6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
Size

860KB
MD5

12cbf83abf772ae80fc1f06122cdc8dd
SHA1

dd109671efd7f9f4cf0aa3f2ac51f0ad757925fc
SHA256

6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4
SHA512

8046101e1189eba72366b7a045fe62a297f931753b034bf838abcf83f42c2b0f96ee8a224b55dae3fdde9413420aa1d335cbade1af2d68f3c5d3c35f2a85dc77
SSDEEP

24576:ls5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:lzbazR0vD

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpghkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhlpfgbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmjemflb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flngfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clchbqoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpdcag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afockelf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liifnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljdceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njghbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhoqeibl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppcmeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Malefbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jggapj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dinmhkke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oogpjbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alpbecod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnonkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpedeiff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jopiom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgdbnmji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhafeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccdnjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oelolmnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogklelna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pleaoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbkgfej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmglcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaindh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpaihooo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofegni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfomda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhbkinel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohgdhfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahippdbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhnikc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbiniff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfeagefd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plcdiabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgnkhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eagaoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljkifn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjjiej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alpbecod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfdklllb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpnihiio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidhlb32.exe

Executes dropped EXE 64 IoCs

pid	Process
4888	Jbbfdfkn.exe
3956	Lidmhmnp.exe
4816	Lhijijbg.exe
364	Llipehgk.exe
4064	Leadnm32.exe
4520	Mpghkf32.exe
4924	Mhbmphjm.exe
1492	Mfcmmp32.exe
4020	Mplafeil.exe
3172	Mehjol32.exe
4160	Moaogand.exe
1104	Mhicpg32.exe
3360	Mbognp32.exe
3116	Nhlpfgbb.exe
1128	Nbadcpbh.exe
4468	Nbcqiope.exe
4164	Nojanpej.exe
4752	Nipekiep.exe
4664	Nchjdo32.exe
1880	Nibbqicm.exe
4852	Ogfcjm32.exe
3716	Oidofh32.exe
3124	Opogbbig.exe
432	Oekpkigo.exe
2272	Opadhb32.exe
2824	Ogklelna.exe
448	Opcqnb32.exe
1308	Ocamjm32.exe
2812	Opemca32.exe
3080	Oebflhaf.exe
1140	Ookjdn32.exe
5052	Pedbahod.exe
2552	Pomgjn32.exe
1152	Pjbkgfej.exe
2892	Poodpmca.exe
224	Pfillg32.exe
2992	Plcdiabk.exe
5116	Pcmlfl32.exe
5076	Pleaoa32.exe
2888	Pcpikkge.exe
2836	Phlacbfm.exe
4996	Qcbfakec.exe
2948	Qhonib32.exe
5148	Qoifflkg.exe
5184	Qjnkcekm.exe
5220	Aokcklid.exe
5256	Afelhf32.exe
5292	Amodep32.exe
5328	Acilajpk.exe
5364	Ahfdjanb.exe
5400	Aopmfk32.exe
5436	Ajeadd32.exe
5472	Aobilkcl.exe
5508	Aflaie32.exe
5544	Aqaffn32.exe
5580	Ajjjocap.exe
5616	Amhfkopc.exe
5652	Bgnkhg32.exe
5688	Bmkcqn32.exe
5724	Bfchidda.exe
5760	Biadeoce.exe
5796	Bcghch32.exe
5832	Bidqko32.exe
5868	Bpnihiio.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jqlefl32.exe	Jjamia32.exe
File created	C:\Windows\SysWOW64\Hbhijepa.exe	Gipdap32.exe
File created	C:\Windows\SysWOW64\Mohjdmko.dll	Mepfiq32.exe
File opened for modification	C:\Windows\SysWOW64\Kmncif32.exe	Kfdklllb.exe
File opened for modification	C:\Windows\SysWOW64\Dlicflic.exe	Qomghp32.exe
File opened for modification	C:\Windows\SysWOW64\Ahcajk32.exe	Aeddnp32.exe
File created	C:\Windows\SysWOW64\Cndeii32.exe	Clchbqoo.exe
File opened for modification	C:\Windows\SysWOW64\Lqojclne.exe	Lggejg32.exe
File created	C:\Windows\SysWOW64\Pplobcpp.exe	Pmnbfhal.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Conanfli.exe
File created	C:\Windows\SysWOW64\Ddkbmj32.exe	Damfao32.exe
File opened for modification	C:\Windows\SysWOW64\Edbiniff.exe	Ebdlangb.exe
File created	C:\Windows\SysWOW64\Bpfljc32.dll	Finnef32.exe
File created	C:\Windows\SysWOW64\Hqfqfj32.exe	Ecidpiad.exe
File opened for modification	C:\Windows\SysWOW64\Lhopgg32.exe	Lpghfi32.exe
File opened for modification	C:\Windows\SysWOW64\Bkmeha32.exe	Bpedeiff.exe
File opened for modification	C:\Windows\SysWOW64\Bggnof32.exe	Bmbiamhi.exe
File opened for modification	C:\Windows\SysWOW64\Jcphab32.exe	Jlfpdh32.exe
File created	C:\Windows\SysWOW64\Oeokal32.exe	Oodcdb32.exe
File created	C:\Windows\SysWOW64\Ekaapi32.exe	Eicedn32.exe
File created	C:\Windows\SysWOW64\Mcdibc32.dll	Caojpaij.exe
File created	C:\Windows\SysWOW64\Obnehj32.exe	Omalpc32.exe
File created	C:\Windows\SysWOW64\Kcpahpmd.exe	Kkeldnpi.exe
File created	C:\Windows\SysWOW64\Hbenoi32.exe	Hpfbcn32.exe
File created	C:\Windows\SysWOW64\Okilfdgl.dll	Dapkni32.exe
File created	C:\Windows\SysWOW64\Inqbclob.exe	Idhnkf32.exe
File created	C:\Windows\SysWOW64\Maggnali.exe	Mepfiq32.exe
File created	C:\Windows\SysWOW64\Clmipm32.dll	Doccpcja.exe
File opened for modification	C:\Windows\SysWOW64\Fbhpch32.exe	Flngfn32.exe
File created	C:\Windows\SysWOW64\Ofigcd32.dll	Iqombb32.exe
File opened for modification	C:\Windows\SysWOW64\Fagjfflb.exe	Fknbil32.exe
File created	C:\Windows\SysWOW64\Jhcnob32.dll	Lbpdblmo.exe
File created	C:\Windows\SysWOW64\Bbdhiojo.exe	Boflmdkk.exe
File opened for modification	C:\Windows\SysWOW64\Bohbhmfm.exe	Bhnikc32.exe
File opened for modification	C:\Windows\SysWOW64\Kjjiej32.exe	Kcpahpmd.exe
File created	C:\Windows\SysWOW64\Ljhnlb32.exe	Lcnfohmi.exe
File created	C:\Windows\SysWOW64\Mmfkhmdi.exe	Ljhnlb32.exe
File created	C:\Windows\SysWOW64\Bdgehobe.exe	Ajaqjfbp.exe
File created	C:\Windows\SysWOW64\Phlacbfm.exe	Pcpikkge.exe
File created	C:\Windows\SysWOW64\Qcbfakec.exe	Phlacbfm.exe
File created	C:\Windows\SysWOW64\Omhebonp.dll	Qjnkcekm.exe
File created	C:\Windows\SysWOW64\Fmpbnihe.dll	Alcfei32.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qaqegecm.exe
File opened for modification	C:\Windows\SysWOW64\Aaldccip.exe	Akblfj32.exe
File opened for modification	C:\Windows\SysWOW64\Ohlqcagj.exe	Oabhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Ifcben32.exe	Imknli32.exe
File opened for modification	C:\Windows\SysWOW64\Aqbfaa32.exe	Ancjef32.exe
File created	C:\Windows\SysWOW64\Faaigehd.dll	Mlbkap32.exe
File created	C:\Windows\SysWOW64\Nemmoe32.exe	Njghbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mnegbp32.exe	Mcpcdg32.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Hehdfdek.exe
File created	C:\Windows\SysWOW64\Nlphbnoe.exe	Nefped32.exe
File created	C:\Windows\SysWOW64\Ddhpmfbl.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Pmiikh32.exe
File created	C:\Windows\SysWOW64\Eignjamf.dll	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Ehjlaaig.exe	Emehdh32.exe
File created	C:\Windows\SysWOW64\Keldkigj.dll	Odmbaj32.exe
File created	C:\Windows\SysWOW64\Alpbecod.exe	Adikdfna.exe
File created	C:\Windows\SysWOW64\Gbhibfek.dll	Pcgdhkem.exe
File created	C:\Windows\SysWOW64\Mpghkf32.exe	Leadnm32.exe
File opened for modification	C:\Windows\SysWOW64\Omfekbdh.exe	Oflmnh32.exe
File created	C:\Windows\SysWOW64\Bbmbgb32.exe	Bjfjee32.exe
File opened for modification	C:\Windows\SysWOW64\Bgeadjai.exe	Bdgehobe.exe
File opened for modification	C:\Windows\SysWOW64\Qoifflkg.exe	Qhonib32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	5468	WerFault.exe	878

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nondlbmd.dll"	Blhpqhlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgqpkip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejdonq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpodlbng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkjlic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfnagdi.dll"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlkipgpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkeldnpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgcpo32.dll"	Jgcooaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhmigagd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlbkap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nijeec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kejeebpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obbcmknk.dll"	Bbmbgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oekpkigo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addnfnhd.dll"	Imknli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mifljdjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmgmhgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bloikp32.dll"	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jencdebl.dll"	Ljhnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajaelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdmbe32.dll"	Malpia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olanmgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likcdpop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dclkee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkicaahi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iafkni32.dll"	Akcjkfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffaong32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adikdfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqmmmmph.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lejgch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gghpel32.dll"	Qhlkilba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaodc32.dll"	Ggmmlamj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icachjbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khcgfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjemgpnb.dll"	Pohnnqgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdpoomj.dll"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llcdeegk.dll"	Malefbkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdifpa32.dll"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjmj32.dll"	Knnhjcog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbnffffp.dll"	Oelolmnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiildio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijmhkchl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pohnnqgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeidhb32.dll"	Ibmeoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcmfp32.dll"	Malgcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcpcam32.dll"	Bhcjqinf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4888	956	6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe	97
PID 956 wrote to memory of 4888	956	6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe	97
PID 956 wrote to memory of 4888	956	6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe	97
PID 4888 wrote to memory of 3956	4888	Jbbfdfkn.exe	98
PID 4888 wrote to memory of 3956	4888	Jbbfdfkn.exe	98
PID 4888 wrote to memory of 3956	4888	Jbbfdfkn.exe	98
PID 3956 wrote to memory of 4816	3956	Lidmhmnp.exe	99
PID 3956 wrote to memory of 4816	3956	Lidmhmnp.exe	99
PID 3956 wrote to memory of 4816	3956	Lidmhmnp.exe	99
PID 4816 wrote to memory of 364	4816	Lhijijbg.exe	100
PID 4816 wrote to memory of 364	4816	Lhijijbg.exe	100
PID 4816 wrote to memory of 364	4816	Lhijijbg.exe	100
PID 364 wrote to memory of 4064	364	Llipehgk.exe	102
PID 364 wrote to memory of 4064	364	Llipehgk.exe	102
PID 364 wrote to memory of 4064	364	Llipehgk.exe	102
PID 4064 wrote to memory of 4520	4064	Leadnm32.exe	103
PID 4064 wrote to memory of 4520	4064	Leadnm32.exe	103
PID 4064 wrote to memory of 4520	4064	Leadnm32.exe	103
PID 4520 wrote to memory of 4924	4520	Mpghkf32.exe	104
PID 4520 wrote to memory of 4924	4520	Mpghkf32.exe	104
PID 4520 wrote to memory of 4924	4520	Mpghkf32.exe	104
PID 4924 wrote to memory of 1492	4924	Mhbmphjm.exe	105
PID 4924 wrote to memory of 1492	4924	Mhbmphjm.exe	105
PID 4924 wrote to memory of 1492	4924	Mhbmphjm.exe	105
PID 1492 wrote to memory of 4020	1492	Mfcmmp32.exe	106
PID 1492 wrote to memory of 4020	1492	Mfcmmp32.exe	106
PID 1492 wrote to memory of 4020	1492	Mfcmmp32.exe	106
PID 4020 wrote to memory of 3172	4020	Mplafeil.exe	107
PID 4020 wrote to memory of 3172	4020	Mplafeil.exe	107
PID 4020 wrote to memory of 3172	4020	Mplafeil.exe	107
PID 3172 wrote to memory of 4160	3172	Mehjol32.exe	108
PID 3172 wrote to memory of 4160	3172	Mehjol32.exe	108
PID 3172 wrote to memory of 4160	3172	Mehjol32.exe	108
PID 4160 wrote to memory of 1104	4160	Moaogand.exe	109
PID 4160 wrote to memory of 1104	4160	Moaogand.exe	109
PID 4160 wrote to memory of 1104	4160	Moaogand.exe	109
PID 1104 wrote to memory of 3360	1104	Mhicpg32.exe	110
PID 1104 wrote to memory of 3360	1104	Mhicpg32.exe	110
PID 1104 wrote to memory of 3360	1104	Mhicpg32.exe	110
PID 3360 wrote to memory of 3116	3360	Mbognp32.exe	111
PID 3360 wrote to memory of 3116	3360	Mbognp32.exe	111
PID 3360 wrote to memory of 3116	3360	Mbognp32.exe	111
PID 3116 wrote to memory of 1128	3116	Nhlpfgbb.exe	112
PID 3116 wrote to memory of 1128	3116	Nhlpfgbb.exe	112
PID 3116 wrote to memory of 1128	3116	Nhlpfgbb.exe	112
PID 2924 wrote to memory of 4468	2924	Niklpj32.exe	114
PID 2924 wrote to memory of 4468	2924	Niklpj32.exe	114
PID 2924 wrote to memory of 4468	2924	Niklpj32.exe	114
PID 4468 wrote to memory of 4164	4468	Nbcqiope.exe	115
PID 4468 wrote to memory of 4164	4468	Nbcqiope.exe	115
PID 4468 wrote to memory of 4164	4468	Nbcqiope.exe	115
PID 4164 wrote to memory of 4752	4164	Nojanpej.exe	116
PID 4164 wrote to memory of 4752	4164	Nojanpej.exe	116
PID 4164 wrote to memory of 4752	4164	Nojanpej.exe	116
PID 4752 wrote to memory of 4664	4752	Nipekiep.exe	117
PID 4752 wrote to memory of 4664	4752	Nipekiep.exe	117
PID 4752 wrote to memory of 4664	4752	Nipekiep.exe	117
PID 4664 wrote to memory of 1880	4664	Nchjdo32.exe	118
PID 4664 wrote to memory of 1880	4664	Nchjdo32.exe	118
PID 4664 wrote to memory of 1880	4664	Nchjdo32.exe	118
PID 1880 wrote to memory of 4852	1880	Nibbqicm.exe	119
PID 1880 wrote to memory of 4852	1880	Nibbqicm.exe	119
PID 1880 wrote to memory of 4852	1880	Nibbqicm.exe	119
PID 4852 wrote to memory of 3716	4852	Ogfcjm32.exe	120

C:\Users\Admin\AppData\Local\Temp\6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe
"C:\Users\Admin\AppData\Local\Temp\6a6f6c9d948033f3fe0b76dd85d72259568a4c8b1997b0b2fbfa63c367c272e4.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\Jbbfdfkn.exe
  C:\Windows\system32\Jbbfdfkn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\Lidmhmnp.exe
    C:\Windows\system32\Lidmhmnp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\Lhijijbg.exe
      C:\Windows\system32\Lhijijbg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:364
      - C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        16⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        24⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        25⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        27⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        29⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        30⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        31⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        32⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        33⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        34⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        35⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        37⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        38⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        40⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2836
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        44⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2948
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        46⤵
        Executes dropped EXE
        
        PID:5148
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        48⤵
        Executes dropped EXE
        
        PID:5220
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        49⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        50⤵
        Executes dropped EXE
        
        PID:5292
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        51⤵
        Executes dropped EXE
        
        PID:5328
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        52⤵
        Executes dropped EXE
        
        PID:5364
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        53⤵
        Executes dropped EXE
        
        PID:5400
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        54⤵
        Executes dropped EXE
        
        PID:5436
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        55⤵
        Executes dropped EXE
        
        PID:5472
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        56⤵
        Executes dropped EXE
        
        PID:5508
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        57⤵
        Executes dropped EXE
        
        PID:5544
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        58⤵
        Executes dropped EXE
        
        PID:5580
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        59⤵
        Executes dropped EXE
        
        PID:5616
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5652
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        61⤵
        Executes dropped EXE
        
        PID:5688
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        62⤵
        Executes dropped EXE
        
        PID:5724
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        63⤵
        Executes dropped EXE
        
        PID:5760
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        64⤵
        Executes dropped EXE
        
        PID:5796
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        65⤵
        Executes dropped EXE
        
        PID:5832
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5868
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        67⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        68⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        69⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        70⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        71⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        72⤵
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        74⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        77⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4144
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        80⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        81⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        82⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        83⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        84⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        85⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        86⤵
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        87⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        88⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        89⤵
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        90⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        92⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        94⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        95⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        96⤵
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        97⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        98⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        100⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        101⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        102⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        103⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        104⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        105⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        106⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        107⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        108⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        109⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        110⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        111⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        112⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        113⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        114⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        115⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        116⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        117⤵
        Modifies registry class
        
        PID:3728
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2148
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        119⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        120⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        122⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        123⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        124⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        125⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        126⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        128⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        129⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        131⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        132⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        133⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        134⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        135⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        136⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        138⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        140⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        141⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        142⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        143⤵
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        144⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        145⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        146⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        147⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        148⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        149⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        151⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6780
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        153⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        154⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        155⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        156⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        157⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        158⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        159⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        161⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        162⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        163⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        164⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        165⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        166⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        167⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        168⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        169⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        170⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        171⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        172⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        173⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        174⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        175⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        176⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        177⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        178⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        179⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        180⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        181⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        182⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        183⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        184⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        185⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        186⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        187⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        188⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        189⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        190⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        191⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        192⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        193⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        194⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        196⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        197⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        198⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        199⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        200⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        201⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        202⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        203⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        204⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        205⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        206⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        207⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        208⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        209⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        210⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        211⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        212⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        213⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        216⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        217⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        218⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        219⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        220⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        221⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        222⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        223⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        224⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        225⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        226⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        227⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        228⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        229⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        230⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        231⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        232⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        233⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        234⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        235⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        236⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        237⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        238⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        239⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        240⤵
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        242⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        243⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        244⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        245⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        246⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        247⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        248⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        249⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        250⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        251⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        252⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        253⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        254⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        255⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        256⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        257⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        258⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3900
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        260⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        261⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        262⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        263⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        264⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        265⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        266⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        267⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        268⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        270⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        271⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        272⤵
        Drops file in System32 directory
        
        PID:9020
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        273⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        274⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        275⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        276⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        277⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        278⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        279⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        280⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        281⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        282⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        283⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9100
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        285⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        286⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        287⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        288⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        289⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        290⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        291⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        292⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        293⤵
        Modifies registry class
        
        PID:9432
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        294⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        295⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        296⤵
        Drops file in System32 directory
        
        PID:9576
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        297⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        298⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        299⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        300⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        301⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        302⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        303⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        304⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        305⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        306⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        307⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        308⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        309⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        310⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        311⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        312⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        313⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        314⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        315⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        316⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        317⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        318⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        319⤵
        Modifies registry class
        
        PID:9812
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        320⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        322⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        323⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        325⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        326⤵
        Drops file in System32 directory
        
        PID:9276
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        327⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        328⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9644
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        330⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        331⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        332⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        333⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        334⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        335⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        336⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        337⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        338⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9480
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        340⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        341⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        343⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        345⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        346⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        348⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        349⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        350⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        351⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        352⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        354⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        355⤵
        Modifies registry class
        
        PID:10388
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        356⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        357⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        358⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        359⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        360⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        361⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        362⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        363⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        364⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        365⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10868
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        367⤵
        Modifies registry class
        
        PID:10904
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        368⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        369⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        370⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        371⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        372⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        373⤵
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        374⤵
        Drops file in System32 directory
        
        PID:11216
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        375⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        376⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        377⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        378⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        379⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        380⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        381⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10620
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        383⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        384⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        385⤵
        Modifies registry class
        
        PID:10836
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        386⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        387⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        388⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        389⤵
        Modifies registry class
        
        PID:11124
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        390⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11184
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        392⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        393⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        394⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        395⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        396⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        397⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        398⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        399⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        400⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        401⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        402⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        403⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        404⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        405⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        406⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        407⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        408⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        409⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        410⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        411⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        412⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10876
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        414⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        415⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        416⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        417⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        418⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        419⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        420⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        421⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11280
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        423⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        424⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11408
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        426⤵
        Modifies registry class
        
        PID:11452
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        427⤵
        Drops file in System32 directory
        
        PID:11496
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        428⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        429⤵
        Drops file in System32 directory
        
        PID:11584
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        430⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11640
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        431⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        432⤵
        Drops file in System32 directory
        
        PID:11728
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        433⤵
        Modifies registry class
        
        PID:11760
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        434⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        435⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        436⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        437⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        438⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        439⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        440⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        441⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        442⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        443⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        444⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        445⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        446⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        447⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        448⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        449⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        450⤵
        Modifies registry class
        
        PID:11664
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        451⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        452⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        453⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11904
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        455⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        456⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        457⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        458⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        459⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        460⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        461⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        462⤵
        Drops file in System32 directory
        
        PID:12260
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        463⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        465⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        466⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        467⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        468⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        469⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        470⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        471⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11864
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        473⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        474⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        475⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        476⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        477⤵
        Drops file in System32 directory
        
        PID:12120
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        478⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        479⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        480⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        481⤵
        Modifies registry class
        
        PID:11320
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        482⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        483⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11572
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        485⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        486⤵
        Drops file in System32 directory
        
        PID:11736
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        487⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        488⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        489⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2924
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        491⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        492⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        493⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        494⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        495⤵
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        496⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        497⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        498⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        499⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        500⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        501⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        502⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        503⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        504⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        505⤵
        Drops file in System32 directory
        
        PID:11800
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        506⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        507⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        508⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        509⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        510⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        511⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        512⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        513⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        514⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        516⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        517⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        518⤵
        Drops file in System32 directory
        
        PID:11668
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        519⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        521⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        522⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        523⤵
        Drops file in System32 directory
        
        PID:11964
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1004
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        525⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        526⤵
        Drops file in System32 directory
        
        PID:12244
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        527⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4020
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        528⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        529⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        530⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        531⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        532⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        533⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        534⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        535⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        536⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        537⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        538⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        539⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        540⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        541⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        542⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        543⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        544⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        545⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        546⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        548⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        549⤵
        Modifies registry class
        
        PID:11352
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        550⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        551⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        552⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        553⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2564
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        555⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        556⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        557⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        558⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        559⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        560⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        561⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        562⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        563⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        564⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        565⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        566⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        567⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        568⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        570⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        571⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        573⤵
        Drops file in System32 directory
        
        PID:3860
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        574⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        575⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        576⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        577⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        578⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        579⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        580⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        581⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        582⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        583⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        584⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2436
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        586⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        587⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        588⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        589⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        590⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        591⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        592⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        594⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        595⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        596⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        597⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        599⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        600⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        601⤵
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        602⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        603⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        604⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        605⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        606⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        607⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        608⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        609⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        610⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        611⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        612⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        613⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        614⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        615⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        616⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        617⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        618⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        619⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        620⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        621⤵
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        622⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        623⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        624⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        625⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        626⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        627⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        628⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        629⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        630⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        631⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        632⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        633⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        634⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        635⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        636⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        637⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        638⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jgcooaah.exe
        
        C:\Windows\system32\Jgcooaah.exe
        639⤵
        Modifies registry class
        
        PID:9200
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        640⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Jmpgghoo.exe
        
        C:\Windows\system32\Jmpgghoo.exe
        641⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        642⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        643⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        644⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        645⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        646⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        647⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Kmncif32.exe
        
        C:\Windows\system32\Kmncif32.exe
        648⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Khcgfo32.exe
        
        C:\Windows\system32\Khcgfo32.exe
        649⤵
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        650⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        651⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        652⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        653⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        654⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ljkghi32.exe
        
        C:\Windows\system32\Ljkghi32.exe
        655⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        656⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Lhdqml32.exe
        
        C:\Windows\system32\Lhdqml32.exe
        657⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        659⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        660⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        661⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Paocim32.exe
        
        C:\Windows\system32\Paocim32.exe
        662⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        663⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Pfpidk32.exe
        
        C:\Windows\system32\Pfpidk32.exe
        664⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        665⤵
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        666⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        667⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        668⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        669⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        670⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        671⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        672⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        673⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        674⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        675⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        676⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        677⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        678⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10936
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        679⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11192
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        680⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        681⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Kpilekqj.exe
        
        C:\Windows\system32\Kpilekqj.exe
        682⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        683⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        684⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        685⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        686⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11256
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        687⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        688⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        689⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        690⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        691⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        692⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        693⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7612
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        694⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        695⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        696⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        697⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        698⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        699⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        700⤵
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Lhopgg32.exe
        
        C:\Windows\system32\Lhopgg32.exe
        701⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        702⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        703⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        704⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        705⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        706⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Mpqklh32.exe
        
        C:\Windows\system32\Mpqklh32.exe
        707⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        708⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        709⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        710⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        711⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Mhjpceko.exe
        
        C:\Windows\system32\Mhjpceko.exe
        712⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        713⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        714⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Mabdlk32.exe
        
        C:\Windows\system32\Mabdlk32.exe
        715⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        716⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11884
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        717⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        718⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        719⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        720⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        721⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        722⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Aqpika32.exe
        
        C:\Windows\system32\Aqpika32.exe
        723⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Ancjef32.exe
        
        C:\Windows\system32\Ancjef32.exe
        724⤵
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        725⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        726⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        727⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        728⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        729⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        730⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        731⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        732⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        733⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        734⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        735⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        736⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Bjfjee32.exe
        
        C:\Windows\system32\Bjfjee32.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\Bbmbgb32.exe
        
        C:\Windows\system32\Bbmbgb32.exe
        738⤵
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        739⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        740⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        741⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        742⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        743⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        744⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        745⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        746⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        747⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        748⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        749⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        750⤵
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        751⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        752⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        753⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        754⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        755⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        756⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        757⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        758⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        759⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        760⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        761⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        762⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        763⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        764⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        765⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Ejdonq32.exe
        
        C:\Windows\system32\Ejdonq32.exe
        766⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        767⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        768⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 408
        769⤵
        Program crash
        
        PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5468 -ip 5468
1⤵
PID:5244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aafemk32.exe

Filesize
163KB

MD5
d0d804a8472a7062e2d36faa9d4c1f45

SHA1
61855980ee5f0037d8f35f024ad9d6ef51fb2a28

SHA256
8281a19ca1c29499642fb488d5f3e6617659aeda1c2eace3439fb4e5639c2c55

SHA512
145eb3fd08c24864e31d5f963c16963a312abcb4c3ed4d8559c862fd3acfb666fffc1f8b0bb9b74d63c045e69609258577b92c28181db6732c2a57c17ade1c3f

Download Submit
C:\Windows\SysWOW64\Albpkc32.exe

Filesize
860KB

MD5
b2af70297114334d9679f2e1bd795e68

SHA1
165bf314a07762c40c5b6a4307f8df447f81f08d

SHA256
c984132c3df86abf788407d389511dda991f60c8e5d84d693818a724dbd1e355

SHA512
d44a7fc925faaa111089136d72205b55c8b4ccd72bbcdfe105fd5ce0978153c8321d00a8169d97b3eb378d877f262b8a7321de130574239d94cf09208f03a41c

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
860KB

MD5
318133a1acfa4136a4e84f26755a1b3e

SHA1
58b1df618e0ff6928bc88faa26ff54d6330eca70

SHA256
5f6b28188366415dcea04d9c65526ef87e3b92f2c6d3f3e982e2613d3969fb3d

SHA512
435e2cbb4b01ab7a2cc6d668610ef70b5d11528a127ac8c1b48dd0325f7f8944975c913cf58f061e3bcbf2a004f4627df2a7317ae77ec96b7828834c0de39a04

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
860KB

MD5
24c3d2c25a41c46e076401c10ea8f281

SHA1
67cd95ac71ec1b97dc864c56ae4336b4d7bc8a17

SHA256
4f54d2d67a291979118f1e26b99fd5d35a771276bad94ae92db349cbff85135d

SHA512
837f2802794f93c03e230067f069be33c754bece2da3f6a86976521567501b9cb9f60d76919266f282cf4f0f9046934ddd8439bbfddc1ee5b2e01806a897821b

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
860KB

MD5
3482bb279608d84e0d16e8e9591bbbec

SHA1
bacd4755f7e715f449d3ac53532cbef9864cf04b

SHA256
bc5f75c151fcd4241785d8f35d1fdddf0aa33ee00f5ef8298194c4572fbebbc7

SHA512
48a8f61a1c3f58b344f46ce8e81df74f512b5f712f7fbe577dd99c815fa7ffdc2974d75970341a7e8468a6e8017db9701d29e6c3bf5fb375f6fa73fd14640acf

Download Submit
C:\Windows\SysWOW64\Fgdbnmji.exe

Filesize
860KB

MD5
884848bd3b7803a759bbf3a4a4eee939

SHA1
bb92d5b7e8a98bf29c2fff0e35285f606d1143c5

SHA256
6ee2472bf90eee807ad7a0cae4b6687c8f41b84e972d5c332e08617bae203b32

SHA512
27f5d89957d214fd89030407642a1630e4ffadcca3511d9141df7e947e6401f92f1abb49c6fe749f2e429b87c3ea1d6046164953e99df8ae6f3ae770a51b48b5

Download Submit
C:\Windows\SysWOW64\Flfkkhid.exe

Filesize
860KB

MD5
8d062ff3863469553bdb17ad7b207ed3

SHA1
e908d4942b6fb149b92257cb1c34033ecb4034fd

SHA256
d5e331822b3603f3e82a61d3d5c30a067c6b843c550ecb48246a11bc0751b3cd

SHA512
cbb8fbc77cb624d12211f4c9eb7c474784c14ccdceae88563593e11d77af786b7dbef76369c5fd69a2d06121dc11066d6d4ca64be9a242ed9718e8c01eaeb9cf

Download Submit
C:\Windows\SysWOW64\Gpbpbecj.exe

Filesize
860KB

MD5
22aeb57671490bacb625b66cf928d8ed

SHA1
161941a924f25468b2488d8ffb1601df85b9d066

SHA256
23bef2b778b078cd4ce638327fdc9a73c29dc5309a1e79c7718b2a70c0daf14b

SHA512
1724cb7aa96485dd28eedfb9697899bae9928829757fab632617b1f257c8c73f737652c7a2d279efb4d5c58d40eab5fbc3f416fd599259bee552fe3843636428

Download Submit
C:\Windows\SysWOW64\Gpfjma32.exe

Filesize
604KB

MD5
b9400ffd992913d3cfb85b958b3d31e6

SHA1
86fd5355e404ee2e159442d9ac3e1f1d87b1e485

SHA256
1a75eee455cf4cf1bb3bb9c195c85e9f5f3da0bd5f8c1dd95c838b19e7301fae

SHA512
7d6e88fdb4ca24107ac6866eb34a0c9eac51c1145cb5a8444b5f43af20a216d431996a133adf75377f7b437a3f84a89b06025f3082f9dc00a23d491e1ba923f0

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
860KB

MD5
fdb1aca34990f9174455256aa8d6dfe9

SHA1
c3d8c74656953460fecce27fd7ae4745bd9a1b71

SHA256
27541fd54a26c7e1ac57c48b2dac69559440385c12fda2472d1eb21778f76041

SHA512
fa218be84e76e82688301a90394c981a9c4d0ec5b2711a0185779094fdd00407db814cdade33e82e5b54a219f15f503ad2f1b74a1bb31fce651fb7e21c2d5843

Download Submit
C:\Windows\SysWOW64\Hkbdki32.exe

Filesize
860KB

MD5
ad16e32c91251c71b4ef1b10cebf1015

SHA1
375567f333a265d37cc76082eb818fe768100012

SHA256
2deecda17e75a8f17ad64196b59e2ac1d4ce907f75ea5e617bb3acc32dce3e6d

SHA512
bbecc3642de2eac0fd00fceb412a6ca39602145e19bb0aa8dace3719f494e531c9a81d1a7f2f3f750a3481a7fbaf2f5289727a9a16951540526bd7bb069123da

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
860KB

MD5
7f7c1b2318f29b6dd9a4d48df2a97393

SHA1
79314450f6a9c4c807ec3c3d956fb9bce11bdd2a

SHA256
b6fdcf768819c24d3147aa975e009ecb7b86ccf2465b2d9b0d2d0d9315eb5373

SHA512
d1a06eae2ce339fc2eb0f2b527b9d025e7a4488c9607bbe0595581c972b9aaa0f8c5b017419661d94d2e137e7e40bf079cd44602cee25443a6214d13231a3117

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
860KB

MD5
9a5b0514ba5719da2e6b4eedde1ab9e8

SHA1
32fb6582213b7bfbf95e2cd71df74e2c455aa3ea

SHA256
ee5a330820690be7276457830ae9267b622812e68cc927cec0f6bccdcc1c5e32

SHA512
1f0e6504130c9662a3deb881c311dd10bc72af214ba70925613eda6d85616c8e5714de3382836784fc03cc8668f1558e14500b3c950db0cbdea9c2cef1472ea9

Download Submit
C:\Windows\SysWOW64\Idfaefkd.exe

Filesize
860KB

MD5
1b13836b8d9dba8f4fb4b24ef946bd91

SHA1
e91c43ba044f9fbb493b885197a0a572985afa13

SHA256
114e5e97ab2568c9ade12723477e507779f3dbf77eb643ea1501be075721b556

SHA512
3ab26cfb5936972cfdc65e794e3c97b42075194c70694b295f3fb21296f5c9d8a2f9bdf6be2a4fea411810b40d9ee6cc3e1806785d00490ebd5a9abf90a137af

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
860KB

MD5
0aa0e18c9527907566c843a26a00c5a5

SHA1
689e9d8bdbbdf5402fc5c3a0c60feae29248ae5f

SHA256
e640e9b5375447d36be62c6ce8939d6b3bce7b77f3c8abc5804e6336cf9a2269

SHA512
9d50fe4f613ca4ae2c3c4d57a771b4c111f57bf246c5b52e031b08ae2d6f7cb948a1414bbe66715f652bec59500ee30a6fe3c8d0838e047aa60fef00e1489fc2

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
860KB

MD5
02cbff4d70d8098423b5efd75922ef07

SHA1
1985dcf3df1649ce2cdc66c0a79ac22b9cab8ec7

SHA256
b35e06d439a72c9c84fe7c301f2bf8c19ed197562ce5276687cf15e9f3797c63

SHA512
23a1f6e144925664e5cce36e014c5aecdf593ab5f643ba3cac8a2d6265f919b241ec6ee1c51670875a040482e22ded139deebfafe52dd073381cbee0ad9f0ae1

Download Submit
C:\Windows\SysWOW64\Jbbfdfkn.exe

Filesize
860KB

MD5
ce266fd1be2979638ca43c42fedf61e4

SHA1
eb064c82d05e5bb9c5059a56386394a8e9739046

SHA256
e4e87f13720883b3ec9e5cff0348ec139c2755c7297efcd5f39f0947f41107e8

SHA512
05ff860521b0318587b811e6ec5da83b9df6e2d9939af42047c83095b1aff0f96caa8ac7b9929fdb80ce0f08a2408358f5485df7b04f318e2925470308ac3a2f

Download Submit
C:\Windows\SysWOW64\Jjdjoane.exe

Filesize
860KB

MD5
1b8621d0fab43e593072e3c0a1ea0413

SHA1
af7d025b3862a292465e376328ffd423f55b908d

SHA256
ab5350e4fa647cf2af26a61b65f38a687e662a9a63244e03e68ce7dd916bc8f1

SHA512
2a93645078486761fe6fac751e24af1943934d46d085dae0306e5ae8fc2d708f6c42a09a7759c9f28f3cf2c560b5a81f87cb37d085fb53f8d8b2efa84f77607d

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
860KB

MD5
5275e92e234726c19dea74204239bc94

SHA1
c581363c5f103cc8f0ba44740fc728995b7c68be

SHA256
d62b83e977f466190d3ba4ac4c8eaa582a143f09b46c3fd2972648c40b538a5f

SHA512
3c15301d52f20d61bbfd06e21d68231624c2de478716192d24da5d6617c5282175fc6c959624efea9d9add02af1148ca0a60c5c960842b8cca2e661fe6c66f86

Download Submit
C:\Windows\SysWOW64\Leadnm32.exe

Filesize
860KB

MD5
ea78669dae521d854d703ce047873f18

SHA1
3f1ac1b0129fdd65348fe1ea7bf23cdaf22a8fe6

SHA256
f5101a8950039018c76b1ad5c807cd9709f36a15d54306320720cf83e1297362

SHA512
d1a9d1359f9517a02d15542b9473b2dafd6fc79f4d8f9c2a41122bef7c9ef553bf52b66223e68c10a542922133a8f30d2fb270219c077e56081bb966d0481797

Download Submit
C:\Windows\SysWOW64\Lejgch32.exe

Filesize
860KB

MD5
709e375f34cee0987bb2eb961641c40e

SHA1
5311af816e86412aba9c66dd0e814ea7f60b3e95

SHA256
982abd404df9985b113593353f2793f28e4cf6324599e60096e33258bf2328fa

SHA512
643f6d9eef79803c1cf9202df11e62a50d75c2ff16128f707681149903667dc8c3b5a0a25c657d45e87d80798131f9c9ab1e2e1591d2c00c2def57bddaafe964

Download Submit
C:\Windows\SysWOW64\Lhijijbg.exe

Filesize
860KB

MD5
7905e960650f1827d70dc52eb074c215

SHA1
a815f18784232eacf24e3f0890ddcc7719a8b447

SHA256
58bd674d15b825185900a43c4838c938a29b6dd4fd013ce720a396e740ff22a1

SHA512
a8813566fe265a1b6807377e94f732bd42684ab487474b78f5153378a14466b9e1f4728b6e05910ae48d7843d209de52fc346e844401b4599eef9b772ca2e02b

Download Submit
C:\Windows\SysWOW64\Lidmhmnp.exe

Filesize
860KB

MD5
620f0c085d0f4b805fde9d3b92b9b253

SHA1
412d5d077d7e9540ad6036266b3a999191a2162c

SHA256
8c971ddf1aa6c35972aecb15f9afdbd151e2f1493b85bed00e09a0cd7f933dab

SHA512
25bdfec8d347f62c4a63802b272b5c1413c3d418d8374c071d6581d425da94595402a4a6b11bfd2b15915b0ccf3ff66e0c26f2b8de15520c2f89e9c2105e4bb8

Download Submit
C:\Windows\SysWOW64\Llipehgk.exe

Filesize
860KB

MD5
c0674aa0f0deff816a9862fd44a2832b

SHA1
c77a408b9d3c8b26dad3239444bed7274351451e

SHA256
ea9ddb824af57af08101de9754b044bc5ccfdb251225a2c05ac4d633907a16e8

SHA512
721a7c13110e6ea217bd09e7245eddd4980abacb38c87700585590f807d585b61715b49e46df868de43d00c7f0267445b1e389adc3be1fbfd45432be51e834b4

Download Submit
C:\Windows\SysWOW64\Mbognp32.exe

Filesize
860KB

MD5
60fb91e549cc97607254eb259b344d73

SHA1
87de046cf04a4597bee3ccacb584b673cfaaff8d

SHA256
f2977bd690123d89f5f2a56c0868809d2a3b88b98ffa28063998869a38ddfe3b

SHA512
12fd06a2f1efcb34172e85d4c0f2fd525b2f80d0179feb99c4bc7d57d86f27bb7bf5b437f193f82c5fe2e504660c693575c616b44dc5a30fcbf9db9f1fd22ee2

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
860KB

MD5
525aac7e4eaa00d0e0a21a710604dddf

SHA1
4b468c028d909bf0e31566b121ba26d9af077d6b

SHA256
705b8114dd5d246f87189c4be11afe4dd9090540cc08f615b5cb554ff635ca6c

SHA512
c246f6a0bd882506f3f4361d1af316ffb406cc384681e793a89ed89592b63ab1acee040d45d3f87dcd4c867f03d212c9dce4263f1786f857cbf9c22b985255ca

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
384KB

MD5
8e3fb8858d863b1327baa23dd6f574a9

SHA1
5df89675b9353706872620084aa880e6c3cc8496

SHA256
0f733876935c272aeac497abd7777988ce5593e04e32aff3585f46e986c9becf

SHA512
4193f850ab46cb8560eb53c5af69d0850009ef6c528379a7117104474581b82ebc2bedf3c9ba6b6851fa2c75e704b3bc53b9d4459ab8ab62c66706d73793c713

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
860KB

MD5
cc11cd984fbc90b2de6fb730a2894344

SHA1
9dd3c48bc283fa69990a361a3d37dd3cf508c36a

SHA256
4a7be346357b0ad67a1dd918abef20e163d072d8e45daf72c303d1425cc4dd28

SHA512
fccbcdcd0af77186ee68a0f586e71fff041a05fd0ba766bde051e9e9c82482d2a90b22f2cc7b5e1e9f597fd94a622a9e9bd24f6d7dfae59da3a5a10383f66367

Download Submit
C:\Windows\SysWOW64\Mfcmmp32.exe

Filesize
860KB

MD5
e1ec0fdd1eeb04d87940c92cee6742f7

SHA1
5268199243599c5c12b8d31d94474b7f515794ac

SHA256
f25a279eb615e08b608c055f7ed0936d6731b17549a64503ee7eb338a47fb836

SHA512
8c1849efd5beb5b598fd355b04a26a9e7aed2feeaed4fa9d5c44fe9cb65f84459894598160a4629ddfd65d968f5c9aeb6bdbba12d917bc5002546017609783c4

Download Submit
C:\Windows\SysWOW64\Mfcmmp32.exe

Filesize
576KB

MD5
53bf2038dac9f1e38547e41752c62c49

SHA1
44cb92448a97cce1721606e7996f90c61f229952

SHA256
4a7de5a5bb677c43c72bc76e11a06ef5b8dbe038e8f005f3c54d04d1a5cf7656

SHA512
a79c741d275644b523e8432793ddc21b92e67a43c14e9b12e3f9c48160830685083590bb2528b67fd2f85cc8c0e43678972205340d6f49cb71527089f744c041

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
860KB

MD5
0659c9f21e3c10bf4d6a3f70493baaa7

SHA1
dff044c9559ce3e41e983a921d39a5ec5698d83b

SHA256
ab75cdb8ccc800ea9def9eda1a39768a1c53f96ecb929f28ba2733d095561c3e

SHA512
b3dd4957a4c832869d956dd23e42cfb5a4f6e80f3790fa9f184319d08dedc6cc944c2c6cb874afe50f530e5a39830d174a5e60e9779198e83c528d7ac36d0c32

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
832KB

MD5
b36986b152ea857bb194f013a09a5c47

SHA1
5e93af4fcc2c43a76f10f42aace1dadf7540b4b5

SHA256
13d85f50bee61cbd76b99e64dfbef728e01f22aa7e0bfd9ed0cb09d93da981da

SHA512
6b0d4b4c4f657a43e4b31a0f504ef9eedfd38493386f007748592101a74a9cdc0ac11ceccf120ddf198f85e83a6f55254b93e8f848edc245c2bbb324d3301298

Download Submit
C:\Windows\SysWOW64\Mhicpg32.exe

Filesize
860KB

MD5
2d761226803c2b783df991daf10e672c

SHA1
ee315952e1953dabd55c3c305612fb08504a03b7

SHA256
36cc911e46959f6d16e299b4a70db4dee26cebc54a70fc74c0bdc50da3883b42

SHA512
7601f3c2408a80a40b1ee8542a5e35feb878bed355f06f7bdd90e108c833a0d8330d99ae7e69a414e02db1f907ec742ea07683abfe992a2c8c5742458f94621c

Download Submit
C:\Windows\SysWOW64\Moaogand.exe

Filesize
860KB

MD5
b1f28104727c6b2efeff943a0b5b0cd1

SHA1
1b8f2b3edd91849ba147ecfaec9b89f91ee442f3

SHA256
8b64105742e3f94baf62aca51d2fe6c867f7e97e9593ba995e1e0a0eb68684dc

SHA512
07a171e21cba1d67aa8ededcf34ac6b181e51e543d90f637ec25b8ddfd0d7669003c4942501a9cf97ddbe4b1537b0ae6d41470658d16fabbfcf76c9dd31febe0

Download Submit
C:\Windows\SysWOW64\Mpghkf32.exe

Filesize
860KB

MD5
833d01853670af2baff76e4a3e5b1e74

SHA1
b54251f80ce9762147329017ced8eb1f08e65ddf

SHA256
5f29d8e66401c7a874dcf52fcb56abd33b62553641ed691b12af6ca061eceffc

SHA512
6da052d901af1f364703cded681646a5b3cd4043e1140c97cf300420d0025d2a2f086bc6bc124518453e3d0d3e895adfd4d5ffc8f241336ff75b83639b7b9548

Download Submit
C:\Windows\SysWOW64\Mpghkf32.exe

Filesize
832KB

MD5
1f263ced36340f2ca766669e9a377286

SHA1
90206258c5aee36c34b3762bde35a617c48f27fd

SHA256
76ad97b0fc85944c11d4da9cde7120f87bbdbccda6ba228d657351a92a66c736

SHA512
ba100cb6aacd5bbfd3a68f7234d87b6a92c7afc792de592311f9925174251f36ebbb6fed4898424e9b57046718a39187eab401dcd1ef969f4d59e19fcb2b5c4c

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
860KB

MD5
4fe00cfb10308fbc8b43c4b974d63083

SHA1
74822132c9e1c3859826c3e6d5352bc9ce510292

SHA256
c82e85352d8a7394417531763b27ff577bb8b1edaaf49c1a291b5521f8829df7

SHA512
dd0b700cbe9903c7da7e6f37c224c36cbdd8da65b44fed60cb52d4c67789de386dcb9509860c606a13a20f335969c7e7a48b4de4abb480921fa103ec9d952d3c

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
512KB

MD5
b98e2a78eac1d0d9d0363ce46d46b4b1

SHA1
feaf6dcbe43af400e82b92b280a5ad8a1c46a7e7

SHA256
36135820cda1728175a3ebc5f0b8e7d169aaec6eefae10a6ea736198e73d15f1

SHA512
7ac81b793098448bdde4913fb9ccbf43b650eadd4cafed960ac81f14c3a0bda945640bd6b1c9df3c06c0713e25f65d3c1341aae5f5b93ad02715dd3c4e7b3d8c

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
860KB

MD5
0f56b9b5b030ca028376e4da4198f930

SHA1
bf2703ef7bc4ecbf3c62b40d8bcb9f805e4c1277

SHA256
cafdaba789b00040ac6697531fc28d1a309d4a0f21ee84856ada567899fef06b

SHA512
2d34a1bb824e8c64f285164c6c7664dc8cfce4d85d3420e3e71baf287434930fa3122cdd693a76e656bbd7bf99dc20fab32f171e40a42c6b54fd7bf3b8af3a08

Download Submit
C:\Windows\SysWOW64\Nbadcpbh.exe

Filesize
42KB

MD5
60a49d951e7e2bd8a5c5ac5800c019ed

SHA1
54a695f85ee57679c918ae71362d436c29fc131a

SHA256
e70baf39deb23901ce1946b78941db78fcdf32849029d6a2c20cca3da68cffcb

SHA512
67af23c091be027cc3bef59cabf545fd08f35345d19c85ac9271e48ee8b8155d521f666f1875b7e32eb0dc152ac418dcaa5146c573a246d6e23c07234d602216

Download Submit
C:\Windows\SysWOW64\Nbcqiope.exe

Filesize
860KB

MD5
f0d4a45622eb3e77284c31390c21c42d

SHA1
4c6af31ec70539fe574c08105c9ea33c8511ccde

SHA256
c385870b09cedbaea0f2e62a619600ffc32c738ffcc868ad45aa7aebe1bb99a4

SHA512
7412c6a9d33db36ef36d32d8946396acd58123b4a9a8cd2c55f1a2daf36a11f3205f396b0a4d5e7f89d439eb7a3172e7f55351ca2a69aa81cc8e2425b39fde14

Download Submit
C:\Windows\SysWOW64\Nbcqiope.exe

Filesize
832KB

MD5
c30ac5d911271c9c55d65be7cb6e6101

SHA1
f857556f03ef4352dd2d7914b0e25fadd08b746d

SHA256
a4df9462e71b4dc49705fd633270f91d714972b367f0bc5dc585cc88c1446d7b

SHA512
357188b3ac1296ef5f398ec0559926667c39aa65fbdc1836b0ac5acd6268dce6deb3693ef4b2a61fd3014ec3def3742ab3a85ed54e398cd1c5321554ec165d05

Download Submit
C:\Windows\SysWOW64\Nchjdo32.exe

Filesize
860KB

MD5
ce6698ffb6bbbc2b4277328670a0fdf4

SHA1
c744417f03770128831a6b4ae9ffffdd2c71fb99

SHA256
9dde93b9adafcc19b2e0cbec0572b31394488aca6a42e292213d917e9b4614e5

SHA512
9d6ce0f15f5c8b6ec55a549bf6e3626e2733ce84e8db643890896334b7457ffa265b8282071071a5ba0981d856e1c81d14529d9398b7ad98e6dce10f35c16f0e

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
860KB

MD5
194a22354ffc2eb96b0f1b4de8b2d39c

SHA1
14deb135e456a8116967a4d08d1f54bc2594f015

SHA256
77e545f2c6fe07a529647314d7bce0666d679296039f5e869c6c3152a97385a4

SHA512
d048e2ad8cb4bc115b320af8aa306ee49470303d7c7e3fb4da1b66f8f0b5071eb467c01628bcaaf0381ace65631978d655761e97dc6273e471b7367f044d80b4

Download Submit
C:\Windows\SysWOW64\Nibbqicm.exe

Filesize
860KB

MD5
3ce14c714953ed9c6eeed1807254de60

SHA1
dfd50120ca00bb4d47acc06051b34784fdf3a85e

SHA256
11c8e60ef54fefa0f26e43c608a7b6c117053f147341733da1e019999c25d33c

SHA512
5fd1e2319192a9881a8b23e300ade5f40f7f433ae1392e5d7c7f3dd7d55a2af7ff7c0034f15e8b00dac26c7a959dc0ed9a4d59abd026208f70494750d9ae1c1a

Download Submit
C:\Windows\SysWOW64\Nipekiep.exe

Filesize
860KB

MD5
cd062a7c62aef2c98f7f9ed33b6ad0c9

SHA1
42318316d5e08ab7fdd94f27842dfb60427e76e1

SHA256
0f9f30ce15ffdefcc3d1039e635c92a972693837609a3275d02c440b93fbd164

SHA512
eebf61b0b28a2b753865bac1b44c59cb81bfdf985194d4db15014196267d4cfb024c0488a2944c65b400791e8ab27eae65b47263af77aaa162f7ba5dd30d9f07

Download Submit
C:\Windows\SysWOW64\Nipekiep.exe

Filesize
704KB

MD5
21f90e8068068a6c405cf76f9728ce5b

SHA1
d810d501349a428c1c20ebabebd8e2dcdce04b41

SHA256
e6649aeea46f01b189d1212d512a062c878982f9a6a3caf94c6ad273ffa6908e

SHA512
da49848493ced32944dac3c3a932d23e8d0bc55b2991ca1b1730f7e10ad42d74fa62c7ef4209c41d317d9072e8600b599e04bf53658ea82c2d6e83dc99f7d9a7

Download Submit
C:\Windows\SysWOW64\Nojanpej.exe

Filesize
860KB

MD5
1a9510966070124fc7d2edd2ca33edc7

SHA1
b75ededf52f949c83d30761da02120f2d5bfdb17

SHA256
de93c4cead55ebc008aa0282be7872bc902548a30b2c77b7a676e4ca9bf2aad7

SHA512
ebd1859ea9d511752855c4b92a45fac52cb1ca67e4c67d02b8d1879a6da48e1c716a51e17d7e04b657235a4c6e0d74c6d2697c3af432be75c6f59d5fe9f64a62

Download Submit
C:\Windows\SysWOW64\Nojanpej.exe

Filesize
832KB

MD5
35facccafed234a8fd0a1d1a246d78b1

SHA1
dc0c6dd9dca1c4ac5d2b03a5b79c8c47c3bce59c

SHA256
570cd02083a84029a0d4501450919b3c970b70f9b0ab3771c8901db011c51804

SHA512
a442f63a0f33d611ec0faf95f7d432c87d0b03fcb2c7b56e4ba718991ee36bbceca4df3effe962bcfb182e0cccda9248f08e408371bacfba9a782cc000109f8c

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
860KB

MD5
32cbb4784a2e5d97431a39cb940085d8

SHA1
9654f968b26de84af6fdf20286c26ca850a97832

SHA256
a9fd1eb6f5846a1184373a25d83b3ad050a80088ef2bfb7225c72433b13bd514

SHA512
de578f3c91ac227081955662a57556a90281e3a1dea12f85259f5f82510a066b49c4a2d3b9b0e1d1b19271ae8a0aeaa93544f51b5e4bba2368215d8b8bf8ed86

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
256KB

MD5
2355f6843057b4fc8f8c292365891c1a

SHA1
45c7fd10678cc409a7ba4de58ba0ec45fe5d0274

SHA256
a28e7d392ad021cf90e463248482ea1318e880dbe2dcc1ff0a29a8dbccd500dd

SHA512
61ec17a8b8c2e36ff1a98c0dd26adf987c03e4b0ae1e7e0153c34a399cde451636cabe5d29042cf0bc4db5308a56e53bb158e84aaae7b1637f85cde036b7d464

Download Submit
C:\Windows\SysWOW64\Oebflhaf.exe

Filesize
128KB

MD5
17fce3ec5694d3259cc877c26065c355

SHA1
6c500d8bcdddac04429a1f0e6eb43a59e9be519c

SHA256
1ebf502f1f0284483b2fc6b2d6bb3609c08f3754e16f603d0d1a1b0354dd73df

SHA512
13d9f4d4b8f283f8a573d86698869cd2f96f81265e16aecdd4a868bd906fb5132397fe09da6dc499bacc3504e305473a6f679ff2e04e61f5b28017e00bcc0dfa

Download Submit
C:\Windows\SysWOW64\Oebflhaf.exe

Filesize
860KB

MD5
a3214b5b1a775cc1d6a3895c4529c7e3

SHA1
b9e5833eea655163c4be44377c11ec316445fbfc

SHA256
56221e2ecf69887e8e059412f3ae12d859369f8afafbbf6ef0a21333dcffb2e7

SHA512
9acd866a0dca7c822da22a66bcf6bcdac5c6ef1b4b0553935dec75db3aceed30971642eda2c27adbebb4bf02a2094dbab89a3d8b0cb36ed6668ba4c05a91d23f

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
448KB

MD5
8fcf479d1a798597f6ff19d58210c5e4

SHA1
6c712f068175fa74d3dd03a345c9295c2ace6886

SHA256
466ba2dd983ca60db1ca73c31e2e0db2ae0076ae1c20ec83dd3babf924d19f8d

SHA512
e582ef1fbb80d99f45a34a87fe63deb02cec0fcccd85fc8b343c23f86f090499a18b398d9c63beaa40fb2dcdf7e7b6671d64466dd762aee125c3793eea90b9f9

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
860KB

MD5
6d436d02ede0a50c6f61940d2e3fabaf

SHA1
e250c58d22eb70ce7d351327d5356b7713984d9c

SHA256
b1f9778232198ca370ea54f5e2d5e0ea1e16749f90b68350285a6c35495b167a

SHA512
96169e7c477fcda3d741d6341af38227567517eb4d6ee7138834c1e5de5ec5f034cf076d06200a307723bf533de0718d50c28e129eb5a6b7c174e5b0f01ebe75

Download Submit
C:\Windows\SysWOW64\Ogfcjm32.exe

Filesize
860KB

MD5
e0514385b864328b4c3e951b2d034492

SHA1
c527d45572201afac031fa5a2daafa8d25469a25

SHA256
3613aed18c77d93744a952de4e36fd25a16b842e81d98df75de857d325ff6a36

SHA512
c9aa77245c1e88b50dfbb4e8a897cb00de49fa816738a5a04d93aba9051fc69c8fec9fb8277e350b36ac48b5b17632e3b622b6236449281824af93cf0201f00e

Download Submit
C:\Windows\SysWOW64\Ogklelna.exe

Filesize
860KB

MD5
3d498572623028ab3a7f3b43ea9413fe

SHA1
95c01682f3eca7bcb9848e78dc99065df8ef0c1b

SHA256
8480a08d8389fffa48c1d0db1e53de3a0148d7562a38ffa469bc39c3b9b9bcdb

SHA512
e942b66ab66edc2e1aa8529051a5ecc0e23696b0fa36e4584be0b8f717c0349edec1f2cf7ae09f1006f6333684975926faa171137c4ea16edc89a4c979abc788

Download Submit
C:\Windows\SysWOW64\Ogklelna.exe

Filesize
384KB

MD5
17b8670f23e93079264622c85ee96401

SHA1
6c2d7ab45c18c5dbf5f27446e897b463e7678f25

SHA256
bde02b4dd8a8fe0fb86ccaa8808ff38112d3e32dd6a7f214e3892166b27dcead

SHA512
0eb70770d106dc6c05fc2af1137c5e3698a8d51d8335a2da880aa87238fc3f2cf6130dde004129a5ae4a03b9f6c22e953890387f00be48130503dd7556c97b61

Download Submit
C:\Windows\SysWOW64\Oidofh32.exe

Filesize
860KB

MD5
d8a660bf69fecf0c74f00f07e5c4be9e

SHA1
c36595d2fd20d15aac1fcb991121b51637d002bc

SHA256
1f2e54d3f2578f9fca3bd8462aee87c385a8c33f3a98c650bcd9796b79b00685

SHA512
9633a6134bc3e81ccff4c5bdf171b4ea89168fcd676a7e65ddf42ce39814e5321853ca42516c0ae06ea4ee2519136e7401b697655cf9cf92e6f7887840c5b9c8

Download Submit
C:\Windows\SysWOW64\Oidofh32.exe

Filesize
512KB

MD5
3b3bc98ec7209c8749dd117914d9f57a

SHA1
49273bb3718b276659b37eb7de19e38e824f5c0f

SHA256
a7bbeb847d8cb3f7adf5e5099d16b608b6095a06ba6fcf420073c70f41136d44

SHA512
dcb0654a39324a9a0567aad3c23e3f87485eac04b08f4736c4534f34aaf109e2b92a9b29934eec7eea07b041eb2613c5aea5f45cb5ad3149e8a4221a55606960

Download Submit
C:\Windows\SysWOW64\Ookjdn32.exe

Filesize
860KB

MD5
092c4fdc3a9137c8ef7967b06888753b

SHA1
1e00bb25a0484b04860dc4e733d8b63c1499a9d4

SHA256
5f36a1d22dbe27b54531560c70b9de8b0717741406ba5bab5fba93ff09bab3cc

SHA512
18d4e96e65a0e1a88530c7df1b2443e58cb830e5931308b26d65b11fb1b0d2c88aef7cfb0ae5c75ab91b44adb69686cae15af67c1239cb89e9361d442e8e66cc

Download Submit
C:\Windows\SysWOW64\Opadhb32.exe

Filesize
860KB

MD5
b4a8626f71bf23361047223c752bc5a3

SHA1
639b44417d0f4bb8a773be37853e328857053981

SHA256
7c02881bd7ce7e543a90197bacc60da0c08ef36ac88536dce9d5686b516b7692

SHA512
de8a0bc24a3571e9c5508968b35a4d7b28c1eef3327e1ef13afbeb3cf255668894e9b03f12980f4c9b9c33554d70bea2196eb723535d428637aa72c2737beafc

Download Submit
C:\Windows\SysWOW64\Opcqnb32.exe

Filesize
860KB

MD5
130712c1e810a2049086c2dfa3de2e7a

SHA1
e7b7ab4aa25aa63243fafcd805a3012dd83b0637

SHA256
59f46503cbd5dbd38c328836c70ac931e3dfc0054a52af1b0f100ed5524280cc

SHA512
9b3730dc58c95f342d349665ce58c548d597057328b239343e5f7b0e25526b14faa7e3c8de3d9e86a6c8dcf80f1eddf44afc5fa57d8d571696a52fba57af122c

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
860KB

MD5
b6b88d1f828bdf9ca00c1d92f84d98bc

SHA1
db09554326704ab9b7da428f7580f3e5fba322b3

SHA256
28b6381b490438fa9b525e94f0fe46f9603ce3e2eddffe52778afe6a7873366a

SHA512
23390ddc28a0c2ae8ebdb772e3c764c8aa5ece1dee9bc6392a5fd52cf8c34599d81da5e9ed637a38774d8070d5177faae5b967e57a48354d71a131f8061b309e

Download Submit
C:\Windows\SysWOW64\Opogbbig.exe

Filesize
860KB

MD5
0d7a7d1b6560bc61301fd3e1afcd4421

SHA1
e381e5624938c5222c88d60d6e8b9cd185e4c528

SHA256
e23210d42a35218d309357778cbc0e484ebb089a817235f58661db2692cbc8b1

SHA512
1346e5be0a043e2d8e35ae12faf0b05f3cc21330caf93894d421a71014211f146c71c62bebfc22bceeabd03cc216595cdfcc7a11fa12affa0e88dd590e14c5bb

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
860KB

MD5
53a53bdeb44f6d32e51c7e0947f4610c

SHA1
30cd208bd9237d29a57ec015e8bf0cbec4e262dc

SHA256
620973e5c45141c0810e4cd7c3a52b953cfd2330078de39d0d38b703505bcdaa

SHA512
5a2fd15d4afa126113b07de9af2de0349477513267456c7ee5754c6f267bb061c42effb2e6a6d4042715b8973d63f8c966efe4b46d86e3fa0aa36dc2e368e1e6

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
192KB

MD5
a61b90357b9b07e04caeef9f25a147c8

SHA1
851e09c32d1b548f5029714ca1f3490ce34dbe9a

SHA256
db642b3471e7f4864c6cb17b70d3a2d29f28534fd1f831c8e5dc0439e9cd68e0

SHA512
d0793251e83e6f97402b6242080bd6d058c29a1dd898dd4b0fbcb5ebd57bf823a88475d7fb0f9733f4e8df9c9328062587d52f689c75ccff01d3d91199784c31

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
860KB

MD5
adc8a814234ec7d176481909ee338b57

SHA1
60118655650b97bb190f3ce1e1a35e2ff1f163eb

SHA256
84cea8ad0e9670bc242f966414ebabb4abcf69ee3a7759204a73dbb97efe39ab

SHA512
e198035edcc0f200cbf74d0ae609903962e3b770759bdb2d9305376c27f241c6eb9c43187093a1ef3584f06e9be4a21982447108d59927dff1dbbeadb8446c3e

Download Submit
C:\Windows\SysWOW64\Pmcclm32.exe

Filesize
860KB

MD5
497e8e022ac77387ed99a1e68102fd6b

SHA1
8ab3d67df19c550fda216eb04df94b393108a31a

SHA256
790b76c6d54abdd637d91a0acf90ab21ca74bfb4242939e343a63bfdf90d8d9d

SHA512
4bd9b7919392192ded8e6c7542c59a4d41b963cc97b357d9dc0421929bfb37d5cab94df23dff9da397d59d00bd9643616312b2c14acb0cce05573fa658d01895

Download Submit
C:\Windows\SysWOW64\Pomgjn32.exe

Filesize
860KB

MD5
8b9e750f02ab5c83d3c2ee62d3f189c4

SHA1
5c280b84264bbec5729ca1339a2e3ad542235c56

SHA256
3bfba69980b913339d1797995e178af69c4891e733373061aa537768202cf51b

SHA512
77e5c9b99d73179495b1807b2a8e576cc9525be4daaab304c24b01fa94d0f1a4944fa110e42489da59981db78cc776ce88d261eddc8e7a68962cb3913a3fb1ea

Download Submit
memory/224-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/364-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/364-809-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1152-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1880-423-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2824-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2836-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2892-439-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2924-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-434-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3116-416-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3716-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-776-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4160-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4468-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4816-794-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4816-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-764-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5148-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5184-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5220-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5256-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5292-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5328-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5364-475-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5400-481-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5436-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5472-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5508-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5544-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5580-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5616-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5652-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5688-499-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5724-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5760-506-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5796-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads