        94⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ehddpdlc.exe
        
        C:\Windows\system32\Ehddpdlc.exe
        95⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Eoollocp.exe
        
        C:\Windows\system32\Eoollocp.exe
        96⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Elbmebbj.exe
        
        C:\Windows\system32\Elbmebbj.exe
        97⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Eekanh32.exe
        
        C:\Windows\system32\Eekanh32.exe
        98⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Eaabci32.exe
        
        C:\Windows\system32\Eaabci32.exe
        99⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        100⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Fcanmlea.exe
        
        C:\Windows\system32\Fcanmlea.exe
        101⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Fdbked32.exe
        
        C:\Windows\system32\Fdbked32.exe
        102⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Fljcfa32.exe
        
        C:\Windows\system32\Fljcfa32.exe
        103⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Fafkoiji.exe
        
        C:\Windows\system32\Fafkoiji.exe
        104⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Fhpckb32.exe
        
        C:\Windows\system32\Fhpckb32.exe
        105⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Flnlaahl.exe
        
        C:\Windows\system32\Flnlaahl.exe
        106⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Fchdnkpi.exe
        
        C:\Windows\system32\Fchdnkpi.exe
        107⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        108⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        109⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        110⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        111⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Goconkah.exe
        
        C:\Windows\system32\Goconkah.exe
        112⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Gmhogppb.exe
        
        C:\Windows\system32\Gmhogppb.exe
        113⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Gcagdj32.exe
        
        C:\Windows\system32\Gcagdj32.exe
        114⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Gfbpfedp.exe
        
        C:\Windows\system32\Gfbpfedp.exe
        115⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        116⤵
        
        PID:680
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        117⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Hfgjad32.exe
        
        C:\Windows\system32\Hfgjad32.exe
        118⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Hmabnnhg.exe
        
        C:\Windows\system32\Hmabnnhg.exe
        119⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Hfiffd32.exe
        
        C:\Windows\system32\Hfiffd32.exe
        120⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        121⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Hbpgle32.exe
        
        C:\Windows\system32\Hbpgle32.exe
        122⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        123⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Hcpcehko.exe
        
        C:\Windows\system32\Hcpcehko.exe
        124⤵
        
        PID:100
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        125⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Hpfdkiac.exe
        
        C:\Windows\system32\Hpfdkiac.exe
        126⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Iecmcpoj.exe
        
        C:\Windows\system32\Iecmcpoj.exe
        127⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Ieeihomg.exe
        
        C:\Windows\system32\Ieeihomg.exe
        128⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        129⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Iejcco32.exe
        
        C:\Windows\system32\Iejcco32.exe
        130⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        131⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        132⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Jmfdpkeo.exe
        
        C:\Windows\system32\Jmfdpkeo.exe
        133⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jcplle32.exe
        
        C:\Windows\system32\Jcplle32.exe
        134⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        135⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        136⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        137⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Jbgfca32.exe
        
        C:\Windows\system32\Jbgfca32.exe
        138⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Jianpl32.exe
        
        C:\Windows\system32\Jianpl32.exe
        139⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jpkfmfok.exe
        
        C:\Windows\system32\Jpkfmfok.exe
        140⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jfeoip32.exe
        
        C:\Windows\system32\Jfeoip32.exe
        141⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Klbgag32.exe
        
        C:\Windows\system32\Klbgag32.exe
        142⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        143⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        144⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        145⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        146⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        147⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Lfckjnjh.exe
        
        C:\Windows\system32\Lfckjnjh.exe
        148⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Lmncgh32.exe
        
        C:\Windows\system32\Lmncgh32.exe
        149⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Ldgkdbia.exe
        
        C:\Windows\system32\Ldgkdbia.exe
        150⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Mccofn32.exe
        
        C:\Windows\system32\Mccofn32.exe
        151⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        152⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Mmlphfed.exe
        
        C:\Windows\system32\Mmlphfed.exe
        153⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        154⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Mckefmai.exe
        
        C:\Windows\system32\Mckefmai.exe
        155⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Mcmall32.exe
        
        C:\Windows\system32\Mcmall32.exe
        156⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        157⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        158⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        159⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        160⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        161⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Nnjljd32.exe
        
        C:\Windows\system32\Nnjljd32.exe
        162⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ncfdbk32.exe
        
        C:\Windows\system32\Ncfdbk32.exe
        163⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        164⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        165⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Ngdmhimb.exe
        
        C:\Windows\system32\Ngdmhimb.exe
        166⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ocknmjcf.exe
        
        C:\Windows\system32\Ocknmjcf.exe
        167⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Onqbjccl.exe
        
        C:\Windows\system32\Onqbjccl.exe
        168⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        169⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        170⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ogkcihgj.exe
        
        C:\Windows\system32\Ogkcihgj.exe
        171⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Onekeb32.exe
        
        C:\Windows\system32\Onekeb32.exe
        172⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ofqpje32.exe
        
        C:\Windows\system32\Ofqpje32.exe
        173⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Odaphl32.exe
        
        C:\Windows\system32\Odaphl32.exe
        174⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Pmmelo32.exe
        
        C:\Windows\system32\Pmmelo32.exe
        175⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        176⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        177⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Pnonla32.exe
        
        C:\Windows\system32\Pnonla32.exe
        178⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pdifhkni.exe
        
        C:\Windows\system32\Pdifhkni.exe
        179⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        180⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        181⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Qcppogqo.exe
        
        C:\Windows\system32\Qcppogqo.exe
        182⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Qjmeaafi.exe
        
        C:\Windows\system32\Qjmeaafi.exe
        183⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Qqfmnk32.exe
        
        C:\Windows\system32\Qqfmnk32.exe
        184⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Afcffb32.exe
        
        C:\Windows\system32\Afcffb32.exe
        185⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Anjngp32.exe
        
        C:\Windows\system32\Anjngp32.exe
        186⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Agcbqecp.exe
        
        C:\Windows\system32\Agcbqecp.exe
        187⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Anmjmojl.exe
        
        C:\Windows\system32\Anmjmojl.exe
        188⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Aegbji32.exe
        
        C:\Windows\system32\Aegbji32.exe
        189⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Aancojgn.exe
        
        C:\Windows\system32\Aancojgn.exe
        190⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Afjlgafe.exe
        
        C:\Windows\system32\Afjlgafe.exe
        191⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Aappdj32.exe
        
        C:\Windows\system32\Aappdj32.exe
        192⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bepeph32.exe
        
        C:\Windows\system32\Bepeph32.exe
        193⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Bmkjdj32.exe
        
        C:\Windows\system32\Bmkjdj32.exe
        194⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Bebbeh32.exe
        
        C:\Windows\system32\Bebbeh32.exe
        195⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bfcompnj.exe
        
        C:\Windows\system32\Bfcompnj.exe
        196⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Bmngjj32.exe
        
        C:\Windows\system32\Bmngjj32.exe
        197⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        198⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Bmpcpjcd.exe
        
        C:\Windows\system32\Bmpcpjcd.exe
        199⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Bcjlld32.exe
        
        C:\Windows\system32\Bcjlld32.exe
        200⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        201⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Cdoegcfl.exe
        
        C:\Windows\system32\Cdoegcfl.exe
        202⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Cmgjpi32.exe
        
        C:\Windows\system32\Cmgjpi32.exe
        203⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Cnffjl32.exe
        
        C:\Windows\system32\Cnffjl32.exe
        204⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Cfakon32.exe
        
        C:\Windows\system32\Cfakon32.exe
        205⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Cagolf32.exe
        
        C:\Windows\system32\Cagolf32.exe
        206⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Cfdhdn32.exe
        
        C:\Windows\system32\Cfdhdn32.exe
        207⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dmnpah32.exe
        
        C:\Windows\system32\Dmnpah32.exe
        208⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        209⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Degdgd32.exe
        
        C:\Windows\system32\Degdgd32.exe
        210⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dfiaomkb.exe
        
        C:\Windows\system32\Dfiaomkb.exe
        211⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Dmcilgco.exe
        
        C:\Windows\system32\Dmcilgco.exe
        212⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        213⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Daqbbe32.exe
        
        C:\Windows\system32\Daqbbe32.exe
        214⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Dgpgplej.exe
        
        C:\Windows\system32\Dgpgplej.exe
        215⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ehocjo32.exe
        
        C:\Windows\system32\Ehocjo32.exe
        216⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Eahhcd32.exe
        
        C:\Windows\system32\Eahhcd32.exe
        217⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Eeeaibid.exe
        
        C:\Windows\system32\Eeeaibid.exe
        218⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ealanc32.exe
        
        C:\Windows\system32\Ealanc32.exe
        219⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ekefgi32.exe
        
        C:\Windows\system32\Ekefgi32.exe
        220⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Eejjdb32.exe
        
        C:\Windows\system32\Eejjdb32.exe
        221⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Fneohd32.exe
        
        C:\Windows\system32\Fneohd32.exe
        222⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Fnmeic32.exe
        
        C:\Windows\system32\Fnmeic32.exe
        223⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Fecmjq32.exe
        
        C:\Windows\system32\Fecmjq32.exe
        224⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Fkqebg32.exe
        
        C:\Windows\system32\Fkqebg32.exe
        225⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fhdfll32.exe
        
        C:\Windows\system32\Fhdfll32.exe
        226⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Gehfepio.exe
        
        C:\Windows\system32\Gehfepio.exe
        227⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Gkeonggf.exe
        
        C:\Windows\system32\Gkeonggf.exe
        228⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Gnckjbfj.exe
        
        C:\Windows\system32\Gnckjbfj.exe
        229⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Gkglcfec.exe
        
        C:\Windows\system32\Gkglcfec.exe
        230⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Gempqo32.exe
        
        C:\Windows\system32\Gempqo32.exe
        231⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Gkjhif32.exe
        
        C:\Windows\system32\Gkjhif32.exe
        232⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        233⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Gohaod32.exe
        
        C:\Windows\system32\Gohaod32.exe
        234⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        235⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Hojndd32.exe
        
        C:\Windows\system32\Hojndd32.exe
        236⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Hfdfanoa.exe
        
        C:\Windows\system32\Hfdfanoa.exe
        237⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Hgebif32.exe
        
        C:\Windows\system32\Hgebif32.exe
        238⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Holjjd32.exe
        
        C:\Windows\system32\Holjjd32.exe
        239⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Hkckoe32.exe
        
        C:\Windows\system32\Hkckoe32.exe
        240⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        241⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Hoadecal.exe
        
        C:\Windows\system32\Hoadecal.exe
        242⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Hbppaopp.exe
        
        C:\Windows\system32\Hbppaopp.exe
        243⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Hhihnihm.exe
        
        C:\Windows\system32\Hhihnihm.exe
        244⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Hbbmgn32.exe
        
        C:\Windows\system32\Hbbmgn32.exe
        245⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ibdiln32.exe
        
        C:\Windows\system32\Ibdiln32.exe
        246⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Igabdekb.exe
        
        C:\Windows\system32\Igabdekb.exe
        247⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        248⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ibicgmhe.exe
        
        C:\Windows\system32\Ibicgmhe.exe
        249⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Idgocigi.exe
        
        C:\Windows\system32\Idgocigi.exe
        250⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Iomcqa32.exe
        
        C:\Windows\system32\Iomcqa32.exe
        251⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ifglmlol.exe
        
        C:\Windows\system32\Ifglmlol.exe
        252⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ikcdfbmc.exe
        
        C:\Windows\system32\Ikcdfbmc.exe
        253⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jigdoglm.exe
        
        C:\Windows\system32\Jigdoglm.exe
        254⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Jndmgn32.exe
        
        C:\Windows\system32\Jndmgn32.exe
        255⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Jenedhaa.exe
        
        C:\Windows\system32\Jenedhaa.exe
        256⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jodiaqag.exe
        
        C:\Windows\system32\Jodiaqag.exe
        257⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Jbbfnlpk.exe
        
        C:\Windows\system32\Jbbfnlpk.exe
        258⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Jgonfcnb.exe
        
        C:\Windows\system32\Jgonfcnb.exe
        259⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Jnifbmfo.exe
        
        C:\Windows\system32\Jnifbmfo.exe
        260⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Jecoog32.exe
        
        C:\Windows\system32\Jecoog32.exe
        261⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Jkmgladi.exe
        
        C:\Windows\system32\Jkmgladi.exe
        262⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Jbgoik32.exe
        
        C:\Windows\system32\Jbgoik32.exe
        263⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Jiageecb.exe
        
        C:\Windows\system32\Jiageecb.exe
        264⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Jpkpbpko.exe
        
        C:\Windows\system32\Jpkpbpko.exe
        265⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        266⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        267⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Kppimogj.exe
        
        C:\Windows\system32\Kppimogj.exe
        268⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Kbpboj32.exe
        
        C:\Windows\system32\Kbpboj32.exe
        269⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Lbjeei32.exe
        
        C:\Windows\system32\Lbjeei32.exe
        270⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        271⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Loqejjad.exe
        
        C:\Windows\system32\Loqejjad.exe
        272⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Lldfcn32.exe
        
        C:\Windows\system32\Lldfcn32.exe
        273⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Lihfmb32.exe
        
        C:\Windows\system32\Lihfmb32.exe
        274⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        275⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Mhppcn32.exe
        
        C:\Windows\system32\Mhppcn32.exe
        276⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        277⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        278⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Miaica32.exe
        
        C:\Windows\system32\Miaica32.exe
        279⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        280⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Noaoagca.exe
        
        C:\Windows\system32\Noaoagca.exe
        281⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        282⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        283⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Neppiagi.exe
        
        C:\Windows\system32\Neppiagi.exe
        284⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ngombd32.exe
        
        C:\Windows\system32\Ngombd32.exe
        285⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Nhpijldj.exe
        
        C:\Windows\system32\Nhpijldj.exe
        286⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Nojagf32.exe
        
        C:\Windows\system32\Nojagf32.exe
        287⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ngaihcli.exe
        
        C:\Windows\system32\Ngaihcli.exe
        288⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Nlnbqjjq.exe
        
        C:\Windows\system32\Nlnbqjjq.exe
        289⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Oomnmfid.exe
        
        C:\Windows\system32\Oomnmfid.exe
        290⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Olcklj32.exe
        
        C:\Windows\system32\Olcklj32.exe
        291⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Oghpib32.exe
        
        C:\Windows\system32\Oghpib32.exe
        292⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Ohjlqklp.exe
        
        C:\Windows\system32\Ohjlqklp.exe
        293⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Pphjbgfj.exe
        
        C:\Windows\system32\Pphjbgfj.exe
        294⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Phcogice.exe
        
        C:\Windows\system32\Phcogice.exe
        295⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Pjbkal32.exe
        
        C:\Windows\system32\Pjbkal32.exe
        296⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Poodicio.exe
        
        C:\Windows\system32\Poodicio.exe
        297⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        298⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        299⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Qlhnng32.exe
        
        C:\Windows\system32\Qlhnng32.exe
        300⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Qofjjb32.exe
        
        C:\Windows\system32\Qofjjb32.exe
        301⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        302⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Amjjcf32.exe
        
        C:\Windows\system32\Amjjcf32.exe
        303⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ahakhg32.exe
        
        C:\Windows\system32\Ahakhg32.exe
        304⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Aokceaoa.exe
        
        C:\Windows\system32\Aokceaoa.exe
        305⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Ajqgbjoh.exe
        
        C:\Windows\system32\Ajqgbjoh.exe
        306⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Aqjpod32.exe
        
        C:\Windows\system32\Aqjpod32.exe
        307⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        308⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        309⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        310⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Acnefoac.exe
        
        C:\Windows\system32\Acnefoac.exe
        311⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Bijnnf32.exe
        
        C:\Windows\system32\Bijnnf32.exe
        312⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Bcpblo32.exe
        
        C:\Windows\system32\Bcpblo32.exe
        313⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Bjjjhifm.exe
        
        C:\Windows\system32\Bjjjhifm.exe
        314⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Bcboan32.exe
        
        C:\Windows\system32\Bcboan32.exe
        315⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Bfqkmj32.exe
        
        C:\Windows\system32\Bfqkmj32.exe
        316⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Bqfokblg.exe
        
        C:\Windows\system32\Bqfokblg.exe
        317⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        318⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Bqhlpbjd.exe
        
        C:\Windows\system32\Bqhlpbjd.exe
        319⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Bmomecoi.exe
        
        C:\Windows\system32\Bmomecoi.exe
        320⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Bciebm32.exe
        
        C:\Windows\system32\Bciebm32.exe
        321⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        322⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Cameka32.exe
        
        C:\Windows\system32\Cameka32.exe
        323⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Cggnhlml.exe
        
        C:\Windows\system32\Cggnhlml.exe
        324⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Cmdfpbkc.exe
        
        C:\Windows\system32\Cmdfpbkc.exe
        325⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Cjjcof32.exe
        
        C:\Windows\system32\Cjjcof32.exe
        326⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Cpglgmfa.exe
        
        C:\Windows\system32\Cpglgmfa.exe
        327⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cjmpeffh.exe
        
        C:\Windows\system32\Cjmpeffh.exe
        328⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Cpihmmdo.exe
        
        C:\Windows\system32\Cpihmmdo.exe
        329⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        330⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Djomjfde.exe
        
        C:\Windows\system32\Djomjfde.exe
        331⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        332⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Didjkbim.exe
        
        C:\Windows\system32\Didjkbim.exe
        333⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dpnbhl32.exe
        
        C:\Windows\system32\Dpnbhl32.exe
        334⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Diffabgj.exe
        
        C:\Windows\system32\Diffabgj.exe
        335⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Dhgfoioi.exe
        
        C:\Windows\system32\Dhgfoioi.exe
        336⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Ddngdj32.exe
        
        C:\Windows\system32\Ddngdj32.exe
        337⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Ejklfd32.exe
        
        C:\Windows\system32\Ejklfd32.exe
        338⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Epgenk32.exe
        
        C:\Windows\system32\Epgenk32.exe
        339⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Efamkepl.exe
        
        C:\Windows\system32\Efamkepl.exe
        340⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        341⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ehcfkhel.exe
        
        C:\Windows\system32\Ehcfkhel.exe
        342⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ekdolcbm.exe
        
        C:\Windows\system32\Ekdolcbm.exe
        343⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Fkihgb32.exe
        
        C:\Windows\system32\Fkihgb32.exe
        344⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        345⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Faemjl32.exe
        
        C:\Windows\system32\Faemjl32.exe
        346⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Fgdbgbof.exe
        
        C:\Windows\system32\Fgdbgbof.exe
        347⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Fajgekol.exe
        
        C:\Windows\system32\Fajgekol.exe
        348⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Ggfombmd.exe
        
        C:\Windows\system32\Ggfombmd.exe
        349⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ganppk32.exe
        
        C:\Windows\system32\Ganppk32.exe
        350⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Ghhhmebd.exe
        
        C:\Windows\system32\Ghhhmebd.exe
        351⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Gaqmej32.exe
        
        C:\Windows\system32\Gaqmej32.exe
        352⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        353⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Gpfjfg32.exe
        
        C:\Windows\system32\Gpfjfg32.exe
        354⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Gnjjpk32.exe
        
        C:\Windows\system32\Gnjjpk32.exe
        355⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Hddbmedc.exe
        
        C:\Windows\system32\Hddbmedc.exe
        356⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Hpmpgfhd.exe
        
        C:\Windows\system32\Hpmpgfhd.exe
        357⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hgghdp32.exe
        
        C:\Windows\system32\Hgghdp32.exe
        358⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Hdkimdnk.exe
        
        C:\Windows\system32\Hdkimdnk.exe
        359⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Haoighmd.exe
        
        C:\Windows\system32\Haoighmd.exe
        360⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        361⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ikndpm32.exe
        
        C:\Windows\system32\Ikndpm32.exe
        362⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ibhlmgdj.exe
        
        C:\Windows\system32\Ibhlmgdj.exe
        363⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        364⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Iqmincia.exe
        
        C:\Windows\system32\Iqmincia.exe
        365⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Ikcmklih.exe
        
        C:\Windows\system32\Ikcmklih.exe
        366⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        367⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Jgjnpm32.exe
        
        C:\Windows\system32\Jgjnpm32.exe
        368⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        369⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Jkggfl32.exe
        
        C:\Windows\system32\Jkggfl32.exe
        370⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Jqdoob32.exe
        
        C:\Windows\system32\Jqdoob32.exe
        371⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        372⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        373⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        374⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Kjambg32.exe
        
        C:\Windows\system32\Kjambg32.exe
        375⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        376⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Knofif32.exe
        
        C:\Windows\system32\Knofif32.exe
        377⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Keinepch.exe
        
        C:\Windows\system32\Keinepch.exe
        378⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Kgjggkqi.exe
        
        C:\Windows\system32\Kgjggkqi.exe
        379⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Kjkpif32.exe
        
        C:\Windows\system32\Kjkpif32.exe
        380⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Kaehepeg.exe
        
        C:\Windows\system32\Kaehepeg.exe
        381⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Lkjlciem.exe
        
        C:\Windows\system32\Lkjlciem.exe
        382⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Lbddpclj.exe
        
        C:\Windows\system32\Lbddpclj.exe
        383⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Linmlm32.exe
        
        C:\Windows\system32\Linmlm32.exe
        384⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Lnkedd32.exe
        
        C:\Windows\system32\Lnkedd32.exe
        385⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        386⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Llabchoe.exe
        
        C:\Windows\system32\Llabchoe.exe
        387⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Liecmlno.exe
        
        C:\Windows\system32\Liecmlno.exe
        388⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Lbngfbdo.exe
        
        C:\Windows\system32\Lbngfbdo.exe
        389⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Mndhkc32.exe
        
        C:\Windows\system32\Mndhkc32.exe
        390⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Mijlhl32.exe
        
        C:\Windows\system32\Mijlhl32.exe
        391⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Milinkgf.exe
        
        C:\Windows\system32\Milinkgf.exe
        392⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Magnbnea.exe
        
        C:\Windows\system32\Magnbnea.exe
        393⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        394⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mjbopcip.exe
        
        C:\Windows\system32\Mjbopcip.exe
        395⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Malgmm32.exe
        
        C:\Windows\system32\Malgmm32.exe
        396⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Nlbkjf32.exe
        
        C:\Windows\system32\Nlbkjf32.exe
        397⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Njghkb32.exe
        
        C:\Windows\system32\Njghkb32.exe
        398⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Nihiiimi.exe
        
        C:\Windows\system32\Nihiiimi.exe
        399⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Noeaaqlq.exe
        
        C:\Windows\system32\Noeaaqlq.exe
        400⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        401⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        402⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Okpkaqmp.exe
        
        C:\Windows\system32\Okpkaqmp.exe
        403⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Oefpoi32.exe
        
        C:\Windows\system32\Oefpoi32.exe
        404⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        405⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Oehldi32.exe
        
        C:\Windows\system32\Oehldi32.exe
        406⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Okjnhpee.exe
        
        C:\Windows\system32\Okjnhpee.exe
        407⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Plijbblh.exe
        
        C:\Windows\system32\Plijbblh.exe
        408⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Pcccol32.exe
        
        C:\Windows\system32\Pcccol32.exe
        409⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Pllggbje.exe
        
        C:\Windows\system32\Pllggbje.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8000
        
        C:\Windows\SysWOW64\Pahppihl.exe
        
        C:\Windows\system32\Pahppihl.exe
        411⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        412⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Aepklffh.exe
        
        C:\Windows\system32\Aepklffh.exe
        413⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        414⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Akoqjl32.exe
        
        C:\Windows\system32\Akoqjl32.exe
        415⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Bbiamd32.exe
        
        C:\Windows\system32\Bbiamd32.exe
        416⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Ckhlgilp.exe
        
        C:\Windows\system32\Ckhlgilp.exe
        417⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Cofemg32.exe
        
        C:\Windows\system32\Cofemg32.exe
        418⤵
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\Diafkl32.exe
        
        C:\Windows\system32\Diafkl32.exe
        419⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Diccal32.exe
        
        C:\Windows\system32\Diccal32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3076
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        421⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Dfgcjpdk.exe
        
        C:\Windows\system32\Dfgcjpdk.exe
        422⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        423⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        424⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        425⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Efhlan32.exe
        
        C:\Windows\system32\Efhlan32.exe
        426⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        427⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Fpjcpbdn.exe
        
        C:\Windows\system32\Fpjcpbdn.exe
        428⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Gjohnkdd.exe
        
        C:\Windows\system32\Gjohnkdd.exe
        429⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Gpnmka32.exe
        
        C:\Windows\system32\Gpnmka32.exe
        430⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Gifadggi.exe
        
        C:\Windows\system32\Gifadggi.exe
        431⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Gpqjaanf.exe
        
        C:\Windows\system32\Gpqjaanf.exe
        432⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Gkfnnjnl.exe
        
        C:\Windows\system32\Gkfnnjnl.exe
        433⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Hgokikan.exe
        
        C:\Windows\system32\Hgokikan.exe
        434⤵
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        435⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hipdjfoo.exe
        
        C:\Windows\system32\Hipdjfoo.exe
        436⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Hdehho32.exe
        
        C:\Windows\system32\Hdehho32.exe
        437⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Hkpqdifa.exe
        
        C:\Windows\system32\Hkpqdifa.exe
        438⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Hplimpdi.exe
        
        C:\Windows\system32\Hplimpdi.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8900
        
        C:\Windows\SysWOW64\Hgfaij32.exe
        
        C:\Windows\system32\Hgfaij32.exe
        440⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Hmpjfdcb.exe
        
        C:\Windows\system32\Hmpjfdcb.exe
        441⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        442⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        443⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        444⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Idahcm32.exe
        
        C:\Windows\system32\Idahcm32.exe
        445⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Ijnqld32.exe
        
        C:\Windows\system32\Ijnqld32.exe
        446⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        447⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jdhndlno.exe
        
        C:\Windows\system32\Jdhndlno.exe
        448⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Jjeflc32.exe
        
        C:\Windows\system32\Jjeflc32.exe
        449⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        450⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Jpalomaq.exe
        
        C:\Windows\system32\Jpalomaq.exe
        451⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Jgkdkg32.exe
        
        C:\Windows\system32\Jgkdkg32.exe
        452⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Jcbdph32.exe
        
        C:\Windows\system32\Jcbdph32.exe
        453⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Jjlmmbfo.exe
        
        C:\Windows\system32\Jjlmmbfo.exe
        454⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        455⤵
        
        PID:8644

C:\Windows\SysWOW64\Jgpmffeh.exe
C:\Windows\system32\Jgpmffeh.exe
1⤵
PID:8584
- C:\Windows\SysWOW64\Kcgnkgkl.exe
  C:\Windows\system32\Kcgnkgkl.exe
  2⤵
  PID:9136
- - C:\Windows\SysWOW64\Kmobdm32.exe
    C:\Windows\system32\Kmobdm32.exe
    3⤵
    PID:8824
  - - C:\Windows\SysWOW64\Kjepcqnd.exe
      C:\Windows\system32\Kjepcqnd.exe
      4⤵
      PID:5064
    - - C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        5⤵
        
        PID:8624
      - C:\Windows\SysWOW64\Lqdakjak.exe
        
        C:\Windows\system32\Lqdakjak.exe
        6⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Lnhadnpe.exe
        
        C:\Windows\system32\Lnhadnpe.exe
        7⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Lgqfmcge.exe
        
        C:\Windows\system32\Lgqfmcge.exe
        8⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Lnmkpm32.exe
        
        C:\Windows\system32\Lnmkpm32.exe
        9⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Lqkgli32.exe
        
        C:\Windows\system32\Lqkgli32.exe
        10⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lgephccp.exe
        
        C:\Windows\system32\Lgephccp.exe
        11⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lnohemjm.exe
        
        C:\Windows\system32\Lnohemjm.exe
        12⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Leipbg32.exe
        
        C:\Windows\system32\Leipbg32.exe
        13⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Ljfhjn32.exe
        
        C:\Windows\system32\Ljfhjn32.exe
        14⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        15⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        16⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Mminaikp.exe
        
        C:\Windows\system32\Mminaikp.exe
        17⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        18⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        19⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Mjokpm32.exe
        
        C:\Windows\system32\Mjokpm32.exe
        20⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        21⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        22⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        23⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Nladpo32.exe
        
        C:\Windows\system32\Nladpo32.exe
        24⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        25⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Napjnfik.exe
        
        C:\Windows\system32\Napjnfik.exe
        26⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Nhjbjp32.exe
        
        C:\Windows\system32\Nhjbjp32.exe
        27⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        28⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        29⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Nljgfn32.exe
        
        C:\Windows\system32\Nljgfn32.exe
        30⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        31⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        32⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Oeehdcij.exe
        
        C:\Windows\system32\Oeehdcij.exe
        33⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Oegejc32.exe
        
        C:\Windows\system32\Oegejc32.exe
        34⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        35⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Oeloebcb.exe
        
        C:\Windows\system32\Oeloebcb.exe
        36⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        37⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        38⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        39⤵
        
        PID:8396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeeomegd.exe

Filesize
110KB

MD5
266ddbc56167d679467b192b99ca4500

SHA1
308625f8ad7fc364fe58df45aff5e4546044849a

SHA256
f1ccc0e9741363032f1c4d9ec0850f74d3f70c58ecab75b3ae519403fc2f52e8

SHA512
b737f00029c908c3282bb4ef543a4bc0b9ec1a298cd7080450239fe143ab87fc9a3d02e84e191cdbec7902b23f7764ce43749b3c4d93745707e7aa177d26aa66

Download Submit
C:\Windows\SysWOW64\Afockelf.exe

Filesize
110KB

MD5
21432d2fb9100b61f8a257cb2fb6fb7c

SHA1
e037bff1f1c814cab9d0369a66fb3e521795790a

SHA256
8f14970dea22e16c5878ff857cc703fe50bf91f554471ed932480f1fbb0d9e8a

SHA512
495134e2510fe2c3ff6d69fe9ee12d0180eae040b1f6777f02a21c8066595e99917a9d3c0b82f4b62cf4b3e527a9fd70c08c56ff2b7cf1cfc36334cb1a8f6079

Download Submit
C:\Windows\SysWOW64\Apimodmh.exe

Filesize
110KB

MD5
db21438390ca645b012e576db6eef087

SHA1
b86a5ecbb095eea18c60ffcffcf8f10ad2eabad4

SHA256
12053372684935dfe78168f676ad97d3c587e5d9c3039f7b0ab613f3db54b2b5

SHA512
3c06be5cd6b443649ba178f2a7d58c120f8d6bd516d150819176d89f3c3a2e42e10a716899d685f690b29a8e18ef8697dda59a9dcddf3469fc91f79111a81ae2

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
110KB

MD5
574ea4d5262c2883dcc8830997c14b73

SHA1
1a6498eb31d01ef96f4007cb3517dd388030e67b

SHA256
3ae830e90a2bfb5bdceaf3f51d6f862b6ce49a2e589f216a9805a4cc986d39aa

SHA512
4bfa7540cbfdd72056ab2a8fcb6227a6997b6655489ba7d2f19288d0242dabea1a1edd02091d5e792d35366f37a0b5f5e1289ef0985c79263d2a23acdba92c2e

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
110KB

MD5
b561607b843f3c055368d4e0b28c5379

SHA1
014790b45cb6a052f65c415c0a329cf80e92131f

SHA256
f23ecb1f3e0b7cfabe4aa372aac595f44f39906b4d6ae1c81f467645a2b43884

SHA512
6dfa07866271bcce4fbe16efbedc374369a3e0139f05b8efad1811b5d2ed2c77e9ec11790eff508ded0fbd68705c5941f2406a12d74167da0d70d0beb563807c

Download Submit
C:\Windows\SysWOW64\Bfolacnc.exe

Filesize
110KB

MD5
753d6748aa47ad1225ce26e4ae199795

SHA1
2e80f3da035202d7717c378a5c97a0448c0a3be2

SHA256
50d13365e84d6521dc213ef502b1bcb65c543705578b8b5c79853c86b3e3c6c6

SHA512
30388e10ed2ea2db9a4e5e24a63ba9085aae038064145e23215d49d1bb8be0d2f5b440d0d3f55d509ed7525d7f10ab32e80b9eefa0ade90dc7b43923462ae054

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
110KB

MD5
c75001b74d99d754d03eb58ec28457c7

SHA1
2f2a6453c3512882ad0528445bc143939b13470b

SHA256
6398f28f2f6b41c63425f699d763bfb8c9b4d11632e18c0e910885b888a66557

SHA512
f621374972d35e06cf60a0c967ab43f3da72f7f9d5476a067bcda4ee9c6ded5f9563596dd7c140bbcd9e59f2c42af012668a5d7ec322057e9a818ddbf1af70e9

Download Submit
C:\Windows\SysWOW64\Ddnobj32.exe

Filesize
110KB

MD5
2ce35f18b0a6fda158d7b9150776b30c

SHA1
afe87c93cdf3eb2b9f379befe3af8f86eb7bf96d

SHA256
bfd19229aebc84fd37ba536406e2e96cf2804c9dff0a194c9213a351dac413bb

SHA512
6cb8cdd38206ba16c0014ad0cce8f9a59a5da478d2674ea5ea08e87d32609e233421efe08780e275ace5e1d356c95d9cae1f4d1916129b7ec59fea76a3b07d78

Download Submit
C:\Windows\SysWOW64\Dlbfmjqi.exe

Filesize
110KB

MD5
6a779a5d6763410e09128e5898c96a2f

SHA1
ed0cee2faa24a9b116dc428f2fa6377d2d4321fb

SHA256
650c18478c4d602493fcb99f04e57dddd80d575aaa31d9728abee2fa2e9cbe5c

SHA512
396e5ba728254af61246b4ea3a065a52b43644ad9d62eafc7583fb96093db7bdf64825d315d95d59218e751ce400fdc856f1e7bd88aea3fe077c1efa74c2e401

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
110KB

MD5
e88dda9590f4cc58b5d28ab1e712919c

SHA1
ccd8927c9f60dedbe7a7e8ed2fa9764aa9448f55

SHA256
532862ecea2427a9cde3b7556e34b8cc245ddce347572e834a682af7d76adefe

SHA512
d51ff34bdc5388a2d93839ce6462008bb719b647266c46fb29d21ae482b45c9808e6cf81db534d156b683039e3fc1c63c499da947fa25624c18fc3bdd5de1e3a

Download Submit
C:\Windows\SysWOW64\Edionhpn.exe

Filesize
110KB

MD5
82350456a3c1210c097c48967a6bcfc6

SHA1
a9d6e5e2ef75673d6fdca04d18ad60d6ea134238

SHA256
2e99248da8420a6ca42f94a47fd7249583ca33b6216612eb2f2eeb13e5058fc4

SHA512
e19db95947df52e8f9a8e3ba9ecff8a4c8b7fa9c09841da61c2e2e45700642d7ebe6304ac20c5110d1dcc067606573c836866460889339506b4e998bf4d9dd19

Download Submit
C:\Windows\SysWOW64\Enkmfolf.exe

Filesize
110KB

MD5
8aa048536d8ef51f8b7b6a3a0d8dabd6

SHA1
b9e74f121871c23c49eda1f7f42852c55ef02c8d

SHA256
1252ed358d89064120df85f831b62aca6aec0216adc3cee3caefbad3d404ac82

SHA512
4f8553db6d59d34ac3512bcc0fed8e7e0fd4eab7965f3cf81c722a5e6628adeb61e2c5cae1092ca06cb7f22af3d19320bf151dc3df80e31f9c284873ec2834b7

Download Submit
C:\Windows\SysWOW64\Eoepebho.exe

Filesize
110KB

MD5
2ec5485c139e3c69eb3b141b346eee5a

SHA1
d491196376dd71eb10e493db8b6c2b69bdd2e08f

SHA256
1a74327ce9590ff35a9fc7a2c98ca55efe7189ff425b84130a2e6f4eee6eb5a0

SHA512
38c8b362b225154a8d2b5828d382b59d49f12af87989e6c22c77fb915720403f588bd7ffc666b22ff97734b77480d8dfb2de5dc4086166d5e03f623d4dbfcc93

Download Submit
C:\Windows\SysWOW64\Fdlkdhnk.exe

Filesize
110KB

MD5
c892f6a5105d73cb534e3ebe2dd71718

SHA1
08d518d4ced55af71804a7460564b1e05a3c9f88

SHA256
4df9eb58a6ce173b9c7c153380a3ca00593c14b41cd2c48e1d85432f6f11f738

SHA512
7457fa15ddb38151e60fd7e720b94dd899bda1a2e5fda148f1efa2f9223ce9684a4d0976f3d8957b22927c17b41ba5b22174077aa13aedbad1e49710a3e9819a

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
110KB

MD5
6e21bc1225c3960b37731469f40611c8

SHA1
8666a35be56896dce7de0d0a4e151117eb600869

SHA256
4158e834c2b2528a6989fc99de8b5e114f41a0a8fe38fa658aa4969449a20042

SHA512
8a0df32b0cc4f82f89d1459a80dc63669956a05fe33fd9ae789bad6264b0a3241f3dd4902f23505734c59aa4721fdc4387c5850ab536a8c4f82c69a28d7b3a9b

Download Submit
C:\Windows\SysWOW64\Fqbliicp.exe

Filesize
110KB

MD5
785692cfd0ad837a01538debc70061f8

SHA1
62a33ce6e950e2f1945d9645e6350a5ca1df5ae0

SHA256
2d22a7e92fa367d75fc7224a30c7ddca2a742a82133c0c12e3654c6010d718b1

SHA512
d205a6aae3dd9dd7a690d770a48def4288bcac6cdedab6ae7723ea757ca752f3c8d87c08b37cb733edaa5054d5dafa00a61ef78b6a47f0fed4b22c70e2ab6cc2

Download Submit
C:\Windows\SysWOW64\Gacepg32.exe

Filesize
110KB

MD5
d0a5a4e85badb1e759d4136381623b0f

SHA1
508ec7900ec07be0d5e69b0ec64b126e22a9b4ec

SHA256
11e2c4a69c68ba0702a869d20bf6f15c7d9e293e781f39ae426be5a3889fda42

SHA512
2e055ba24c7d17c82db407ce9f49d4f2974d9d5a5d1f3ac533de8a79e84a74a48fb50706b9111ee9421c30ce4204f97fbe1aef891be6459c554ab069d0a02499

Download Submit
C:\Windows\SysWOW64\Gdhjpjjd.exe

Filesize
64KB

MD5
aaabc272607b8abd8f38ab5008d8f3bc

SHA1
bf96569caf291b9ec7099ef667f4e1e128cc9837

SHA256
f421c64b7b9c58236d90922df2b1a9a7cd7de2e3433f3fee07b1d26058e2530c

SHA512
872bfc742f6a0245a15f4959250890ca6f002470a8a1f9aa7f2461597e0c161164132243ae546d69810b80a1ebd5aac0c52383f5940963a4be437f1166fa1086

Download Submit
C:\Windows\SysWOW64\Geldkfpi.exe

Filesize
110KB

MD5
4d2907e6a2ea67dd5462b5492235dd50

SHA1
4fc5594a186c9f4615a3142ccd3e43f6004a425b

SHA256
1dbefccd084007f2eb7cef7f730b1da44b8e4a5eaf1f88b18a81af9493b3f7b7

SHA512
76e72d3f14bac9abbebf98fcfa00d3a3a651c0525cf042b27c24b8b2fa5880121a994d25c00c40f87f6eb55ab91ddeb6967072722761c99fd0dfb37f7e69210a

Download Submit
C:\Windows\SysWOW64\Ghojbq32.exe

Filesize
110KB

MD5
2fa2718f332112e7bd9254d8c638bd71

SHA1
35851e02f9f61ad714191c0b10ba159567150914

SHA256
23f669dcc5999aadcdd331fab67845162fa6ed593715a4e0b466c150aab9077d

SHA512
61934125766f2f4be9693e78c6048bed54b002de7fdfd70370fbe74d45e12fb9219ebec356f01dfec1e3da4c2827cb3fcdd0347c03cf6cf13858b632a7fbfd9e

Download Submit
C:\Windows\SysWOW64\Gicgpelg.exe

Filesize
110KB

MD5
1cb641114c2cfcf2d3b3dab662a35155

SHA1
6f06f2b247c30afb2270108fadbb1c7da2a1ebee

SHA256
5d7cec2d8018abfe6e3266f6f1196c3ec35933234588d9d5b4495999475f60a0

SHA512
54bf60030dff851b796d4945565628c4240fd010cf0c60ff026f80bcaa987e63cd6852d816b4fd61391676009ea92fbe898571e0c1d9995fe694824c1f5cf5a8

Download Submit
C:\Windows\SysWOW64\Giecfejd.exe

Filesize
110KB

MD5
f0deb2ff53c913365d479d6545e52d7b

SHA1
e2c766513196fef894687319e8a5b150213aa151

SHA256
549fa83931cb1b46bcaec515bc7470a17dfe1656e3f0c479791a266682f22be9

SHA512
772a5dd24e81e52bbfa76232bce5c7591063d7a385709ed514423e002b80a0bd11fb1113f0e24d544e781e21d6baed23561980d5f4de70860c86791c1928602e

Download Submit
C:\Windows\SysWOW64\Hecjke32.exe

Filesize
110KB

MD5
95e590189208489dfc95a8645aebb24c

SHA1
a168d8b5f8b7b0ed8d380fd4b47132ed607b2a33

SHA256
424a778b05ff8e1298114287bd5ee03ba72c705dc8281ceef2c2f688287908fe

SHA512
a85713f0c585c987d657c00bebfda63777d195e0d902e41369aa4f0f349f032ea457ddb51d6701a3c2d2ec20a3745f4c6a6b4234a459bd4b5cb5679acdd61ebf

Download Submit
C:\Windows\SysWOW64\Hhdcmp32.exe

Filesize
110KB

MD5
c5d11f395fb8c89907aa8a7540c6cf1d

SHA1
96094abb255e8e15d60a66beac50c7db1ef60763

SHA256
1953b5a4f0cdbb8b634c7503aca82155d9510f58d06e5d4280fc2b9c443b6f2f

SHA512
4622dda037ce434e70ec5164ea393e027b420b7e59ea9dfd703f74d6d169955d2888c1a5d6fcf313771f737b2c5c6c685ef35f1b99de50126b9a4c0e310d7f51

Download Submit
C:\Windows\SysWOW64\Hhfpbpdo.exe

Filesize
110KB

MD5
6e210bf8db947a714142fbe88cd19d6b

SHA1
a4587c3ea7cb1bc97c4f59c9b30c028dd5b1e5fc

SHA256
75d17f44e64f897d589832829c67759e553a5c47e3ba265a4724b80fe5baa07e

SHA512
677b150fdcdfdcabb14fdb9b234f3adac7e5400fce10d2dae66d7fdc8f5dc611315005ef18cd05463ac68506f8a0f5a03b9a2b0780f23b9455fc9462a56a955f

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
110KB

MD5
004e4d5f0162bb66cb472b1677f707c4

SHA1
aba6c06d252adb15fa8b928e7bbf16210218db32

SHA256
30be7f014941792098e495750473ca570bf0c9b46e5e56367f5b4d5583ee6cd5

SHA512
dacf6f4c689ae5e9f61b40d6c7dfc6424c5717aa9d83f0fad31adcbd0c6d08f4f5af81d6cfab1b0371981b1572f6ec4144d658f96ad73a0b3318eed71d0fe879

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
110KB

MD5
737a8e15a44abff771750a4dfa780658

SHA1
251bedc2c96b13b7a7cc44118a4c28b3787c2b45

SHA256
ecddd490c40cd01db5199b351db5d8f99c8a5b56c00b778e4f7c98257542d62e

SHA512
b7d238ad1af6e9025184ebc6a2e6c48e56c6a0320d24a0a2745c9995d80fb97f58f8607586deadc9af4033d28623d64f873d15ab5747ca326253df6b3b52b912

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
110KB

MD5
550acd0b5231f5472235aa5fc8b6cd36

SHA1
f414a3105a4a88c47e18da439450f18083f89406

SHA256
583fc735c7c9c23eb604bcfed56366d8b1d11221abd0ae2193e8ef1a33af46f0

SHA512
32e2cacbc03da5781dea9704a09ef6719c8f7a99cbf9edba3108e640a35717734c63aa40f9c07abe888ed68c69122b8ed09c492f46070546ea727f26af63f088

Download Submit
C:\Windows\SysWOW64\Iojkeh32.exe

Filesize
110KB

MD5
d60ec5911409cb914e4116f8b7efdfda

SHA1
33bbb73a4f982f25f629c6d4d3cb830e25bead78

SHA256
64db9619f69df9d2ac90b7aec925f2a0367ed50940a02b1f09513c50a04b4346

SHA512
e2bfe3e293bb601fbbe893a3ee19804a8275d7ca0e20db1ac4900d90e2be3ae3687714cdccd8ae480526e1ee53a9c0144fb770c1930698c68b4ab25dbddf79f4

Download Submit
C:\Windows\SysWOW64\Jghhjq32.exe

Filesize
110KB

MD5
fac04d700a894a7bcda0d4074556517c

SHA1
42e34bb9e42133f598298a3d80cf766896bea67c

SHA256
306a016351d631022b16b7c6e791071161c784f8b18656ac77576efd7ab1ee3b

SHA512
6574f71fb8f4fff402dcdf87ae4977658f8743b60b96dc5b4e17ae8fcc6a03c684f707ec6b05d90735976176840a1d2d3c09b98aec39b522d8b9a28426fd5a58

Download Submit
C:\Windows\SysWOW64\Kcpjnjii.exe

Filesize
110KB

MD5
df214c059156f24fa52d2da3e1b23052

SHA1
dbd7f6156e52193bb6d5b2d118dc9214fc555295

SHA256
86f07b4394a0169e5c7662587fe85067653a53d86f3cbcfe11a171b1c7ba51a8

SHA512
b4d45fd437f88e62f7da0ef41e19ea62577df6bfcab8e02e68d4c6ae34733972f7335f365e55e7e474e9212c3aac2120852e7dae67093e8f4903db74eaa491e2

Download Submit
C:\Windows\SysWOW64\Lfgipd32.exe

Filesize
110KB

MD5
21f938412790962e2707cec69120f2fc

SHA1
e46aa43ae813094844bdc9aa2dc8873cf607a234

SHA256
1c80d2ea005041dc4b3ccff12d2f5274b2207dd0ba2ae7cda3df26953b857dcb

SHA512
00424eff41b3aca07262c268fe768a86fa58c434eeed6328fc1f76a32d960d86d7d06cb59b25e64a4ce7af137624a93f3e55c0ba74a28c83ef4b02d3ebee065e

Download Submit
C:\Windows\SysWOW64\Lklnconj.exe

Filesize
110KB

MD5
81ce52b49d607cfe70f7edd19c519a93

SHA1
7c60876dfeb7b47abda10b67ed46eee58e80fbe5

SHA256
56d8a2f0c6cd4a248f9dedc5774b28724ea4d2fea6af141a21fb2cd157cb18eb

SHA512
414af2556dc203ae3d2c762bfeaf32a24f644269395277da1d2d9974e8e235282ee87f6cf295bf5854caaf8cb6d87fface36f1f1400fa5995741d6845e654527

Download Submit
C:\Windows\SysWOW64\Lpepbgbd.exe

Filesize
110KB

MD5
dfc9e1e5b407ab74eefe6b4461af47eb

SHA1
d6b65e54db99c997a7b46eee208d5969c2905caa

SHA256
259acf59299361e577e85991f8cccf45b913ea7186d96b8fb86d233ab7fe225b

SHA512
3919cfaf83d01f4bf303ce84e5eb4d02b6f7a02537a74e86051fd234fe9fd8e14ba2a5b3c945828a126da649a2526a5ff822ed48c3225191d4c947dd6bb9bc97

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
110KB

MD5
0311ef2ad54f1836277391901bb0d264

SHA1
95b7ae31c8b68ac517593a3fcf3f88645992048a

SHA256
5f089cb0622b8d4b9bdc2d7d4c143ba7e724abcd25a07915452d2d822ee4d5a0

SHA512
f16c7b48a32382fec97a00d283e4fb889bbaa9c808caa1ae834f8e2f10e7e754e7c48e1f00670956c2b9b50f335dcdc3027adc6bb3bda8aa60055402f02a6b38

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
110KB

MD5
416caded92356eb26bb6d23bbdccca05

SHA1
0a0c556c7377570a678d74ff5a818c8f9f435c19

SHA256
b51fcaa1e287fce7ff8056d367374cf8a9035ff78f3b988b8cf93330a22af1e7

SHA512
dff3c3c96e87508da5fd9f8876dbfdbbebd229def7efc11100bd349dfd37ebda996ce86019a27c83031f1b9dac66f6fa6b7c5b84f4da1fcb4c534a04b2c686eb

Download Submit
C:\Windows\SysWOW64\Namegfql.exe

Filesize
110KB

MD5
3343e7aadefa280c8ed30d320827c522

SHA1
7d2417c54147dbcd049b43403e4d865d8df863ab

SHA256
311a905e338430279edf66d79689e54460ba653c11f8f92ca98a2d4772c90429

SHA512
cbd8d89b39e41a0c8b47297df90bbdab6d9fc3eb229e8caf2b47fdd8fa08ea6af2c1b2e7028a11105fcb23ffe8b530c46994646857ad46c2d96ffc95125271a9

Download Submit
C:\Windows\SysWOW64\Nefmgogl.exe

Filesize
110KB

MD5
557f2ece7225bbbff5f83711b97d104a

SHA1
0e5387dc65eb285a70c696f91df1b15e96127980

SHA256
cca3e4f8487e3a785b8a8fbf45f1f6b0b69988af53118540c8ac8bb4d932bef2

SHA512
f87f9f840a9bed4557b1f3e80c13d3e3461e1905b656db50f60db0d812eceeb8d91f15b99a59b2d16e5ac9f4cf98b9e11c42329e5b63ee3d943d5a411ef82a97

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
110KB

MD5
672b9fcb3f48ee3f94d0c1f5a4d9e01f

SHA1
31916d7fcbcd28734c45724e948e63d7931c845d

SHA256
f0cbfd90ecde94180d6148cbc5923298563fe64767e16fa77ece3e45a95e4732

SHA512
4bde956a1a3748620da989505fab0c7b818ec2a70d3a01094ddd2ab6a74d739b0ae1ab9fb0e718bc9394d4b71776031ae9bc59e34ec95cd862f235c748ea933d

Download Submit
C:\Windows\SysWOW64\Ogjdmbil.exe

Filesize
110KB

MD5
8a78df9e106d87c3e94e2b1945964b76

SHA1
5041bf256eab914cba6bf35f4337a32772953e13

SHA256
48938de85fff402ab51a2b1aed7d593881041c4da33abd35e0d554071db2896e

SHA512
aaf273be2256e1260d2adef1f52f8282d09993a9d88d20c77bb005ae840bc09cee21aa85b4e8381d10f5de0cd295815fb9a10a31d6b3566ce1975b4c8118ddf9

Download Submit
C:\Windows\SysWOW64\Ojcpdg32.exe

Filesize
110KB

MD5
7d04cb83da0f6ddc926c26dfc78d00ae

SHA1
14b1a43992748d1e41f92fcc3b8b73578353afb9

SHA256
0ce025234e67bb1f57de4ce0439b709c9ba2d3ec6126285950e71bf279ef13d1

SHA512
5d0ff0fb31564f18ce3e0e89252ad423b0a4620d00708719f32b5f2fbf67214aaddb2a10b403ce9d311a86fdf42657cd978bcee8aad593377cf33df0a1692ba8

Download Submit
C:\Windows\SysWOW64\Okneldkf.exe

Filesize
110KB

MD5
712ff2209ece3bc49ed22fea03f8ebc5

SHA1
80babb4272c57a9aa4ed05cf262517f4f12895fb

SHA256
6a4ab9565422b87413ed87d84d434edf430691d2004c0ca7970204cc6eb20cfd

SHA512
b3f5eaacea936160a8feba6d8efc726f4deb2afbb2a8efd5e8fc0a02be322d02127c322c05cad7f279990f46d2e9028d73041bc8d2d76f19c60df126ede8a283

Download Submit
C:\Windows\SysWOW64\Onkidm32.exe

Filesize
110KB

MD5
4183f2994dcd79396aa58016bede9e27

SHA1
7faed777ffb0735fa1a46b643b1e4ddc7262061a

SHA256
48cb6cdefbc5a8a94761cf564cfa7d4ce3718e05882c089509bc87ba83e6d67b

SHA512
c6dedc6bca427a43ad774252cfa78d140064f4695eb1ec6d0ea0bc19a192e7e5cd41b824a60316085cac74459ad4b55f7a46c28ab0c94d116641f128e67f6852

Download Submit
C:\Windows\SysWOW64\Pbbgicnd.exe

Filesize
110KB

MD5
4e12fb655c36a240e903becd8d759213

SHA1
85da55033e7d93ada2612e0e26a0f698cbf56585

SHA256
1f2277267bc15002a195578df59d4ea5518b1d5b032561dbd29eb6699bbe3d8f

SHA512
b1054a076df04782dfecea3cb653b8ab3edaa0411da14516c932e7606075241f5977fe05d5cefc88d4c526ea4d6872537e065533f4336f12c82b4b9c63adb71f

Download Submit
C:\Windows\SysWOW64\Pdenmbkk.exe

Filesize
110KB

MD5
319abc128262669b228c670158dee29f

SHA1
8a85a34521fa843f849cf8abaf32af6016015cc5

SHA256
00d5ad537b091e70958a133a4491c9eaec7c591bfbb203f41e137cb4b18038f9

SHA512
45dc8566b943eeb128a9504963dffbc178a4e943633ae2d21a2f7fb040d2eba3059cb54c4f9c5f346eaf5aad838a9f899fa2309ead84828fb9a94b94041c58a0

Download Submit
C:\Windows\SysWOW64\Pecpknke.exe

Filesize
110KB

MD5
6a334189c1dca38eccee0a8cade7b1e3

SHA1
50cbea7da1b175bf7186ef807ceeaf8a19303826

SHA256
476d2369b0167cb7f6f5bfbb82df2c273d87ff1d0329a327b3f3fa73ef50635d

SHA512
8eebcf19f9c4f48fe382b32b2e58c8a33ad1ecd278775f5a7989c6ec6fd063298290d90898e6ccc00680bf4e23e30dd86eec776daed3cb56c69988f009e597df

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
110KB

MD5
84ba3a927ef2c1b59fb902c898997bb1

SHA1
9b9904ca5de83ff7caa310cc04527609fd50b776

SHA256
7a9297e20f60b95c67f36f257847457c1aab87d86864a51cee3eb64bad194809

SHA512
5ee1ae023771ba0425b63ad2bb143013132d6e88d39ad7179ab76ae5329dc7e4ed69c01c911e64bffecc6e683550efcbf29fe51d104e5921a7dff68e2abca1b9

Download Submit
memory/340-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/340-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/720-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-219-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-584-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-577-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1580-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1580-131-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2000-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2144-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2544-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-603-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-549-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-195-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3556-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3796-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3988-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4152-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4216-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4272-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4272-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-499-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-243-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4916-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads