7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe
Size

296KB
MD5

5d68c7392686d4c6066b7f40c03a249e
SHA1

964fabe4d17080cc6c8f39501b62bbf6b431d7fc
SHA256

7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc
SHA512

18b4e44e2c70d145d71625c7c2c868facd758be2a8c988201669e46ef50451bbee47e43ffea53257ed9298c84c550cbcaf5f85f61bfa3950690834d5a1d4730a
SSDEEP

3072:OWtfv0t3qeTxKheVdTz3QDhIARA1+6NhZ6P0c9fpxg6pg:TtXu35TxKhSF3QdONPKG6g

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nognnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohiemobf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efccmidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajggomog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjicdmmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffmfchle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbbpmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iajdgcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Milidebi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfldelik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oodcdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idghpmnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akqfkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahnhhod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohghgodi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jemfhacc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbddfmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nognnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbjmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojdnid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfqlfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnajppda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lplfcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qlmgopjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajqgidij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhniccb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enpmld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnegbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgelek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oobfob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npgmpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Finnef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Feoodn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkpjdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pocfpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khbiello.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agiamhdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paoollik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpcgpihi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foqkdp32.exe

Executes dropped EXE 64 IoCs

pid	Process
532	Fafkecel.exe
1824	Fkopnh32.exe
4680	Fchddejl.exe
4376	Fkciihgg.exe
2452	Gblngpbd.exe
1224	Hobkfd32.exe
3564	Hecmijim.exe
3896	Iicbehnq.exe
1184	Kfoafi32.exe
4476	Klljnp32.exe
2424	Kipkhdeq.exe
3664	Belebq32.exe
4228	Cfmajipb.exe
3748	Chmndlge.exe
2916	Caebma32.exe
1016	Chokikeb.exe
1512	Chagok32.exe
1896	Cdhhdlid.exe
688	Cnnlaehj.exe
3856	Dfiafg32.exe
2672	Dejacond.exe
4520	Dfknkg32.exe
4132	Daqbip32.exe
1128	Dodbbdbb.exe
3432	Daconoae.exe
3884	Dhmgki32.exe
3396	Dkkcge32.exe
548	Deagdn32.exe
2124	Edfdej32.exe
3552	Emaedo32.exe
2428	Edknqiho.exe
1924	Ehiffh32.exe
2468	Eemgplno.exe
448	Egnchd32.exe
4024	Fdbdah32.exe
4580	Fkllnbjc.exe
3688	Fafdkmap.exe
1012	Fgbmccpg.exe
4456	Fnmepn32.exe
2984	Fkqeib32.exe
4500	Fajnfl32.exe
4020	Fggfnc32.exe
3684	Fnaokmco.exe
2932	Fhgbhfbe.exe
2520	Foqkdp32.exe
2328	Gekcaj32.exe
4504	Gglpibgm.exe
2988	Gochjpho.exe
2224	Gdppbfff.exe
4744	Gkjhoq32.exe
3236	Gepmlimi.exe
1180	Ggqida32.exe
2464	Ggcfja32.exe
1856	Lhncdi32.exe
4756	Loglacfo.exe
3600	Leadnm32.exe
4560	Mhppji32.exe
5008	Mbedga32.exe
1876	Miomdk32.exe
4960	Molelb32.exe
2216	Mefmimif.exe
4072	Mlpeff32.exe
3944	Mbjnbqhp.exe
3964	Mhgfkg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jkhgmf32.exe	Jdnoplhh.exe
File created	C:\Windows\SysWOW64\Opcefi32.dll	Ogekbb32.exe
File opened for modification	C:\Windows\SysWOW64\Pdenmbkk.exe	Ppjbmc32.exe
File opened for modification	C:\Windows\SysWOW64\Pffgom32.exe	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Jcknij32.dll	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Hmhkgijk.dll	Mkadfj32.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Jhndljll.exe	Jnhpoamf.exe
File opened for modification	C:\Windows\SysWOW64\Kgiiiidd.exe	Klcekpdo.exe
File opened for modification	C:\Windows\SysWOW64\Bmggingc.exe	Bbaclegm.exe
File created	C:\Windows\SysWOW64\Fiebmc32.dll	Mahnhhod.exe
File created	C:\Windows\SysWOW64\Idahjg32.exe	Ingpmmgm.exe
File opened for modification	C:\Windows\SysWOW64\Kclgmq32.exe	Kmaopfjm.exe
File created	C:\Windows\SysWOW64\Eoideh32.exe	Efpomccg.exe
File created	C:\Windows\SysWOW64\Mjcngpjh.exe	Mmpmnl32.exe
File opened for modification	C:\Windows\SysWOW64\Kbddfmgl.exe	Kgopidgf.exe
File opened for modification	C:\Windows\SysWOW64\Nliaao32.exe	Nacmdf32.exe
File created	C:\Windows\SysWOW64\Oemefcap.exe	Oocmii32.exe
File opened for modification	C:\Windows\SysWOW64\Hdokdg32.exe	Hmechmip.exe
File opened for modification	C:\Windows\SysWOW64\Jdodkebj.exe	Jlhljhbg.exe
File created	C:\Windows\SysWOW64\Mgaokl32.exe	Mebcop32.exe
File created	C:\Windows\SysWOW64\Blciboie.dll	Paoollik.exe
File opened for modification	C:\Windows\SysWOW64\Qgpogili.exe	Qqffjo32.exe
File opened for modification	C:\Windows\SysWOW64\Ijfnmc32.exe	Idieem32.exe
File created	C:\Windows\SysWOW64\Kjpijpdg.exe	Kinmcg32.exe
File opened for modification	C:\Windows\SysWOW64\Dpgnjo32.exe	Dimenegi.exe
File opened for modification	C:\Windows\SysWOW64\Hplbickp.exe	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Aggegh32.exe	Agdhbi32.exe
File created	C:\Windows\SysWOW64\Dcdepb32.dll	Fdkpma32.exe
File created	C:\Windows\SysWOW64\Mhilfa32.exe	Malgcg32.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Goniok32.dll	Iajdgcab.exe
File created	C:\Windows\SysWOW64\Mledmg32.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Kipkhdeq.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Aaafckfg.dll	Edknqiho.exe
File created	C:\Windows\SysWOW64\Nnbnhedj.exe	Nlcalieg.exe
File created	C:\Windows\SysWOW64\Bmaioi32.dll	Dndnpf32.exe
File created	C:\Windows\SysWOW64\Omnjojpo.exe	Nceefd32.exe
File created	C:\Windows\SysWOW64\Lefqkm32.dll	Pgkelj32.exe
File created	C:\Windows\SysWOW64\Lccahg32.dll	Jnhidk32.exe
File created	C:\Windows\SysWOW64\Kqbdldnq.exe	Kdkdgchl.exe
File created	C:\Windows\SysWOW64\Oklfllgp.dll	Pddhbipj.exe
File created	C:\Windows\SysWOW64\Apnndj32.exe	Affikdfn.exe
File opened for modification	C:\Windows\SysWOW64\Lpjjmg32.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Knienl32.dll	Efjimhnh.exe
File created	C:\Windows\SysWOW64\Igigla32.exe	Ipoopgnf.exe
File created	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jklinohd.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Lacaea32.dll	Dnajppda.exe
File opened for modification	C:\Windows\SysWOW64\Fkopnh32.exe	Fafkecel.exe
File opened for modification	C:\Windows\SysWOW64\Mhilfa32.exe	Malgcg32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Apaadpng.exe
File created	C:\Windows\SysWOW64\Gedhfp32.dll	Gbiockdj.exe
File created	C:\Windows\SysWOW64\Aldclhie.dll	Bpedeiff.exe
File opened for modification	C:\Windows\SysWOW64\Moaogand.exe	Mhgfkg32.exe
File created	C:\Windows\SysWOW64\Kqbkfkal.exe	Kndojobi.exe
File created	C:\Windows\SysWOW64\Jjgchm32.exe	Igigla32.exe
File created	C:\Windows\SysWOW64\Klobfk32.dll	Ahqddk32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Cllhoapg.dll	Mhgfkg32.exe
File created	C:\Windows\SysWOW64\Alqjpi32.exe	Aomifecf.exe
File created	C:\Windows\SysWOW64\Gbmingjo.exe	Glcaambb.exe
File created	C:\Windows\SysWOW64\Hfjjlc32.dll	Fbpchb32.exe
File opened for modification	C:\Windows\SysWOW64\Fbgbnkfm.exe	Fohfbpgi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7524	8100	WerFault.exe	906

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdckomdh.dll"	Moaogand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjccdkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdifpa32.dll"	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqcjepfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aomifecf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akhcfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflonn32.dll"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eleepoob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcjppk32.dll"	Hnhghcki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjjpnlbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Cacckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbcolk32.dll"	Cmpjoloh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldldehjm.dll"	Hfaajnfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobhb32.dll"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lajagj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papambbb.dll"	Edplhjhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfamapjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgbfhmll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdihjfbe.dll"	7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fagjfflb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahgjejhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glengm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioqgiibk.dll"	Hdokdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkjiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffceip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epjajeqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcinna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djhimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijqmhnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjjpnlbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfendmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmqmbmdf.dll"	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpdcag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbohpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ihnkel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cioilg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bkjiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjcakafa.dll"	Legben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhncdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaqdae32.dll"	Jcphab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmbhgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Clgbmp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 532	5040	7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe	87
PID 5040 wrote to memory of 532	5040	7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe	87
PID 5040 wrote to memory of 532	5040	7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe	87
PID 532 wrote to memory of 1824	532	Fafkecel.exe	89
PID 532 wrote to memory of 1824	532	Fafkecel.exe	89
PID 532 wrote to memory of 1824	532	Fafkecel.exe	89
PID 1824 wrote to memory of 4680	1824	Fkopnh32.exe	90
PID 1824 wrote to memory of 4680	1824	Fkopnh32.exe	90
PID 1824 wrote to memory of 4680	1824	Fkopnh32.exe	90
PID 4680 wrote to memory of 4376	4680	Fchddejl.exe	91
PID 4680 wrote to memory of 4376	4680	Fchddejl.exe	91
PID 4680 wrote to memory of 4376	4680	Fchddejl.exe	91
PID 4376 wrote to memory of 2452	4376	Fkciihgg.exe	92
PID 4376 wrote to memory of 2452	4376	Fkciihgg.exe	92
PID 4376 wrote to memory of 2452	4376	Fkciihgg.exe	92
PID 2452 wrote to memory of 1224	2452	Gblngpbd.exe	93
PID 2452 wrote to memory of 1224	2452	Gblngpbd.exe	93
PID 2452 wrote to memory of 1224	2452	Gblngpbd.exe	93
PID 1224 wrote to memory of 3564	1224	Hobkfd32.exe	94
PID 1224 wrote to memory of 3564	1224	Hobkfd32.exe	94
PID 1224 wrote to memory of 3564	1224	Hobkfd32.exe	94
PID 3564 wrote to memory of 3896	3564	Hecmijim.exe	95
PID 3564 wrote to memory of 3896	3564	Hecmijim.exe	95
PID 3564 wrote to memory of 3896	3564	Hecmijim.exe	95
PID 3896 wrote to memory of 1184	3896	Iicbehnq.exe	97
PID 3896 wrote to memory of 1184	3896	Iicbehnq.exe	97
PID 3896 wrote to memory of 1184	3896	Iicbehnq.exe	97
PID 1184 wrote to memory of 4476	1184	Kfoafi32.exe	98
PID 1184 wrote to memory of 4476	1184	Kfoafi32.exe	98
PID 1184 wrote to memory of 4476	1184	Kfoafi32.exe	98
PID 4476 wrote to memory of 2424	4476	Klljnp32.exe	99
PID 4476 wrote to memory of 2424	4476	Klljnp32.exe	99
PID 4476 wrote to memory of 2424	4476	Klljnp32.exe	99
PID 2424 wrote to memory of 3664	2424	Kipkhdeq.exe	100
PID 2424 wrote to memory of 3664	2424	Kipkhdeq.exe	100
PID 2424 wrote to memory of 3664	2424	Kipkhdeq.exe	100
PID 3664 wrote to memory of 4228	3664	Belebq32.exe	101
PID 3664 wrote to memory of 4228	3664	Belebq32.exe	101
PID 3664 wrote to memory of 4228	3664	Belebq32.exe	101
PID 4228 wrote to memory of 3748	4228	Cfmajipb.exe	102
PID 4228 wrote to memory of 3748	4228	Cfmajipb.exe	102
PID 4228 wrote to memory of 3748	4228	Cfmajipb.exe	102
PID 3748 wrote to memory of 2916	3748	Chmndlge.exe	103
PID 3748 wrote to memory of 2916	3748	Chmndlge.exe	103
PID 3748 wrote to memory of 2916	3748	Chmndlge.exe	103
PID 2916 wrote to memory of 1016	2916	Caebma32.exe	104
PID 2916 wrote to memory of 1016	2916	Caebma32.exe	104
PID 2916 wrote to memory of 1016	2916	Caebma32.exe	104
PID 1016 wrote to memory of 1512	1016	Chokikeb.exe	105
PID 1016 wrote to memory of 1512	1016	Chokikeb.exe	105
PID 1016 wrote to memory of 1512	1016	Chokikeb.exe	105
PID 1512 wrote to memory of 1896	1512	Chagok32.exe	106
PID 1512 wrote to memory of 1896	1512	Chagok32.exe	106
PID 1512 wrote to memory of 1896	1512	Chagok32.exe	106
PID 1896 wrote to memory of 688	1896	Cdhhdlid.exe	107
PID 1896 wrote to memory of 688	1896	Cdhhdlid.exe	107
PID 1896 wrote to memory of 688	1896	Cdhhdlid.exe	107
PID 688 wrote to memory of 3856	688	Cnnlaehj.exe	108
PID 688 wrote to memory of 3856	688	Cnnlaehj.exe	108
PID 688 wrote to memory of 3856	688	Cnnlaehj.exe	108
PID 3856 wrote to memory of 2672	3856	Dfiafg32.exe	109
PID 3856 wrote to memory of 2672	3856	Dfiafg32.exe	109
PID 3856 wrote to memory of 2672	3856	Dfiafg32.exe	109
PID 2672 wrote to memory of 4520	2672	Dejacond.exe	110

C:\Users\Admin\AppData\Local\Temp\7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe
"C:\Users\Admin\AppData\Local\Temp\7b27919b9e772a1a1c26dd2b3f95d6e8ec1865b799904359e9a4550804c729cc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\Fafkecel.exe
  C:\Windows\system32\Fafkecel.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\Fkopnh32.exe
    C:\Windows\system32\Fkopnh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\SysWOW64\Fchddejl.exe
      C:\Windows\system32\Fchddejl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        23⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        26⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        28⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        29⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        30⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        31⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        33⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        34⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        35⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        36⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        37⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        38⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        39⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        40⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        41⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        42⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        43⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        44⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        45⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        47⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        48⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        49⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        50⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        51⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        52⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        53⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        54⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        56⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        57⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        58⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        59⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        60⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        62⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        63⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        64⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        66⤵
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        67⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        68⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        69⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        70⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        71⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        72⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        73⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        74⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        75⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        76⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        77⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        78⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        79⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        80⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        81⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        82⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        83⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        84⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        85⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        86⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        87⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        88⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        89⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        90⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        91⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        92⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        93⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        94⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        95⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        96⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        97⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        98⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        99⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        100⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        101⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        102⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        104⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        107⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        109⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        110⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        111⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        114⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        115⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        116⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        117⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        118⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        119⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        120⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        121⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        122⤵
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        123⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        124⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        125⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        126⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        127⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        128⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        129⤵
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        130⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        131⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        132⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        133⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        134⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        135⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        137⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        138⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        139⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        140⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        141⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        142⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        143⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        144⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        145⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        146⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6908
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        148⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        149⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        150⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        151⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        152⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        153⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        154⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        155⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        156⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        157⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        158⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        159⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        160⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        161⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        162⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        164⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        165⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        166⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        167⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        168⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        169⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        170⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        171⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        172⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        173⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        174⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        175⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        176⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        177⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        178⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        179⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        180⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        181⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        182⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        183⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        184⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        185⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        186⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        187⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        188⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        189⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        190⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        191⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        192⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        193⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        194⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        195⤵
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        198⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        199⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        200⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        201⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        202⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        203⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        204⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        206⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        208⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        209⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        211⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        212⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        213⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        214⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7484
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        216⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        217⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        218⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        219⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        220⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5032
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        222⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        223⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7908
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        225⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        226⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        228⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        229⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        230⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        231⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        232⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        233⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        234⤵
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        235⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        236⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        237⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        238⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        239⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        240⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        241⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        242⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        243⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        245⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        246⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        247⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        248⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        249⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        250⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        251⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        252⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        253⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        255⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        256⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        257⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        258⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        260⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        262⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        263⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        264⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        265⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        266⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        267⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        268⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        269⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        270⤵
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        271⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        272⤵
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        273⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        274⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        275⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        276⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        277⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        279⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        280⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        281⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        282⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        283⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        284⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        285⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        286⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        287⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        288⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        289⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        290⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        292⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        293⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        294⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        295⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        296⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        297⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        298⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        299⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        300⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        301⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        302⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        303⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        304⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        305⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        306⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8720
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        308⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        309⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        310⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        311⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        312⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        313⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        314⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        315⤵
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        316⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        317⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        318⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        319⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        321⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        322⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        324⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        325⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9508
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        327⤵
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        328⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        329⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        330⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        332⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        333⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        334⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        335⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        336⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        337⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        338⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        339⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        340⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        341⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        342⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        343⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        344⤵
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        345⤵
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        346⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        347⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        348⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        349⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        350⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        351⤵
        Modifies registry class
        
        PID:9744
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        352⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        353⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        354⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        355⤵
        Drops file in System32 directory
        
        PID:10024
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        356⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        357⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        358⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        359⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        360⤵
        Modifies registry class
        
        PID:9364
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        362⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9552
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        364⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        365⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        366⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        367⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        368⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        369⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        370⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        371⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        372⤵
        Drops file in System32 directory
        
        PID:9332
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        373⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        374⤵
        Drops file in System32 directory
        
        PID:9600
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        375⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        376⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        377⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        378⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        379⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        380⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        381⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        382⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        383⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        384⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        385⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        386⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        387⤵
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        388⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        389⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        390⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        391⤵
        
        PID:100
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        392⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        393⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        394⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        395⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        396⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        397⤵
        Modifies registry class
        
        PID:10324
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        398⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        399⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        400⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        401⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        402⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        403⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        404⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        405⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        406⤵
        Drops file in System32 directory
        
        PID:10712
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        407⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        408⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        409⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        410⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        411⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        412⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        413⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11056
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        415⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        416⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11176
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        418⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        419⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        420⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10404
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        422⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10520
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        424⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        425⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        426⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        427⤵
        Drops file in System32 directory
        
        PID:10808
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        428⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        429⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11004
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        431⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        432⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        433⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        434⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        435⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        437⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        438⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        439⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        440⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        441⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        442⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        443⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        444⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        445⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        446⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        447⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        448⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        449⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        450⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        451⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10696
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        453⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        454⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        455⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        456⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        457⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        458⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        459⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        460⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        461⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        462⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        463⤵
        Modifies registry class
        
        PID:11452
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        464⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        465⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        466⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        467⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        468⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        469⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        470⤵
        Modifies registry class
        
        PID:11760
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        471⤵
        Modifies registry class
        
        PID:11812
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11852
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        473⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11944
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        475⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        476⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        477⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        478⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        479⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        480⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        481⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        483⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        484⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        485⤵
        Modifies registry class
        
        PID:11464
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        486⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        487⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        488⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        489⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        490⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        491⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        492⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        493⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        494⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        495⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        497⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        498⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        499⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        500⤵
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        501⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        502⤵
        Modifies registry class
        
        PID:11864
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        503⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        505⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        506⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        507⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        508⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        509⤵
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        510⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        511⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11708
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        513⤵
        Modifies registry class
        
        PID:11800
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2876
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        515⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        516⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        517⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        518⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        519⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        520⤵
        Modifies registry class
        
        PID:11268
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        521⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        522⤵
        
        PID:332
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        523⤵
        Modifies registry class
        
        PID:11668
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        524⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        525⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        526⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        527⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        528⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        529⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        530⤵
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        531⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        532⤵
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        533⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        534⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        535⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        536⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        537⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        538⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        539⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        540⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        541⤵
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        542⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        543⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        544⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        545⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        546⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        547⤵
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        548⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1988
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        551⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        552⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        553⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2720
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        555⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        556⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        557⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        558⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        559⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        560⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        561⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12336
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12376
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        564⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        565⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        566⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        567⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        568⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        569⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        570⤵
        Drops file in System32 directory
        
        PID:12720
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        571⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        572⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        573⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        574⤵
        Modifies registry class
        
        PID:12864
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        575⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        576⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        577⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13012
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        579⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13048
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        580⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        581⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        582⤵
        Drops file in System32 directory
        
        PID:13188
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        583⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        584⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        585⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12432
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12488
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        588⤵
        Drops file in System32 directory
        
        PID:12664
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        589⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        590⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        591⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        592⤵
        Drops file in System32 directory
        
        PID:12964
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        593⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        594⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        595⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        596⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        597⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        598⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        599⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        600⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        601⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        602⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        603⤵
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        604⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        605⤵
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        606⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        607⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        608⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        609⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        610⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        611⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        612⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        613⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        614⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        615⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        616⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        617⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        618⤵
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        619⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        620⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        621⤵
        Drops file in System32 directory
        
        PID:3944
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        622⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        623⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        624⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        625⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        626⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        627⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        628⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        629⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        630⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        631⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        632⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        633⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        634⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        635⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        636⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        637⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        638⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        639⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        640⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        641⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        642⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        643⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        644⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        645⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        646⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        647⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        648⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        649⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        650⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        651⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        652⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        653⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        654⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        655⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        656⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        657⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        658⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        659⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        661⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        662⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        663⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        664⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        665⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        666⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        667⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        668⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        669⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        670⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        671⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        672⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        673⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        674⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        675⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        676⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        677⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        678⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        679⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        680⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        681⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        682⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        683⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        684⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        685⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        686⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        687⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        688⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        689⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        690⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        691⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        692⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        693⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        694⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        695⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        696⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        697⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        698⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        699⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6180
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        701⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        702⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        703⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        704⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        705⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        706⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        707⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        708⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        709⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        710⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        711⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        712⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        713⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        715⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        716⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        717⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        718⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        719⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        720⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        721⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        722⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        723⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        724⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        725⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        726⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        727⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        728⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        729⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        730⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        731⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        732⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        733⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        734⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        735⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        736⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        737⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        738⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        739⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        740⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        741⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        742⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        743⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        744⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        745⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        746⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        747⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        748⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        749⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        750⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        751⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        752⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        753⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        754⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        755⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        756⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        757⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        758⤵
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        759⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        760⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        761⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        762⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        763⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        764⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        765⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        766⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        767⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        768⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        769⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        770⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        771⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        772⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        773⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        774⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        775⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        776⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        777⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        778⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        779⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        780⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        781⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        782⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        783⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        784⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        785⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        786⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        787⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        788⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        789⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        790⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        791⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        792⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        793⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        794⤵
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        795⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        796⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        797⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        798⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        799⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        800⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        801⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        802⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        803⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        804⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        805⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        806⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        807⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        808⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8100 -s 420
        809⤵
        Program crash
        
        PID:7524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8100 -ip 8100
1⤵
PID:9140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:7896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adfnofpd.exe

Filesize
296KB

MD5
0a896e2ce68f889efb6a9e99d9f30bef

SHA1
bc4b4aedfb1595219797544a3c1eec08afc85d53

SHA256
4764810be98fc035b453aae81f2c62ecc60aa285462c078940a97ad469433015

SHA512
9ac5da4df30bedee7e95620a0cf953be8fa37898f313fee085380848be1ce2fbd00e76d6cc66ad6e78228f71533ceac64637c15f9f4a080e33088c0136c7a08e

Download Submit
C:\Windows\SysWOW64\Bckkca32.exe

Filesize
296KB

MD5
43f83dc1acee6386defc048c78187702

SHA1
fe9dd6ef4f2c82122edb2e9ae118db24213d3873

SHA256
e8406bbaf232479033fabd34ac2c0a39e6166abf2d82e649f5e81078ae02a61c

SHA512
2e5d7ad7396846b2dce6242913a580eef4b0031b001facb6a187975d13f5604c061236f1fca48f1c73b882a53283510b34727af51d9d5b435ea62f7fb225c8fc

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
296KB

MD5
942a36e5d8ad826f7b8034e03866b493

SHA1
77cd3731371b852774d274be18837d87459cd72c

SHA256
9417494dccd738ab16fe0bebb088836c7aef5f8d2cce77963363347ee77347de

SHA512
5e4d13ebed4121a89bf2351fc806e9e6048c388ce2745c5ca6f8623ae9f5e88ad6e602239accae25ad3168976be6203df95d5377484f0041d34c065e85f08ce0

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
296KB

MD5
0d7c53f46dc532e27e7d7a729cf4a27f

SHA1
9ad73a6a1cf744ff3de4f5775c5415b97fd6b005

SHA256
b1c39792c9426985803fd46c36917c9dde914bab130a3184f4ed720e39c4377d

SHA512
cf951effeb6e89463c5096e6a424edcd0adfe5022e6b1d2828dbfabc5d3b766c94082f268c6ff8dee08eb47a05eb343807506b6159439bd274f1be32e0cb6d5b

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
296KB

MD5
7264a07f69a9c43e6131036e02218123

SHA1
d363f8a1d36b78e65dd44422c80dd124a4694c47

SHA256
85fd5b482edd96075b3f18a52dcee55f221ece581d04bdc402d77abdf82e73af

SHA512
34baadafe96dea10cbe5520d5e7d14b7de2c3321a18408bf5a734d4364e031addb5b603e0c75b87f7566cd2a2681d44a3160f4446c6c0a2dd660f88354a3dcda

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
296KB

MD5
f477f99f7b1429a3a7e0be47a27625c7

SHA1
9a25077f0f82e508b33f9ac5aeb2589b4681c38d

SHA256
88162071e4411a5ea18d6f8f28fe13f6f26b1e0ab4707476713add75619b1b26

SHA512
d63e335f1bf55401308367000c1ce63377dc8f7a82a603ccc0569d79f8faa6a04bf66b263899b8d456f3c6551b8903afe6f6520f3cb1136d6e1ea38d6e8a973d

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
296KB

MD5
de127a1189cfa97c9a7ae51c25bfe874

SHA1
55a4190103a563029a009fb642a7d7f1ef4d6054

SHA256
54457c3f63cca3fbce04365589b6954f294e307a58139e4926d8823fb11d225f

SHA512
a952ef4a040071da804bc3449fe0c3c264b4cc5da9c24f56f4bf4c32ce19323d86df496e3b82ca3ea3dccb7180e7e63cb48cddc60328284b3d0c14ff292682f9

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
296KB

MD5
f5a30867b8fe48b32b9cd0c2c751d8a0

SHA1
08489699c65741623e843095f5335f3201178173

SHA256
5a332522509ab1e3e02bbce73831f01eea9b14939c2cf2607250db55a343d027

SHA512
1b3af6f9eba7f6b2ec1415710090f97e9e66fedadf7904895f08d6102362af7ea1b1f1e00ff5a82131b98a4f2b7352f16952f7f4948956101341f66b72d8c325

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
296KB

MD5
e03be0ac32f401f0a26bd48f98d806cc

SHA1
626d094d5c67efb6f2f04f1776b0af1e4abc39b6

SHA256
59d8a1304676088e4fe06a901b2e13d9331fee98bdf17efb076c27fcb2033677

SHA512
8434213846c8e3281a74528c3d15a5e345c1f3630ac1999d2a03c94b705598dafe60d38b8d2c9b885edadb74f8724221f514046b580bff82af9f81c1a35896eb

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
296KB

MD5
2ac28a37ccf48ed53739330cbaec4641

SHA1
c98e15d101964012eb8b2fb3dfd8afb2fc9ad010

SHA256
9e799a2e6ddeae162aceebbc0d9b2a7379c32e70de690e413782a385cf34facc

SHA512
845bdac01d0a87dd9cc4c893805c310e2d401d9be995616baa1908a993812c2dd384ec4c50b097d22b36d7cb6369c92ce60a2f1b4e25504bc4128adc1233b1b1

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
296KB

MD5
febb50dedbf4f0dc8dbc51e1e640fd77

SHA1
eeff263a8c76e2164e594c6bb847aedda2c1a5ff

SHA256
e7c544b7fd79ac17b88a4c5dfed885ce4e84322e43e3df2d4c1bdd33748e46db

SHA512
825603dd7a50337ec057dc3bbfc0238578fcd3a7d1b9fc319b0ea79a7e2d584913976d69fdf96646cf91739794624a711d25d23de18d6504a2006a99fffae085

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
296KB

MD5
d502b8d79bf12a4bd73fef5b4a670d62

SHA1
da981b74f60424641734d724124663252b00b1a1

SHA256
122424d699140498dcd23bbebd697247935faf437d7f46704dda780f85e30f79

SHA512
c68101ff8a488f6e4eaced2b6b019227e3520813a2c8d4467f0c4516875acbf21674716af30f73afefb5109af16a17be671ee1eb0176059d322e2638c7c16e27

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
296KB

MD5
1d12345fb63a7fe40159e197d8cd4e66

SHA1
3a026f96e9fb85c86a7289fecf234ae4ba21696b

SHA256
91090ca207fca66d3436f2360d079f4305dd5c93b5fb3d2452c51cb7fb303503

SHA512
249aea7a961e201d8f0c9533b4580bef81cc0afd7a324d0c805ed2b319c6aad35812739b9824dcd3fc1236f7bca10365fe2e9f698a8642a30c05ac5b20b7365f

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
296KB

MD5
b4c0b8e747b5a74e060e96bb897ec052

SHA1
0f9172bd9dd3645ec6dd1d60c19cf5576adf24cc

SHA256
4e133b9449ff9964affdb1e5f49ba4dedfa0f896ac7ea85d64d8c617818a8b10

SHA512
96000e0cf8e9dd5770c43224c3157d3d61b9b43640c929cdbc2965893f39cc0829ecbe31f74baaf09170fc6f95b515eb4dedf601aaeb5b41528579bd089e4a4a

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
296KB

MD5
49e646f73bc4853a76d8802e66519f37

SHA1
302c8934be2a17821a7169f60c4c89fbf80c5f5a

SHA256
208a672477352bf81f8cc009eeda335a569b3468722a13e2232c7b793541e919

SHA512
254f367a06d6452052428eb36a3044aad1d95e72fef3f65bcb63d478a28427a449e5d1d4fca2f034bdb8164123f859ed2fa9487b55da08701ff40edd86bd6524

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
296KB

MD5
b2ddfd6452ad8159540ea405663d7969

SHA1
ae16403a326619466f3bf2cfa2e7132cb8ddcb54

SHA256
5c378c2a51f5fc23f267f7606b39fce09aaee4cf2ad955cb268fff875968a6a2

SHA512
d13a45dc937e53e341b88774c0c7a82f7782e57f18a0405309b9ad27df48f5f4a4dddc8b90b218fe7b84764c57ddd353e93d0162678e71fc805444c5e008ab2b

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
296KB

MD5
9e98a17b19eb58606fec1288a9c79cf3

SHA1
57ee0a3c21aad8f1320e86aba8cab44eb6a94ca9

SHA256
da73ba9804ec23aebbd847b547479732e4ddaad5d3da8e51c75dd67091368ce3

SHA512
8a9a7c741b5b9ee5f6fedc88c12631de93f71b6038f8a42e1dddab558c22c1faee43acf60eeb92cb2a4e71357eeb7bb27c781a17f842578f9911a1492c76f9af

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
296KB

MD5
e9cd5da4d281431d54a0845a862a7bcf

SHA1
b16b24f9b930a689629ba0208e99474da39c488e

SHA256
d9af7e7c950e8ac3f152acc518b9e72759de2b54590ddc4596376104c1bcb578

SHA512
299734c39064ff8797b039374d15f6e23b558287725b9fd00588d897e24501c750eb1c9605f0d7c404dd29392ec1cb463fe702927aeb437bec6045ca173e4791

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
296KB

MD5
d19d832d2f4ad64c9c5c22e67526f2ac

SHA1
2733f2375c8b33abb07d520e84e4a56fe9e63381

SHA256
9865f6d2f3909e9eba23fb780a2d16b8b0d5e0796e77d0c0da45ecd5200033e5

SHA512
4e62eeb91b57c34de444314b3bc3223bea303200616a7d16cba7d8bf55cd2e65df52c13a86481372e862c485e34db4453d68447940dc51be614a715e33e838fe

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
296KB

MD5
8afab1beeee9b417f73930752066656b

SHA1
5f75aff6126595a2a217785f0c4768509522e5f5

SHA256
96870b8e3a73258b427634098bfce4d9c08527f94a90251f5b0b3d166e1b0b18

SHA512
7626618e75d373ff09e0a7fe06c95549bc078e8bc8c60185075c031caa297889389478ea3d1afa7c6d5c69e8b37351b58990c829cfedb68a6ffcb33fa48b93ab

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
296KB

MD5
d377019ed3d738c749995dc3eb710121

SHA1
28c8688d8b6cd7ca79fb9b5336356f178c2b3bfd

SHA256
437c5d72234978689acb4754be2c24d5091d6df509c37462596bcbd230329c01

SHA512
77946995195d5d871fba3791b51341df247bf6f11b26b02ed760713198890a95a67b49b7004fbcfa8763c0e9a971a44841c5914e31ad932005882558f3348ccb

Download Submit
C:\Windows\SysWOW64\Ealkjh32.exe

Filesize
296KB

MD5
0edf6b00fe8b69d9c5747eb0f821ff11

SHA1
a308ba5f32f4dc27dd091d3f25153f2934101350

SHA256
a5ab64ef20d6bb47ea60ee6cb282d2f2981c0a9982a643661013ca14a02cedab

SHA512
31064c76aaef4c7f14f2acfd701d910da27f72af3f022ba02a9a0d174ad5b84233ca4bd48c1ff5dcd723f4a409ab51422a565bb48c1ec2e1cd44954bb33dd025

Download Submit
C:\Windows\SysWOW64\Edfdej32.exe

Filesize
296KB

MD5
565b6aedbe09410ba5baced82cba42cf

SHA1
30d20d7bef300657335194b84e6edde0a0d0d36d

SHA256
6b2339a227e75441a1c1370013d9bd0f9ddb15f40c0995198950828b401c695f

SHA512
0b7d7282bbf8374109cb36cb571014d6c1bb7a89601bbaa6e1c33540bb02b8d7460abda56c5fc8f5a2730be649311449243c4019f6510edb1556667ad03b479d

Download Submit
C:\Windows\SysWOW64\Edknqiho.exe

Filesize
296KB

MD5
bac18c75758314aca98e502a50e9abd2

SHA1
2dae643945a6df22b10434423d4d697d279de4d0

SHA256
b4e6fd24e1acc30eb6e34303276234d4c0ef9b1d0baf701ae87fa7d461bec804

SHA512
6f48acb719dfa0d0c0f01ab9a49b3e5e9f334312c02a70bac6e079b7b1180e6c597181c86c54047cd5cef0ae0889c89f2974c667de98ecac233c80b4902f7053

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
296KB

MD5
3ea3bbb07e1b34c6a728dd1ae4183ed2

SHA1
d1a611009211592d5127a4971bcf42f828e682ca

SHA256
66772855a5298f815c7e1175526b337a7b23e71a4547144de5f8fa2be626c909

SHA512
95b8dff909803dc4aa20929b18509615ca5c3c0d574942241150bfb6ffd48f9b34e8858aa822865b0ea2c0d234c70acd41da6b9269f9d72b00d0b21f3408c4a0

Download Submit
C:\Windows\SysWOW64\Emaedo32.exe

Filesize
296KB

MD5
3d5c973004126fd3660d8b5906a83070

SHA1
42ea7dee032b97c115026c06e671623da724b68c

SHA256
032568a0ceb804a4ccfe8e18aa4e38b1d61b123fb86145a1b39576011e664621

SHA512
3846de368d2f74615def49fcea5468cf7ea48cd3868c27565f15c09a1fad82c0ac6f335733d7768f40d12b22f2aa3e7860f36116a708bcd7d8b062cb8b7b3a27

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
64KB

MD5
e531471f783697467b0df4af6d7cef4d

SHA1
9fe60c74995c44f2222c04f950d105bfe3537070

SHA256
9265d2ad42f9708a7c6f368a890bfff5f9e8d0823fe6b7a7238d229b380ae995

SHA512
e1e5eb7b5cf85a86b4ace4d18345412430cc64fac19ffd2bed171ced97f108540ec014922ed0de663f9c42b6baaa2932e4580fed6a0430da8ee6e82a29d60b06

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
296KB

MD5
aa17d8504dd6ff020d8202d2976a2288

SHA1
e001c8e8f0aefa494b18a75ba3e9d107c5724321

SHA256
adf3997003e3cb51cf92379a263abf7490136e545eee9efc696b764f6b95bb81

SHA512
0d6609766cb14eb6b29accd39b43981d64049aed26c3da334a3da778f28047866b6ae0e034f088f3b2be152e486fdbaf761d50c86664cb83f633835651a355df

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
296KB

MD5
7cb41bfad7231d60051aacb8fd62bf5b

SHA1
a5ae231450417fbe75f832c8874aa69762d34303

SHA256
4371f1587eff52e699fec4866ce1e0f206ee4d8ee962935e53b5380760e7cdfb

SHA512
e66ecafb04623873a29544739d9889709453febb922a1795d5c4c4d38320522702d50fba8c915d046efffc4759242704a33cae23ec390ca8b7de280ec11389a7

Download Submit
C:\Windows\SysWOW64\Fkciihgg.exe

Filesize
296KB

MD5
02a7116a3e71eebf55aebe3500a8b81b

SHA1
46bb780290083c75a814393f74c0cc2d1d07635f

SHA256
5674f32dda8df276e192aade76cf55e2ec64213a79eb5af578c951845a1cb956

SHA512
373b5176dfc58399826677ab0a07f15ca71f314b3a3a6af6481448d7ce2d4f1b9de9f182ecef6a39cb1adeffecbe40bc2132207eb1d2c0efde461728794a4e7d

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
296KB

MD5
22ce6e1b079f400a5f00613f44284d3f

SHA1
cddd3a2eab4d58eb365cc2bb54c99f9c433d9f08

SHA256
69f9695c9f4b20f34a83150c2c792c341205cc0a39ad18092c1db577e45424ea

SHA512
f6555c324505f8a0a4b84fe8cf5dfc123244d4eb6ad1632ecba1a9ec6dff644b644df1ef7c3fdabe593564a53d3a25c646e5f4ec010ceb0e204e61b928bab334

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
296KB

MD5
0dc9a2f3af28b8fe2e820d0e342dd773

SHA1
3041e7b313587d64da1d3fa875c49fef4c977d45

SHA256
e351e3fb682589150a1a02c4c085d17873f8f52a17769e51d2d1990ee3f70bda

SHA512
11831fd968a0b6795b41bbe049f27768c73fc7bfe37e5232a4ce320109ee032390aca9e858a1ca9c994816f05f5977ad43048e9be6520b0ea53414b2001e66a0

Download Submit
C:\Windows\SysWOW64\Gdafnpqh.exe

Filesize
296KB

MD5
841494ca17805ffa1c54b88914b8a3f6

SHA1
3118cfcabf6e87eea7b96fe988f710b93aa72fd2

SHA256
ebb17efadc8a569853d8b7e4e669c6669b9cab68a7746043517e56622c94dc12

SHA512
f766142f1ae1760be159bb5fc2fc8be52c9c42d2ffbb9eb1fa9ca6e78eeadf0a83d1d652f7d94e8df67ba3b81f90982ae2c07bb705077e42925286be2cc9acac

Download Submit
C:\Windows\SysWOW64\Ggcfja32.exe

Filesize
296KB

MD5
c5b7bc172714b646cd74473ecf46399b

SHA1
d76059432583abbfce461ada640674d2313e50f1

SHA256
ddda639a16ad6964471223a98f85b1b2d28b94eede9e6354c6d6c8316a73cac5

SHA512
5bb2533235bd359f970c47274ce47f4bc84fefe59759d70cf28589566be5596be6f2ddfc713390cf3f78939098a74bc4b54f192ce975ef799e76542f35f96a55

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
296KB

MD5
40caa3762c66a6b69b8d852ef499b49e

SHA1
06320afaec0c53613e1dc303dcd4d7769150ab04

SHA256
5c46d51f30b6f04f7d6b48aabfb7a86119cb8666409889fbdbd2fdfdc5b4409a

SHA512
c49126165e6d9ab3af56fcdcb9d2debb7257333d13ede9d816d2f10ffcf65b3230d263d77ce5608c3e131768419aa05d08c2b067f453af0f91df2cddf2452820

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
296KB

MD5
3a278a6dba248de624d6e2e270041312

SHA1
27fb72a0150165c2865819dd85cf12368bc07539

SHA256
d34a99b6ff1a518484d4212dc705df07f1b205755937755e96b416dab6395bfb

SHA512
f2094f5b2b338162d730703e727fd46ccbb4537868130537bf4765a91e1bb53cf816cac2b6ff273f6f1d642266cf4b38a22ba3f1846e715968b13b1ef84bc284

Download Submit
C:\Windows\SysWOW64\Hpomcp32.exe

Filesize
296KB

MD5
e28332127553b181b645c32df0a4d7a2

SHA1
a433c1947b2bd6fc622333a877819fee087fc315

SHA256
6065c963cdb0055d5b695e98c20618d9390133bbe20864797ba3ff5f3151d90f

SHA512
56781b377355042c1b74f2dc41d5bea2fce788c9a971c0609debd6ebced43bb97114b5c32a830ebb9efd5daf68cbfe2550cf88df4c727a1537358a27e038c7c2

Download Submit
C:\Windows\SysWOW64\Idahjg32.exe

Filesize
296KB

MD5
ee8c6e13124e8d5a616d9a5fa414a0b5

SHA1
266e873a056cb36a34599567e4b110f680d4184e

SHA256
529409ff895cfe456cf93434c885cd628bce12b9cc88d49e87688ed599b3b4a4

SHA512
99af19006383981f581a1d8e43ad6da0d27df90fe389a6384d6ff2142f5c645f10cf9deb6a0faeabb2728a7ccb68264ead5b4346824da46243b3f12442f641f8

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
296KB

MD5
3402a342314166a08c779cf8c04801c8

SHA1
9c4610340512b9ce0d50930f127762fc5b2ea7b9

SHA256
47a4ac5926d2857333d54544207300c21df84f116736eabd5692a0925e0e83bc

SHA512
3ddf1c7b8be5acc016fa5e16df7389a3ba731bb1375363a567a2dd02bd1eb6774bc46ba5902330babf4eec55f90da4367bb1cec179906b8789cec1bb59d20e8d

Download Submit
C:\Windows\SysWOW64\Jmnoof32.dll

Filesize
7KB

MD5
9a758104fee3430c45df43af4dbbb072

SHA1
1b3615c47d9c94f7ab6c9060e20533254faec4de

SHA256
ed70154e498c247b8ae18517d63f9b7536905f6178f67341f61c4e512144a05f

SHA512
be167a7636611a3dbf83ab4b76920255d789f70959347cfacc8739604dd044c0b99f47b1d309894f095fe892522a94660fe651aef7bdcf827edcb713bbfed108

Download Submit
C:\Windows\SysWOW64\Kclgmq32.exe

Filesize
296KB

MD5
486c567b0b13e20cb8c6c6b108adb327

SHA1
1b77ce376b995249be0b220741a81c52192bd7af

SHA256
a38dde3a6d38580c7a84c37ea57a7ab12e84a33051a16ee6624caf4a51424e64

SHA512
5a70f3809570c1ff5c54390f32eeabd5198fcddb382ffdcdc5cbc9faeb25f534600ef4375e93f634ffcea8038c1a15a73384aacbec4f779573872fd64f11f2c2

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
296KB

MD5
08a34ff8185f8ae85dbf7f67b6c42a0a

SHA1
0fc46ba38c24cd8c72b01bb96ea60ddd20ec8a16

SHA256
eb2ef3fcca21e915c03a8249212ffd2f1486929f260021f250b479f52cc4744e

SHA512
eed534b593cfdfe38800149f7e4a17d22aff3d6846b08647f01c893e6cba2e0c1cf6deee2d41a668ef21f866a8bda10dcb91adc7826b8500d42b2c8b87df055b

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
296KB

MD5
05db2fec6ad91ca39c424a0f62eb842a

SHA1
226eabd6b49cc5b4e8b71d70fbee2cee1c9a85ef

SHA256
9f45909295786a348ff6ce02e747c50cc8f3560f66f46de6c21590f174f2721a

SHA512
d83c5c0a77ae54111e531b71de258fc681554a9ed4d69b0859475b5d9cba960bb382081632b23dc882a30de624255a80056bea84458728ff8a0fb22185e8bb63

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
296KB

MD5
6b0c97789c37fbdbd9c991fe890b30c5

SHA1
40e246af77fc9429dc49c12cad6827237b6fabcc

SHA256
a4a48303fb0f8d8ba4f5f81ab3c82d31cd395e26c6293faead8e40f8ed4fa8bd

SHA512
5a5e2b8f2759492465871c886c0a796cccf2432602bad43bd99da0ad51105b2656c780fec87f6fefd992ad2337b9c0943ddbbd4784f94c48e43bf3edfb99f62f

Download Submit
C:\Windows\SysWOW64\Lnnbqnjn.exe

Filesize
296KB

MD5
8fe6207ef2e928798a4a003d25fbd93c

SHA1
6150156afaa72221e2e78808e18058c18dc0ca21

SHA256
76f5c8919e807de5bea15a52bb617c29042ba8e086f5c2848dc3606272e324f0

SHA512
b95d2f4530cbf9738aef8540317278284c52167e1e72693747fd940c4403bf9ce3e8df37d6ca24249179837a48aa029b1f4403ce4f9edbb71ec3cd54da18266a

Download Submit
C:\Windows\SysWOW64\Maiccajf.exe

Filesize
296KB

MD5
5789bd97ab4606ebe5e52f8aabeb2d76

SHA1
6c3ca0f419cc9264c365b648bd2c19368561e171

SHA256
7167ece15bf0619406be410c0ea7fb92ab48923902258d3f065a2bc15d6f64fe

SHA512
1a16e8ccf297bb1fca64737b5685f484dd008f09c28312bc3968049718c294eb7315d153bedb78137362c6937f8c06dbdcfc4ca9face5caf12e919a144d3e1b2

Download Submit
C:\Windows\SysWOW64\Paoollik.exe

Filesize
296KB

MD5
e3aedb53bf497128590c847c620925a8

SHA1
c8ac293ba539ee7c08ba7f96c84f19aaa0fd91b8

SHA256
75594b0fa2042ab83dc996c62b952bb4e82dbf4a89bdfb1ed56f25ad10537e95

SHA512
64bce08a798ba627c395c4f9dd5e21da8c7558eacd8b6ad8182f637c6f973169049663b56ceea2669c77c9db30f4c78fcdf990f3de38b44f148dd696521e7eb0

Download Submit
C:\Windows\SysWOW64\Ploknb32.exe

Filesize
296KB

MD5
995b952980d4f0dae32726b688935274

SHA1
a34b9168e8121b14267bbe29f969cfd64a9dd526

SHA256
e51dc93083f4e01e1f134379c0688627bd54240d2aa87d8cda1f15955ee1aa19

SHA512
75a16a1961da96a295c4c93d1277d538d4a5895850285151d5325bb4b88cf3bb14fcbf897b736f0886a1507fde8b0ee3de661298a4fc7cac08aae94e692546ca

Download Submit
C:\Windows\SysWOW64\Pocfpf32.exe

Filesize
296KB

MD5
2bf175e43a85ff5d6274566f806fba8c

SHA1
b3995055a69ee65c93d8997d2a235a1c3db71a13

SHA256
deb65746a6711c64c97bf0d3c49f7f5c054aa706eaa85527057c67a6174f00d9

SHA512
af788af4374d43b0374a410aa6f7bfb5daae77bb4fec6fdeb064cd1598e4fb9d033b407bcf80e99cce845f0b36b1d190008439021b788dbcc2de4b1632f6147c

Download Submit
memory/448-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/532-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/532-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/688-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1016-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1128-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1224-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1224-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1856-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1876-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1924-257-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2124-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2216-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2424-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2424-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2428-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2452-385-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2452-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2464-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2520-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2672-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2932-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-308-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3432-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3600-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3684-326-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3748-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3856-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3884-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3896-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3896-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3944-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4020-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4024-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4072-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4132-195-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4228-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4456-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4500-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4520-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4560-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4580-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4680-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4680-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4756-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4960-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads