0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe
Size

90KB
MD5

e98c9c16d64fd12f7e9a4b56223f0bde
SHA1

07135fb355081c972ef50d2c7e68009763028ffa
SHA256

0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea
SHA512

e245341c55fb8fa5a3968cc7f20ff3b6d14a578235e6f823a34fcb3730a36d03e06624b70adaf70a9e7c4af87425f97cbd8e369ab54c52a163bec0e3f1eaf82e
SSDEEP

1536:CdzNkzxdtIYBUH/sAuePxyFdgKOn/8eiXZcanaGvu/Ub0VkVNK:JnubHmuad1O/RGvu/Ub0+NK

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngipjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akipic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ablahjhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqakln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfaaebnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqlbqlmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dekapfke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glbapoqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peodcmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfodpbpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeaidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emgblc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mihikgod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jafaem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ickcaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apcead32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahkffqdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpijgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ongijo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jacnegep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnjhhpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddnmeejo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nepgcgje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fklcbocl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgdef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glinjqhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbgafqla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjkgkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbgljf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ondleo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Malefbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apcead32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odbgbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhikci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plgpjhnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhkgnkoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mihikgod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khimhefk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbmfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beqljn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lehhqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefmgogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqhpjohb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkajnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmodfqhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npfchkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhonpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpijgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giokid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnnmogae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbefkjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbgkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bbgiibja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfpkhjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eoocfegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjnjjlog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgalelin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iljpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdaonmdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhpjbgne.exe

Executes dropped EXE 64 IoCs

pid	Process
4440	Nopfpgip.exe
4272	Nadleilm.exe
3536	Nnhmnn32.exe
5032	Oplfkeob.exe
4612	Opeiadfg.exe
456	Pmnbfhal.exe
4684	Qodeajbg.exe
1728	Adfgdpmi.exe
4656	Bobabg32.exe
1500	Bdojjo32.exe
4712	Baegibae.exe
2320	Bpkdjofm.exe
1912	Cdimqm32.exe
3056	Caojpaij.exe
4340	Ckgohf32.exe
1988	Dpiplm32.exe
4044	Ddkbmj32.exe
2588	Dhikci32.exe
2240	Edplhjhi.exe
4784	Ekonpckp.exe
4996	Foapaa32.exe
4940	Fkhpfbce.exe
1644	Fqgedh32.exe
2820	Gghdaa32.exe
1144	Geoapenf.exe
2660	Gngeik32.exe
1044	Iacngdgj.exe
1416	Ibgdlg32.exe
2924	Jhgiim32.exe
4620	Jihbip32.exe
2304	Joekag32.exe
4192	Jllhpkfk.exe
3504	Kibeoo32.exe
832	Kapfiqoj.exe
3676	Klggli32.exe
776	Lohqnd32.exe
4144	Ledepn32.exe
1928	Ljbnfleo.exe
1268	Lhgkgijg.exe
2260	Mofmobmo.exe
4860	Mlljnf32.exe
3220	Nfgklkoc.exe
4516	Nmcpoedn.exe
1788	Nimmifgo.exe
4252	Nqfbpb32.exe
5140	Omopjcjp.exe
5188	Oihmedma.exe
5232	Ocnabm32.exe
5272	Pqbala32.exe
5312	Padnaq32.exe
5352	Pbhgoh32.exe
5400	Piapkbeg.exe
5448	Pidlqb32.exe
5504	Afockelf.exe
5544	Aaiqcnhg.exe
5588	Apnndj32.exe
5640	Bpqjjjjl.exe
5700	Bbfmgd32.exe
5744	Cienon32.exe
5788	Cmedjl32.exe
5828	Cildom32.exe
5868	Ddcebe32.exe
5908	Dggkipii.exe
5952	Dalofi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kkmijf32.exe	Kfpqap32.exe
File created	C:\Windows\SysWOW64\Befkma32.dll	Pijiif32.exe
File opened for modification	C:\Windows\SysWOW64\Cbjogmlf.exe	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Emjfif32.dll	Cbglgg32.exe
File created	C:\Windows\SysWOW64\Mbiapehp.dll	Hommhi32.exe
File created	C:\Windows\SysWOW64\Mmodfqhf.exe	Megldcgd.exe
File created	C:\Windows\SysWOW64\Idjmfmgp.exe	Impeib32.exe
File created	C:\Windows\SysWOW64\Okeinn32.exe	Odkaac32.exe
File created	C:\Windows\SysWOW64\Qhfaig32.dll	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Qmlmjq32.exe	Pdchakoo.exe
File opened for modification	C:\Windows\SysWOW64\Eaklcj32.exe	Ekqcfpmj.exe
File opened for modification	C:\Windows\SysWOW64\Jondojna.exe	Jhdlbp32.exe
File created	C:\Windows\SysWOW64\Pijiif32.exe	Ppbepp32.exe
File created	C:\Windows\SysWOW64\Lijdbofo.exe	Ldmlih32.exe
File created	C:\Windows\SysWOW64\Edpogbee.dll	Ligglo32.exe
File created	C:\Windows\SysWOW64\Aoibcl32.dll	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Idbepmok.dll	Pihmcflg.exe
File created	C:\Windows\SysWOW64\Emhmkh32.exe	Efnennjc.exe
File created	C:\Windows\SysWOW64\Ibqpio32.dll	Nohicdia.exe
File created	C:\Windows\SysWOW64\Noabkh32.dll	Fjeibc32.exe
File opened for modification	C:\Windows\SysWOW64\Fhefmjlp.exe	Fbhnec32.exe
File created	C:\Windows\SysWOW64\Gcgndf32.exe	Gmnfglcd.exe
File created	C:\Windows\SysWOW64\Fkngbb32.dll	Gfaaebnj.exe
File opened for modification	C:\Windows\SysWOW64\Pgdgodhj.exe	Oajoaj32.exe
File created	C:\Windows\SysWOW64\Jdaficop.dll	Pfjcpc32.exe
File opened for modification	C:\Windows\SysWOW64\Klnkoc32.exe	Kbigajfc.exe
File created	C:\Windows\SysWOW64\Nacboi32.exe	Nkijbooo.exe
File created	C:\Windows\SysWOW64\Kingpj32.dll	Ipmjkh32.exe
File opened for modification	C:\Windows\SysWOW64\Glinjqhb.exe	Omgabj32.exe
File created	C:\Windows\SysWOW64\Mldhacpj.exe	Mcggga32.exe
File opened for modification	C:\Windows\SysWOW64\Dncehk32.exe	Dgjmkqke.exe
File opened for modification	C:\Windows\SysWOW64\Deiblamk.exe	Coojpg32.exe
File created	C:\Windows\SysWOW64\Cogllb32.dll	Mcdepd32.exe
File created	C:\Windows\SysWOW64\Dlefhe32.dll	Bhaeli32.exe
File created	C:\Windows\SysWOW64\Iaffkdlc.dll	Nepgcgje.exe
File opened for modification	C:\Windows\SysWOW64\Lahbei32.exe	Logicn32.exe
File created	C:\Windows\SysWOW64\Obnnnc32.exe	Nlgbon32.exe
File created	C:\Windows\SysWOW64\Pgdgodhj.exe	Oajoaj32.exe
File created	C:\Windows\SysWOW64\Plhhcc32.dll	Qmkfoj32.exe
File created	C:\Windows\SysWOW64\Lglopjkg.exe	Laofhbmp.exe
File created	C:\Windows\SysWOW64\Mnojcb32.exe	Mdgejmdi.exe
File created	C:\Windows\SysWOW64\Bkibdp32.dll	Efdbhpbn.exe
File opened for modification	C:\Windows\SysWOW64\Goconkah.exe	Gfkjef32.exe
File opened for modification	C:\Windows\SysWOW64\Kapfiqoj.exe	Kibeoo32.exe
File created	C:\Windows\SysWOW64\Gofndo32.dll	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Ljglnmdi.exe	Kkdoje32.exe
File created	C:\Windows\SysWOW64\Ofbmdj32.dll	Icogcjde.exe
File opened for modification	C:\Windows\SysWOW64\Mkegbfgp.exe	Mqpcdn32.exe
File created	C:\Windows\SysWOW64\Kdkkha32.dll	Kmbkfp32.exe
File created	C:\Windows\SysWOW64\Pnfbpbof.dll	Mkdagm32.exe
File created	C:\Windows\SysWOW64\Bgqedh32.dll	Mhenpk32.exe
File created	C:\Windows\SysWOW64\Mcgpbknd.dll	Panhmi32.exe
File created	C:\Windows\SysWOW64\Donjdabe.dll	Nqaipgal.exe
File created	C:\Windows\SysWOW64\Hmkfnp32.dll	Pkhokkel.exe
File created	C:\Windows\SysWOW64\Gpdkpe32.dll	Lehhqg32.exe
File opened for modification	C:\Windows\SysWOW64\Piceflpi.exe	Pmjhlklg.exe
File created	C:\Windows\SysWOW64\Jaejqa32.dll	Aljmal32.exe
File created	C:\Windows\SysWOW64\Hapgkmbf.dll	Goconkah.exe
File opened for modification	C:\Windows\SysWOW64\Jhmhpfmi.exe	Janghmia.exe
File created	C:\Windows\SysWOW64\Banlia32.dll	Hoiihcde.exe
File opened for modification	C:\Windows\SysWOW64\Nqaipgal.exe	Mjhqcmjo.exe
File created	C:\Windows\SysWOW64\Kahpgcch.exe	Kacgld32.exe
File created	C:\Windows\SysWOW64\Cmedjl32.exe	Cienon32.exe
File opened for modification	C:\Windows\SysWOW64\Epjfehbd.exe	Efdbhpbn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6768	6956	WerFault.exe	904

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdmngm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imkbooff.dll"	Jacnegep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Obnlpnbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pihmcflg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qajhigcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abqjci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Abqjci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aaiqcnhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qaegcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdbmge32.dll"	Odidld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nacboi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdpnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdkkha32.dll"	Kmbkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imofip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhehcge.dll"	Ppeipfdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ecblbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcafjf32.dll"	Kbocng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akipic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppbepp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfmilknm.dll"	Deiblamk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Clfdcgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hijohoki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dqdnjfpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogcho32.dll"	Pilpfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmdfcmid.dll"	Llmbqdfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kingpj32.dll"	Ipmjkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Andlfi32.dll"	Cggpfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjakmcg.dll"	Kkmijf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chpnfc32.dll"	Fcmnkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obqopddf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflhco32.dll"	Aonhblad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apnndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nacboi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qigefl32.dll"	Eoocfegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipllghgi.dll"	Ednajepe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojopki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkmapc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gcgndf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imbaobmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekfnbbc.dll"	Dngobghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnhhmog.dll"	Ceppfbef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfchlb32.dll"	Bhdbaihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehpnnpl.dll"	Jhdlbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Achmpagb.dll"	Glqkefff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecoiapdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmpfcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qaegcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnmdil32.dll"	Hqddqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emanepld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmqggncn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmqggncn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkaijl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fklcbocl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ghnpmqef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgafin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbghhkmq.dll"	Nmmqgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohiajebm.dll"	Coegih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfhij32.dll"	Mcklac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhddce32.dll"	Jafaem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbhbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkmijf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgjmkqke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4440	3472	0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe	98
PID 3472 wrote to memory of 4440	3472	0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe	98
PID 3472 wrote to memory of 4440	3472	0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe	98
PID 4440 wrote to memory of 4272	4440	Nopfpgip.exe	99
PID 4440 wrote to memory of 4272	4440	Nopfpgip.exe	99
PID 4440 wrote to memory of 4272	4440	Nopfpgip.exe	99
PID 4272 wrote to memory of 3536	4272	Nadleilm.exe	100
PID 4272 wrote to memory of 3536	4272	Nadleilm.exe	100
PID 4272 wrote to memory of 3536	4272	Nadleilm.exe	100
PID 3536 wrote to memory of 5032	3536	Nnhmnn32.exe	101
PID 3536 wrote to memory of 5032	3536	Nnhmnn32.exe	101
PID 3536 wrote to memory of 5032	3536	Nnhmnn32.exe	101
PID 5032 wrote to memory of 4612	5032	Oplfkeob.exe	102
PID 5032 wrote to memory of 4612	5032	Oplfkeob.exe	102
PID 5032 wrote to memory of 4612	5032	Oplfkeob.exe	102
PID 4612 wrote to memory of 456	4612	Opeiadfg.exe	103
PID 4612 wrote to memory of 456	4612	Opeiadfg.exe	103
PID 4612 wrote to memory of 456	4612	Opeiadfg.exe	103
PID 456 wrote to memory of 4684	456	Pmnbfhal.exe	104
PID 456 wrote to memory of 4684	456	Pmnbfhal.exe	104
PID 456 wrote to memory of 4684	456	Pmnbfhal.exe	104
PID 4684 wrote to memory of 1728	4684	Qodeajbg.exe	105
PID 4684 wrote to memory of 1728	4684	Qodeajbg.exe	105
PID 4684 wrote to memory of 1728	4684	Qodeajbg.exe	105
PID 1728 wrote to memory of 4656	1728	Adfgdpmi.exe	106
PID 1728 wrote to memory of 4656	1728	Adfgdpmi.exe	106
PID 1728 wrote to memory of 4656	1728	Adfgdpmi.exe	106
PID 4656 wrote to memory of 1500	4656	Bobabg32.exe	107
PID 4656 wrote to memory of 1500	4656	Bobabg32.exe	107
PID 4656 wrote to memory of 1500	4656	Bobabg32.exe	107
PID 1500 wrote to memory of 4712	1500	Bdojjo32.exe	108
PID 1500 wrote to memory of 4712	1500	Bdojjo32.exe	108
PID 1500 wrote to memory of 4712	1500	Bdojjo32.exe	108
PID 4712 wrote to memory of 2320	4712	Baegibae.exe	109
PID 4712 wrote to memory of 2320	4712	Baegibae.exe	109
PID 4712 wrote to memory of 2320	4712	Baegibae.exe	109
PID 2320 wrote to memory of 1912	2320	Bpkdjofm.exe	110
PID 2320 wrote to memory of 1912	2320	Bpkdjofm.exe	110
PID 2320 wrote to memory of 1912	2320	Bpkdjofm.exe	110
PID 1912 wrote to memory of 3056	1912	Cdimqm32.exe	111
PID 1912 wrote to memory of 3056	1912	Cdimqm32.exe	111
PID 1912 wrote to memory of 3056	1912	Cdimqm32.exe	111
PID 3056 wrote to memory of 4340	3056	Caojpaij.exe	112
PID 3056 wrote to memory of 4340	3056	Caojpaij.exe	112
PID 3056 wrote to memory of 4340	3056	Caojpaij.exe	112
PID 4340 wrote to memory of 1988	4340	Ckgohf32.exe	113
PID 4340 wrote to memory of 1988	4340	Ckgohf32.exe	113
PID 4340 wrote to memory of 1988	4340	Ckgohf32.exe	113
PID 1988 wrote to memory of 4044	1988	Dpiplm32.exe	114
PID 1988 wrote to memory of 4044	1988	Dpiplm32.exe	114
PID 1988 wrote to memory of 4044	1988	Dpiplm32.exe	114
PID 4044 wrote to memory of 2588	4044	Ddkbmj32.exe	115
PID 4044 wrote to memory of 2588	4044	Ddkbmj32.exe	115
PID 4044 wrote to memory of 2588	4044	Ddkbmj32.exe	115
PID 2588 wrote to memory of 2240	2588	Dhikci32.exe	116
PID 2588 wrote to memory of 2240	2588	Dhikci32.exe	116
PID 2588 wrote to memory of 2240	2588	Dhikci32.exe	116
PID 2240 wrote to memory of 4784	2240	Edplhjhi.exe	117
PID 2240 wrote to memory of 4784	2240	Edplhjhi.exe	117
PID 2240 wrote to memory of 4784	2240	Edplhjhi.exe	117
PID 4784 wrote to memory of 4996	4784	Ekonpckp.exe	118
PID 4784 wrote to memory of 4996	4784	Ekonpckp.exe	118
PID 4784 wrote to memory of 4996	4784	Ekonpckp.exe	118
PID 4996 wrote to memory of 4940	4996	Foapaa32.exe	119

C:\Users\Admin\AppData\Local\Temp\0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe
"C:\Users\Admin\AppData\Local\Temp\0b67c15fb2dae76c5e408cba25f57415a142edc7c5069fc66e8c1f346bfc21ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\Nopfpgip.exe
  C:\Windows\system32\Nopfpgip.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\Nadleilm.exe
    C:\Windows\system32\Nadleilm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\Nnhmnn32.exe
      C:\Windows\system32\Nnhmnn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        23⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        24⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        25⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        27⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        28⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        29⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        30⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        31⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        32⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        33⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        34⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        36⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        37⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        39⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        40⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        41⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        42⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        44⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        45⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        46⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        47⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        48⤵
        Executes dropped EXE
        
        PID:5140
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        49⤵
        Executes dropped EXE
        
        PID:5188
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5232
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        51⤵
        Executes dropped EXE
        
        PID:5272
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        52⤵
        Executes dropped EXE
        
        PID:5312
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        53⤵
        Executes dropped EXE
        
        PID:5352
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        54⤵
        Executes dropped EXE
        
        PID:5400
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        55⤵
        Executes dropped EXE
        
        PID:5448
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        56⤵
        Executes dropped EXE
        
        PID:5504
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        59⤵
        Executes dropped EXE
        
        PID:5640
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        60⤵
        Executes dropped EXE
        
        PID:5700
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        62⤵
        Executes dropped EXE
        
        PID:5788
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        63⤵
        Executes dropped EXE
        
        PID:5828
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        64⤵
        Executes dropped EXE
        
        PID:5868
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        65⤵
        Executes dropped EXE
        
        PID:5908
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        66⤵
        Executes dropped EXE
        
        PID:5952
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        67⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        68⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        69⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        70⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        71⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        72⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        73⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        74⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        75⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        76⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        77⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        78⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        79⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        80⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        81⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        82⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        83⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        84⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4820
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        86⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        87⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        88⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        90⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        91⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        92⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        93⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        94⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        95⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        96⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        97⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        98⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        99⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        100⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        102⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        103⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        104⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Dmplkd32.exe
        
        C:\Windows\system32\Dmplkd32.exe
        105⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Dekapfke.exe
        
        C:\Windows\system32\Dekapfke.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2248
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        107⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        108⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Emgblc32.exe
        
        C:\Windows\system32\Emgblc32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        110⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fjeibc32.exe
        
        C:\Windows\system32\Fjeibc32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Fcmnkh32.exe
        
        C:\Windows\system32\Fcmnkh32.exe
        112⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        113⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Fnglcqio.exe
        
        C:\Windows\system32\Fnglcqio.exe
        114⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        116⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        117⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        118⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        119⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        120⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        121⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        122⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        123⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        124⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        125⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Hjoeoo32.exe
        
        C:\Windows\system32\Hjoeoo32.exe
        126⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        127⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        128⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        129⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        130⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ijonfmbn.exe
        
        C:\Windows\system32\Ijonfmbn.exe
        131⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jjdgal32.exe
        
        C:\Windows\system32\Jjdgal32.exe
        132⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Jeilne32.exe
        
        C:\Windows\system32\Jeilne32.exe
        133⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        134⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        135⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        136⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        137⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        138⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        139⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        140⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        141⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Lacbpccn.exe
        
        C:\Windows\system32\Lacbpccn.exe
        142⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        144⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        145⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        146⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Lhdqml32.exe
        
        C:\Windows\system32\Lhdqml32.exe
        147⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Mhfmbl32.exe
        
        C:\Windows\system32\Mhfmbl32.exe
        149⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        150⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        151⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Moeoje32.exe
        
        C:\Windows\system32\Moeoje32.exe
        153⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Mhmcck32.exe
        
        C:\Windows\system32\Mhmcck32.exe
        154⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        155⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        156⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        158⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Pfpidk32.exe
        
        C:\Windows\system32\Pfpidk32.exe
        159⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        160⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        161⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        162⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        163⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bbbblhnc.exe
        
        C:\Windows\system32\Bbbblhnc.exe
        164⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        165⤵
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        166⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        167⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        168⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Deokja32.exe
        
        C:\Windows\system32\Deokja32.exe
        169⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        170⤵
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        171⤵
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        172⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        173⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        174⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        175⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Eohhie32.exe
        
        C:\Windows\system32\Eohhie32.exe
        176⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        177⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        178⤵
        Drops file in System32 directory
        
        PID:2252
        
        C:\Windows\SysWOW64\Fhefmjlp.exe
        
        C:\Windows\system32\Fhefmjlp.exe
        179⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        180⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        181⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        182⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        183⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        184⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        185⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        186⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        187⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        188⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Hgpbhmna.exe
        
        C:\Windows\system32\Hgpbhmna.exe
        189⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        190⤵
        
        PID:420
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        191⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        192⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        193⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Jgbhdkml.exe
        
        C:\Windows\system32\Jgbhdkml.exe
        194⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        195⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        196⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        197⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Lfaqcclf.exe
        
        C:\Windows\system32\Lfaqcclf.exe
        198⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        199⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        200⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        201⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        202⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5008
        
        C:\Windows\SysWOW64\Npadcfnl.exe
        
        C:\Windows\system32\Npadcfnl.exe
        204⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        205⤵
        Drops file in System32 directory
        
        PID:948
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2764
        
        C:\Windows\SysWOW64\Gaffbg32.exe
        
        C:\Windows\system32\Gaffbg32.exe
        207⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Gknkkmmj.exe
        
        C:\Windows\system32\Gknkkmmj.exe
        208⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Golcak32.exe
        
        C:\Windows\system32\Golcak32.exe
        210⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        211⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        213⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        214⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        215⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Hojpbigq.exe
        
        C:\Windows\system32\Hojpbigq.exe
        216⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        217⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Hommhi32.exe
        
        C:\Windows\system32\Hommhi32.exe
        218⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        219⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ijgjpaao.exe
        
        C:\Windows\system32\Ijgjpaao.exe
        220⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        221⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        222⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Jkajnh32.exe
        
        C:\Windows\system32\Jkajnh32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        225⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        226⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        227⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        228⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        229⤵
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        231⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        232⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        233⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        234⤵
        Drops file in System32 directory
        
        PID:4876
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        235⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        236⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        237⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lbenho32.exe
        
        C:\Windows\system32\Lbenho32.exe
        238⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        239⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        240⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mcggga32.exe
        
        C:\Windows\system32\Mcggga32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7308
        
        C:\Windows\SysWOW64\Mldhacpj.exe
        
        C:\Windows\system32\Mldhacpj.exe
        242⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Mihikgod.exe
        
        C:\Windows\system32\Mihikgod.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        244⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Nipokfil.exe
        
        C:\Windows\system32\Nipokfil.exe
        245⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Npighq32.exe
        
        C:\Windows\system32\Npighq32.exe
        246⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Niblafgi.exe
        
        C:\Windows\system32\Niblafgi.exe
        247⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Njahki32.exe
        
        C:\Windows\system32\Njahki32.exe
        248⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Nfhipj32.exe
        
        C:\Windows\system32\Nfhipj32.exe
        249⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Niiaae32.exe
        
        C:\Windows\system32\Niiaae32.exe
        250⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ojhnlh32.exe
        
        C:\Windows\system32\Ojhnlh32.exe
        251⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Opefdo32.exe
        
        C:\Windows\system32\Opefdo32.exe
        252⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Ofooqinh.exe
        
        C:\Windows\system32\Ofooqinh.exe
        253⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Ollgiplp.exe
        
        C:\Windows\system32\Ollgiplp.exe
        254⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Obhlkjaj.exe
        
        C:\Windows\system32\Obhlkjaj.exe
        255⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Oibdhd32.exe
        
        C:\Windows\system32\Oibdhd32.exe
        256⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Oplmdnpc.exe
        
        C:\Windows\system32\Oplmdnpc.exe
        257⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Pmpmnb32.exe
        
        C:\Windows\system32\Pmpmnb32.exe
        258⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Pbmffi32.exe
        
        C:\Windows\system32\Pbmffi32.exe
        259⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Pignccea.exe
        
        C:\Windows\system32\Pignccea.exe
        260⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Plejoode.exe
        
        C:\Windows\system32\Plejoode.exe
        261⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Pindcboi.exe
        
        C:\Windows\system32\Pindcboi.exe
        262⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Pdchakoo.exe
        
        C:\Windows\system32\Pdchakoo.exe
        263⤵
        Drops file in System32 directory
        
        PID:7252
        
        C:\Windows\SysWOW64\Qmlmjq32.exe
        
        C:\Windows\system32\Qmlmjq32.exe
        264⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Agfnhf32.exe
        
        C:\Windows\system32\Agfnhf32.exe
        265⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Apobakpn.exe
        
        C:\Windows\system32\Apobakpn.exe
        266⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ajggjq32.exe
        
        C:\Windows\system32\Ajggjq32.exe
        267⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Admkgifd.exe
        
        C:\Windows\system32\Admkgifd.exe
        268⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ajjcoqdl.exe
        
        C:\Windows\system32\Ajjcoqdl.exe
        269⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Adohmidb.exe
        
        C:\Windows\system32\Adohmidb.exe
        270⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Akipic32.exe
        
        C:\Windows\system32\Akipic32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Aljmal32.exe
        
        C:\Windows\system32\Aljmal32.exe
        272⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Agpqnd32.exe
        
        C:\Windows\system32\Agpqnd32.exe
        273⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Aphegjhc.exe
        
        C:\Windows\system32\Aphegjhc.exe
        274⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Bgbmdd32.exe
        
        C:\Windows\system32\Bgbmdd32.exe
        275⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Bnlfqngm.exe
        
        C:\Windows\system32\Bnlfqngm.exe
        276⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Bgdjicmn.exe
        
        C:\Windows\system32\Bgdjicmn.exe
        277⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Blabakle.exe
        
        C:\Windows\system32\Blabakle.exe
        278⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bjeckojo.exe
        
        C:\Windows\system32\Bjeckojo.exe
        279⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Bdkghg32.exe
        
        C:\Windows\system32\Bdkghg32.exe
        280⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Bkepeaaa.exe
        
        C:\Windows\system32\Bkepeaaa.exe
        281⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bdmdng32.exe
        
        C:\Windows\system32\Bdmdng32.exe
        282⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Bkglkapo.exe
        
        C:\Windows\system32\Bkglkapo.exe
        283⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Cnhell32.exe
        
        C:\Windows\system32\Cnhell32.exe
        284⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Cklffq32.exe
        
        C:\Windows\system32\Cklffq32.exe
        285⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ccgjjc32.exe
        
        C:\Windows\system32\Ccgjjc32.exe
        286⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        287⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Cdfgdf32.exe
        
        C:\Windows\system32\Cdfgdf32.exe
        288⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Ckqoapgd.exe
        
        C:\Windows\system32\Ckqoapgd.exe
        289⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Cqmgigfk.exe
        
        C:\Windows\system32\Cqmgigfk.exe
        290⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Cggpfa32.exe
        
        C:\Windows\system32\Cggpfa32.exe
        291⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Cmdhnhkp.exe
        
        C:\Windows\system32\Cmdhnhkp.exe
        292⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dgjmkqke.exe
        
        C:\Windows\system32\Dgjmkqke.exe
        293⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Dncehk32.exe
        
        C:\Windows\system32\Dncehk32.exe
        294⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ddnmeejo.exe
        
        C:\Windows\system32\Ddnmeejo.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Djjemlhf.exe
        
        C:\Windows\system32\Djjemlhf.exe
        296⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Dqdnjfpc.exe
        
        C:\Windows\system32\Dqdnjfpc.exe
        297⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Dgnffp32.exe
        
        C:\Windows\system32\Dgnffp32.exe
        298⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ecoiapdj.exe
        
        C:\Windows\system32\Ecoiapdj.exe
        299⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Ecccmo32.exe
        
        C:\Windows\system32\Ecccmo32.exe
        300⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Enigjh32.exe
        
        C:\Windows\system32\Enigjh32.exe
        301⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Fjphoi32.exe
        
        C:\Windows\system32\Fjphoi32.exe
        302⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Faiplcmk.exe
        
        C:\Windows\system32\Faiplcmk.exe
        303⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Fmejlcoj.exe
        
        C:\Windows\system32\Fmejlcoj.exe
        304⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fdobhm32.exe
        
        C:\Windows\system32\Fdobhm32.exe
        305⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Fjikeg32.exe
        
        C:\Windows\system32\Fjikeg32.exe
        306⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Gdaonmdd.exe
        
        C:\Windows\system32\Gdaonmdd.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Gjkgkg32.exe
        
        C:\Windows\system32\Gjkgkg32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1744
        
        C:\Windows\SysWOW64\Gaepgacn.exe
        
        C:\Windows\system32\Gaepgacn.exe
        309⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Glkdejcd.exe
        
        C:\Windows\system32\Glkdejcd.exe
        310⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hhmdeink.exe
        
        C:\Windows\system32\Hhmdeink.exe
        311⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hmjmnpmb.exe
        
        C:\Windows\system32\Hmjmnpmb.exe
        312⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Hhpaki32.exe
        
        C:\Windows\system32\Hhpaki32.exe
        313⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Hoiihcde.exe
        
        C:\Windows\system32\Hoiihcde.exe
        314⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Hdfapjbl.exe
        
        C:\Windows\system32\Hdfapjbl.exe
        315⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Imofip32.exe
        
        C:\Windows\system32\Imofip32.exe
        316⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Idmhqi32.exe
        
        C:\Windows\system32\Idmhqi32.exe
        317⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ikgpmc32.exe
        
        C:\Windows\system32\Ikgpmc32.exe
        318⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Inhion32.exe
        
        C:\Windows\system32\Inhion32.exe
        319⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Idbalhho.exe
        
        C:\Windows\system32\Idbalhho.exe
        320⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Jklihbol.exe
        
        C:\Windows\system32\Jklihbol.exe
        321⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Jafaem32.exe
        
        C:\Windows\system32\Jafaem32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Jhpjbgne.exe
        
        C:\Windows\system32\Jhpjbgne.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Jojboa32.exe
        
        C:\Windows\system32\Jojboa32.exe
        324⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Jlnbhe32.exe
        
        C:\Windows\system32\Jlnbhe32.exe
        325⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jnoopm32.exe
        
        C:\Windows\system32\Jnoopm32.exe
        326⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jdiglgbg.exe
        
        C:\Windows\system32\Jdiglgbg.exe
        327⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Jookjpam.exe
        
        C:\Windows\system32\Jookjpam.exe
        328⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jehcfj32.exe
        
        C:\Windows\system32\Jehcfj32.exe
        329⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Jhgpbf32.exe
        
        C:\Windows\system32\Jhgpbf32.exe
        330⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Joahop32.exe
        
        C:\Windows\system32\Joahop32.exe
        331⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Khimhefk.exe
        
        C:\Windows\system32\Khimhefk.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Koceep32.exe
        
        C:\Windows\system32\Koceep32.exe
        333⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Kdpmmf32.exe
        
        C:\Windows\system32\Kdpmmf32.exe
        334⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Koeajo32.exe
        
        C:\Windows\system32\Koeajo32.exe
        335⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Kohnpoib.exe
        
        C:\Windows\system32\Kohnpoib.exe
        336⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Kfbfmi32.exe
        
        C:\Windows\system32\Kfbfmi32.exe
        337⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Klloichl.exe
        
        C:\Windows\system32\Klloichl.exe
        338⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Kbigajfc.exe
        
        C:\Windows\system32\Kbigajfc.exe
        339⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Klnkoc32.exe
        
        C:\Windows\system32\Klnkoc32.exe
        340⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Lnbdlkje.exe
        
        C:\Windows\system32\Lnbdlkje.exe
        341⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ldlmieaa.exe
        
        C:\Windows\system32\Ldlmieaa.exe
        342⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Lndaaj32.exe
        
        C:\Windows\system32\Lndaaj32.exe
        343⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ldnjndpo.exe
        
        C:\Windows\system32\Ldnjndpo.exe
        344⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Lkhbko32.exe
        
        C:\Windows\system32\Lkhbko32.exe
        345⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Lbbjhini.exe
        
        C:\Windows\system32\Lbbjhini.exe
        346⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Lofjam32.exe
        
        C:\Windows\system32\Lofjam32.exe
        347⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lfbpcgbl.exe
        
        C:\Windows\system32\Lfbpcgbl.exe
        348⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Mmlhpaji.exe
        
        C:\Windows\system32\Mmlhpaji.exe
        349⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Megldcgd.exe
        
        C:\Windows\system32\Megldcgd.exe
        350⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Mmodfqhf.exe
        
        C:\Windows\system32\Mmodfqhf.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6720
        
        C:\Windows\SysWOW64\Mnpami32.exe
        
        C:\Windows\system32\Mnpami32.exe
        352⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Mieeka32.exe
        
        C:\Windows\system32\Mieeka32.exe
        353⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mkdagm32.exe
        
        C:\Windows\system32\Mkdagm32.exe
        354⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Mfiedfmd.exe
        
        C:\Windows\system32\Mfiedfmd.exe
        355⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Mmcnap32.exe
        
        C:\Windows\system32\Mmcnap32.exe
        356⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Mndjhhjp.exe
        
        C:\Windows\system32\Mndjhhjp.exe
        357⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Meobeb32.exe
        
        C:\Windows\system32\Meobeb32.exe
        358⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Mkhkblii.exe
        
        C:\Windows\system32\Mkhkblii.exe
        359⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Nilkkq32.exe
        
        C:\Windows\system32\Nilkkq32.exe
        360⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Npfchkop.exe
        
        C:\Windows\system32\Npfchkop.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Nfpled32.exe
        
        C:\Windows\system32\Nfpled32.exe
        362⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Nmjdaoni.exe
        
        C:\Windows\system32\Nmjdaoni.exe
        363⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Nbgljf32.exe
        
        C:\Windows\system32\Nbgljf32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Nmmqgo32.exe
        
        C:\Windows\system32\Nmmqgo32.exe
        365⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Nnnmogae.exe
        
        C:\Windows\system32\Nnnmogae.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Nehekq32.exe
        
        C:\Windows\system32\Nehekq32.exe
        367⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Nnpjdfpb.exe
        
        C:\Windows\system32\Nnpjdfpb.exe
        368⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Nejbaqgo.exe
        
        C:\Windows\system32\Nejbaqgo.exe
        369⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nppfnige.exe
        
        C:\Windows\system32\Nppfnige.exe
        370⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Ofjokc32.exe
        
        C:\Windows\system32\Ofjokc32.exe
        371⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Omdghmfo.exe
        
        C:\Windows\system32\Omdghmfo.exe
        372⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Obqopddf.exe
        
        C:\Windows\system32\Obqopddf.exe
        373⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Oijgmokc.exe
        
        C:\Windows\system32\Oijgmokc.exe
        374⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Opdpih32.exe
        
        C:\Windows\system32\Opdpih32.exe
        375⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        376⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Olkqnjhd.exe
        
        C:\Windows\system32\Olkqnjhd.exe
        377⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Omkmhlpf.exe
        
        C:\Windows\system32\Omkmhlpf.exe
        378⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Obgeqcnn.exe
        
        C:\Windows\system32\Obgeqcnn.exe
        379⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pmpfcl32.exe
        
        C:\Windows\system32\Pmpfcl32.exe
        380⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Pifghmae.exe
        
        C:\Windows\system32\Pifghmae.exe
        381⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Pppoeg32.exe
        
        C:\Windows\system32\Pppoeg32.exe
        382⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        383⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Plgpjhnf.exe
        
        C:\Windows\system32\Plgpjhnf.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Peodcmeg.exe
        
        C:\Windows\system32\Peodcmeg.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8400
        
        C:\Windows\SysWOW64\Ppeipfdm.exe
        
        C:\Windows\system32\Ppeipfdm.exe
        386⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Pfoamp32.exe
        
        C:\Windows\system32\Pfoamp32.exe
        387⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Qfanbpjg.exe
        
        C:\Windows\system32\Qfanbpjg.exe
        388⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Qmkfoj32.exe
        
        C:\Windows\system32\Qmkfoj32.exe
        389⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Qolbgbgb.exe
        
        C:\Windows\system32\Qolbgbgb.exe
        390⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Qefkcl32.exe
        
        C:\Windows\system32\Qefkcl32.exe
        391⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        392⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Ampojimo.exe
        
        C:\Windows\system32\Ampojimo.exe
        393⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Aoalba32.exe
        
        C:\Windows\system32\Aoalba32.exe
        394⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Aekdolkj.exe
        
        C:\Windows\system32\Aekdolkj.exe
        395⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Alelkf32.exe
        
        C:\Windows\system32\Alelkf32.exe
        396⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Abodhpic.exe
        
        C:\Windows\system32\Abodhpic.exe
        397⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Aiimejap.exe
        
        C:\Windows\system32\Aiimejap.exe
        398⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Apcead32.exe
        
        C:\Windows\system32\Apcead32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8980
        
        C:\Windows\SysWOW64\Aepmjk32.exe
        
        C:\Windows\system32\Aepmjk32.exe
        400⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Aljefena.exe
        
        C:\Windows\system32\Aljefena.exe
        401⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Aebjokda.exe
        
        C:\Windows\system32\Aebjokda.exe
        402⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Bllble32.exe
        
        C:\Windows\system32\Bllble32.exe
        403⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        404⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Blnoad32.exe
        
        C:\Windows\system32\Blnoad32.exe
        405⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bchgnoai.exe
        
        C:\Windows\system32\Bchgnoai.exe
        406⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Bnnklg32.exe
        
        C:\Windows\system32\Bnnklg32.exe
        407⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Boohcpgm.exe
        
        C:\Windows\system32\Boohcpgm.exe
        408⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Bidlqhgc.exe
        
        C:\Windows\system32\Bidlqhgc.exe
        409⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Cnjkgf32.exe
        
        C:\Windows\system32\Cnjkgf32.exe
        410⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Cpmqoqbp.exe
        
        C:\Windows\system32\Cpmqoqbp.exe
        411⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Dqomdppm.exe
        
        C:\Windows\system32\Dqomdppm.exe
        412⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Djnhne32.exe
        
        C:\Windows\system32\Djnhne32.exe
        413⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Dqhpjohb.exe
        
        C:\Windows\system32\Dqhpjohb.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8760
        
        C:\Windows\SysWOW64\Dfeibf32.exe
        
        C:\Windows\system32\Dfeibf32.exe
        415⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        416⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Emanepld.exe
        
        C:\Windows\system32\Emanepld.exe
        417⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        418⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Ecnbgian.exe
        
        C:\Windows\system32\Ecnbgian.exe
        419⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ejhkdc32.exe
        
        C:\Windows\system32\Ejhkdc32.exe
        420⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Eqbcqnph.exe
        
        C:\Windows\system32\Eqbcqnph.exe
        421⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Eglkmh32.exe
        
        C:\Windows\system32\Eglkmh32.exe
        422⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Enfcjb32.exe
        
        C:\Windows\system32\Enfcjb32.exe
        423⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ecblbi32.exe
        
        C:\Windows\system32\Ecblbi32.exe
        424⤵
        Modifies registry class
        
        PID:8396
        
        C:\Windows\SysWOW64\Fjldocde.exe
        
        C:\Windows\system32\Fjldocde.exe
        425⤵
        
        PID:716
        
        C:\Windows\SysWOW64\Fceihh32.exe
        
        C:\Windows\system32\Fceihh32.exe
        426⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Fnjmea32.exe
        
        C:\Windows\system32\Fnjmea32.exe
        427⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Fcgemhic.exe
        
        C:\Windows\system32\Fcgemhic.exe
        428⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Fakfglhm.exe
        
        C:\Windows\system32\Fakfglhm.exe
        429⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        430⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Fppchile.exe
        
        C:\Windows\system32\Fppchile.exe
        431⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Ffjkdc32.exe
        
        C:\Windows\system32\Ffjkdc32.exe
        432⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Fcnlng32.exe
        
        C:\Windows\system32\Fcnlng32.exe
        433⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        434⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Gfodpbpl.exe
        
        C:\Windows\system32\Gfodpbpl.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3716
        
        C:\Windows\SysWOW64\Gfaaebnj.exe
        
        C:\Windows\system32\Gfaaebnj.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9076
        
        C:\Windows\SysWOW64\Gceaofmc.exe
        
        C:\Windows\system32\Gceaofmc.exe
        437⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Gmnfglcd.exe
        
        C:\Windows\system32\Gmnfglcd.exe
        438⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Gcgndf32.exe
        
        C:\Windows\system32\Gcgndf32.exe
        439⤵
        Modifies registry class
        
        PID:8388
        
        C:\Windows\SysWOW64\Gjagapbn.exe
        
        C:\Windows\system32\Gjagapbn.exe
        440⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Galonj32.exe
        
        C:\Windows\system32\Galonj32.exe
        441⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Hhegjdag.exe
        
        C:\Windows\system32\Hhegjdag.exe
        442⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Hanlcjgh.exe
        
        C:\Windows\system32\Hanlcjgh.exe
        443⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Hjfplo32.exe
        
        C:\Windows\system32\Hjfplo32.exe
        444⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Hpchdf32.exe
        
        C:\Windows\system32\Hpchdf32.exe
        445⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Hndibn32.exe
        
        C:\Windows\system32\Hndibn32.exe
        446⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Hpeejfjm.exe
        
        C:\Windows\system32\Hpeejfjm.exe
        447⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Hdcnpd32.exe
        
        C:\Windows\system32\Hdcnpd32.exe
        448⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        449⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        450⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Idmafc32.exe
        
        C:\Windows\system32\Idmafc32.exe
        451⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Iobecl32.exe
        
        C:\Windows\system32\Iobecl32.exe
        452⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Iaqapggb.exe
        
        C:\Windows\system32\Iaqapggb.exe
        453⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Ihkila32.exe
        
        C:\Windows\system32\Ihkila32.exe
        454⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Jacnegep.exe
        
        C:\Windows\system32\Jacnegep.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Jphkfc32.exe
        
        C:\Windows\system32\Jphkfc32.exe
        456⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Jhocgqjj.exe
        
        C:\Windows\system32\Jhocgqjj.exe
        457⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        458⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        459⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Jmnheggo.exe
        
        C:\Windows\system32\Jmnheggo.exe
        460⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Jhdlbp32.exe
        
        C:\Windows\system32\Jhdlbp32.exe
        461⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Jondojna.exe
        
        C:\Windows\system32\Jondojna.exe
        462⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jpoagb32.exe
        
        C:\Windows\system32\Jpoagb32.exe
        463⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Jkeedk32.exe
        
        C:\Windows\system32\Jkeedk32.exe
        464⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        465⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Kgkfil32.exe
        
        C:\Windows\system32\Kgkfil32.exe
        466⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Kpdjbapj.exe
        
        C:\Windows\system32\Kpdjbapj.exe
        467⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Kkioojpp.exe
        
        C:\Windows\system32\Kkioojpp.exe
        468⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Kacgld32.exe
        
        C:\Windows\system32\Kacgld32.exe
        469⤵
        Drops file in System32 directory
        
        PID:2688
        
        C:\Windows\SysWOW64\Kahpgcch.exe
        
        C:\Windows\system32\Kahpgcch.exe
        470⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        471⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        472⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        473⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Lggeej32.exe
        
        C:\Windows\system32\Lggeej32.exe
        474⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Lnanadfi.exe
        
        C:\Windows\system32\Lnanadfi.exe
        475⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Ldkfno32.exe
        
        C:\Windows\system32\Ldkfno32.exe
        476⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Lkenkhec.exe
        
        C:\Windows\system32\Lkenkhec.exe
        477⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        478⤵
        Drops file in System32 directory
        
        PID:3056
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        479⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Laacmbkm.exe
        
        C:\Windows\system32\Laacmbkm.exe
        480⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Lgnleiid.exe
        
        C:\Windows\system32\Lgnleiid.exe
        481⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Lnhdbc32.exe
        
        C:\Windows\system32\Lnhdbc32.exe
        482⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        483⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Mohplf32.exe
        
        C:\Windows\system32\Mohplf32.exe
        484⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Mddidm32.exe
        
        C:\Windows\system32\Mddidm32.exe
        485⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        486⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Mdgejmdi.exe
        
        C:\Windows\system32\Mdgejmdi.exe
        487⤵
        Drops file in System32 directory
        
        PID:6428
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        488⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Mhenpk32.exe
        
        C:\Windows\system32\Mhenpk32.exe
        489⤵
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        490⤵
        Drops file in System32 directory
        
        PID:9284
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        491⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Mbpoop32.exe
        
        C:\Windows\system32\Mbpoop32.exe
        492⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        493⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Nbbldp32.exe
        
        C:\Windows\system32\Nbbldp32.exe
        494⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        495⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Nofmndkd.exe
        
        C:\Windows\system32\Nofmndkd.exe
        496⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ndbefkjk.exe
        
        C:\Windows\system32\Ndbefkjk.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9580
        
        C:\Windows\SysWOW64\Nohicdia.exe
        
        C:\Windows\system32\Nohicdia.exe
        498⤵
        Drops file in System32 directory
        
        PID:9620
        
        C:\Windows\SysWOW64\Nqifkl32.exe
        
        C:\Windows\system32\Nqifkl32.exe
        499⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Nkojheoe.exe
        
        C:\Windows\system32\Nkojheoe.exe
        500⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Nqlbqlmm.exe
        
        C:\Windows\system32\Nqlbqlmm.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9752
        
        C:\Windows\SysWOW64\Nkagndmc.exe
        
        C:\Windows\system32\Nkagndmc.exe
        502⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        503⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Oghgbe32.exe
        
        C:\Windows\system32\Oghgbe32.exe
        504⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        505⤵
        Modifies registry class
        
        PID:9916
        
        C:\Windows\SysWOW64\Oigdmh32.exe
        
        C:\Windows\system32\Oigdmh32.exe
        506⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ondleo32.exe
        
        C:\Windows\system32\Ondleo32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10004
        
        C:\Windows\SysWOW64\Oijqbh32.exe
        
        C:\Windows\system32\Oijqbh32.exe
        508⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ongijo32.exe
        
        C:\Windows\system32\Ongijo32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Opfedb32.exe
        
        C:\Windows\system32\Opfedb32.exe
        510⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Oecnmi32.exe
        
        C:\Windows\system32\Oecnmi32.exe
        511⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        512⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Oajoaj32.exe
        
        C:\Windows\system32\Oajoaj32.exe
        513⤵
        Drops file in System32 directory
        
        PID:4940
        
        C:\Windows\SysWOW64\Pgdgodhj.exe
        
        C:\Windows\system32\Pgdgodhj.exe
        514⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Pehghhgc.exe
        
        C:\Windows\system32\Pehghhgc.exe
        515⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Plapdb32.exe
        
        C:\Windows\system32\Plapdb32.exe
        516⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Panhmi32.exe
        
        C:\Windows\system32\Panhmi32.exe
        517⤵
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Pldljbmn.exe
        
        C:\Windows\system32\Pldljbmn.exe
        518⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Pbndgl32.exe
        
        C:\Windows\system32\Pbndgl32.exe
        519⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Pihmcflg.exe
        
        C:\Windows\system32\Pihmcflg.exe
        520⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9636
        
        C:\Windows\SysWOW64\Ppbepp32.exe
        
        C:\Windows\system32\Ppbepp32.exe
        521⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        522⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        523⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Qajhigcj.exe
        
        C:\Windows\system32\Qajhigcj.exe
        524⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Ahdpea32.exe
        
        C:\Windows\system32\Ahdpea32.exe
        525⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        526⤵
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Aehpof32.exe
        
        C:\Windows\system32\Aehpof32.exe
        527⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Albikp32.exe
        
        C:\Windows\system32\Albikp32.exe
        528⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3400
        
        C:\Windows\SysWOW64\Aldeap32.exe
        
        C:\Windows\system32\Aldeap32.exe
        530⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        531⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ahkffqdo.exe
        
        C:\Windows\system32\Ahkffqdo.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9320
        
        C:\Windows\SysWOW64\Abqjci32.exe
        
        C:\Windows\system32\Abqjci32.exe
        533⤵
        Modifies registry class
        
        PID:9388
        
        C:\Windows\SysWOW64\Aikbpckb.exe
        
        C:\Windows\system32\Aikbpckb.exe
        534⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Aogkhjii.exe
        
        C:\Windows\system32\Aogkhjii.exe
        535⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Beaced32.exe
        
        C:\Windows\system32\Beaced32.exe
        536⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Blkkaohc.exe
        
        C:\Windows\system32\Blkkaohc.exe
        537⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Coegih32.exe
        
        C:\Windows\system32\Coegih32.exe
        538⤵
        Modifies registry class
        
        PID:9948
        
        C:\Windows\SysWOW64\Ceppfbef.exe
        
        C:\Windows\system32\Ceppfbef.exe
        539⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Chphhn32.exe
        
        C:\Windows\system32\Chphhn32.exe
        540⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Ccfmef32.exe
        
        C:\Windows\system32\Ccfmef32.exe
        541⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Chbenm32.exe
        
        C:\Windows\system32\Chbenm32.exe
        542⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Commjgga.exe
        
        C:\Windows\system32\Commjgga.exe
        543⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Cefega32.exe
        
        C:\Windows\system32\Cefega32.exe
        544⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Coojpg32.exe
        
        C:\Windows\system32\Coojpg32.exe
        545⤵
        Drops file in System32 directory
        
        PID:9764
        
        C:\Windows\SysWOW64\Deiblamk.exe
        
        C:\Windows\system32\Deiblamk.exe
        546⤵
        Modifies registry class
        
        PID:9908
        
        C:\Windows\SysWOW64\Dpnfjjla.exe
        
        C:\Windows\system32\Dpnfjjla.exe
        547⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Dekobaki.exe
        
        C:\Windows\system32\Dekobaki.exe
        548⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        549⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Dcopke32.exe
        
        C:\Windows\system32\Dcopke32.exe
        550⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Djihhoao.exe
        
        C:\Windows\system32\Djihhoao.exe
        551⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Eokjke32.exe
        
        C:\Windows\system32\Eokjke32.exe
        552⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Efdbhpbn.exe
        
        C:\Windows\system32\Efdbhpbn.exe
        553⤵
        Drops file in System32 directory
        
        PID:2240
        
        C:\Windows\SysWOW64\Epjfehbd.exe
        
        C:\Windows\system32\Epjfehbd.exe
        554⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Ebkbmqhb.exe
        
        C:\Windows\system32\Ebkbmqhb.exe
        555⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Ehekjk32.exe
        
        C:\Windows\system32\Ehekjk32.exe
        556⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Eoocfegl.exe
        
        C:\Windows\system32\Eoocfegl.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Ejegdngb.exe
        
        C:\Windows\system32\Ejegdngb.exe
        558⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Eqopqh32.exe
        
        C:\Windows\system32\Eqopqh32.exe
        559⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Ebplhp32.exe
        
        C:\Windows\system32\Ebplhp32.exe
        560⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Eodlad32.exe
        
        C:\Windows\system32\Eodlad32.exe
        561⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Efnennjc.exe
        
        C:\Windows\system32\Efnennjc.exe
        562⤵
        Drops file in System32 directory
        
        PID:10372
        
        C:\Windows\SysWOW64\Emhmkh32.exe
        
        C:\Windows\system32\Emhmkh32.exe
        563⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Fcbehbim.exe
        
        C:\Windows\system32\Fcbehbim.exe
        564⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Fhonpi32.exe
        
        C:\Windows\system32\Fhonpi32.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10508
        
        C:\Windows\SysWOW64\Foifmcoa.exe
        
        C:\Windows\system32\Foifmcoa.exe
        566⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Fjnjjlog.exe
        
        C:\Windows\system32\Fjnjjlog.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10588
        
        C:\Windows\SysWOW64\Fqhbgf32.exe
        
        C:\Windows\system32\Fqhbgf32.exe
        568⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        569⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        570⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Fjccel32.exe
        
        C:\Windows\system32\Fjccel32.exe
        571⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        572⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        573⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Gqohge32.exe
        
        C:\Windows\system32\Gqohge32.exe
        574⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Gbqeonfj.exe
        
        C:\Windows\system32\Gbqeonfj.exe
        575⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Gmfilfep.exe
        
        C:\Windows\system32\Gmfilfep.exe
        576⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Gcpaiq32.exe
        
        C:\Windows\system32\Gcpaiq32.exe
        577⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Gqdbbelf.exe
        
        C:\Windows\system32\Gqdbbelf.exe
        578⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Gfqjkljn.exe
        
        C:\Windows\system32\Gfqjkljn.exe
        579⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Gmkbgf32.exe
        
        C:\Windows\system32\Gmkbgf32.exe
        580⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Gbgkpm32.exe
        
        C:\Windows\system32\Gbgkpm32.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11180
        
        C:\Windows\SysWOW64\Gmmome32.exe
        
        C:\Windows\system32\Gmmome32.exe
        582⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Gbjhelnp.exe
        
        C:\Windows\system32\Gbjhelnp.exe
        583⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Hmolbene.exe
        
        C:\Windows\system32\Hmolbene.exe
        584⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hcidoo32.exe
        
        C:\Windows\system32\Hcidoo32.exe
        585⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Hifmhf32.exe
        
        C:\Windows\system32\Hifmhf32.exe
        586⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Hppedpkf.exe
        
        C:\Windows\system32\Hppedpkf.exe
        587⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Hjjbmhfg.exe
        
        C:\Windows\system32\Hjjbmhfg.exe
        588⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        589⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Ijolhg32.exe
        
        C:\Windows\system32\Ijolhg32.exe
        590⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Ipldpo32.exe
        
        C:\Windows\system32\Ipldpo32.exe
        591⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        592⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Impeib32.exe
        
        C:\Windows\system32\Impeib32.exe
        593⤵
        Drops file in System32 directory
        
        PID:10876
        
        C:\Windows\SysWOW64\Idjmfmgp.exe
        
        C:\Windows\system32\Idjmfmgp.exe
        594⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Imbaobmp.exe
        
        C:\Windows\system32\Imbaobmp.exe
        595⤵
        Modifies registry class
        
        PID:11008
        
        C:\Windows\SysWOW64\Idljll32.exe
        
        C:\Windows\system32\Idljll32.exe
        596⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Iiibdc32.exe
        
        C:\Windows\system32\Iiibdc32.exe
        597⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Ipckqnja.exe
        
        C:\Windows\system32\Ipckqnja.exe
        598⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Jjhonfjg.exe
        
        C:\Windows\system32\Jjhonfjg.exe
        599⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Jpegfm32.exe
        
        C:\Windows\system32\Jpegfm32.exe
        600⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Jfopcgpk.exe
        
        C:\Windows\system32\Jfopcgpk.exe
        601⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Jmihpa32.exe
        
        C:\Windows\system32\Jmihpa32.exe
        602⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Jdcplkoe.exe
        
        C:\Windows\system32\Jdcplkoe.exe
        603⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        604⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        605⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Jbmfig32.exe
        
        C:\Windows\system32\Jbmfig32.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        607⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Kbocng32.exe
        
        C:\Windows\system32\Kbocng32.exe
        608⤵
        Modifies registry class
        
        PID:10808
        
        C:\Windows\SysWOW64\Kmegkp32.exe
        
        C:\Windows\system32\Kmegkp32.exe
        609⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Kgmlde32.exe
        
        C:\Windows\system32\Kgmlde32.exe
        610⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        611⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Kkkdjcjb.exe
        
        C:\Windows\system32\Kkkdjcjb.exe
        612⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Kphmbjhi.exe
        
        C:\Windows\system32\Kphmbjhi.exe
        613⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        614⤵
        Modifies registry class
        
        PID:11232
        
        C:\Windows\SysWOW64\Kagimmol.exe
        
        C:\Windows\system32\Kagimmol.exe
        615⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Lgdbedmc.exe
        
        C:\Windows\system32\Lgdbedmc.exe
        616⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        617⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Lgfojd32.exe
        
        C:\Windows\system32\Lgfojd32.exe
        618⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Lmqggncn.exe
        
        C:\Windows\system32\Lmqggncn.exe
        619⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Ldjodh32.exe
        
        C:\Windows\system32\Ldjodh32.exe
        620⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Ligglo32.exe
        
        C:\Windows\system32\Ligglo32.exe
        621⤵
        Drops file in System32 directory
        
        PID:1300
        
        C:\Windows\SysWOW64\Ldmlih32.exe
        
        C:\Windows\system32\Ldmlih32.exe
        622⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Lijdbofo.exe
        
        C:\Windows\system32\Lijdbofo.exe
        623⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Lpcmoi32.exe
        
        C:\Windows\system32\Lpcmoi32.exe
        624⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        625⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Lacihleo.exe
        
        C:\Windows\system32\Lacihleo.exe
        626⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Mcdepd32.exe
        
        C:\Windows\system32\Mcdepd32.exe
        627⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        628⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        629⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Mciokcgg.exe
        
        C:\Windows\system32\Mciokcgg.exe
        630⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Mnochl32.exe
        
        C:\Windows\system32\Mnochl32.exe
        631⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        632⤵
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        633⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Mcnhfb32.exe
        
        C:\Windows\system32\Mcnhfb32.exe
        634⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Mjhqcmjo.exe
        
        C:\Windows\system32\Mjhqcmjo.exe
        635⤵
        Drops file in System32 directory
        
        PID:10652
        
        C:\Windows\SysWOW64\Nqaipgal.exe
        
        C:\Windows\system32\Nqaipgal.exe
        636⤵
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        637⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Nqdeefpi.exe
        
        C:\Windows\system32\Nqdeefpi.exe
        638⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Nkijbooo.exe
        
        C:\Windows\system32\Nkijbooo.exe
        639⤵
        Drops file in System32 directory
        
        PID:11196
        
        C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        640⤵
        Modifies registry class
        
        PID:11248
        
        C:\Windows\SysWOW64\Ncenga32.exe
        
        C:\Windows\system32\Ncenga32.exe
        641⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Njogdldg.exe
        
        C:\Windows\system32\Njogdldg.exe
        642⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        643⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Njacikbd.exe
        
        C:\Windows\system32\Njacikbd.exe
        644⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        645⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        646⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Ojfmdk32.exe
        
        C:\Windows\system32\Ojfmdk32.exe
        647⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Odkaac32.exe
        
        C:\Windows\system32\Odkaac32.exe
        648⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        649⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        650⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        651⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        652⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        653⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Odbgbb32.exe
        
        C:\Windows\system32\Odbgbb32.exe
        654⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        655⤵
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Pgcpdn32.exe
        
        C:\Windows\system32\Pgcpdn32.exe
        656⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Pbhdafdd.exe
        
        C:\Windows\system32\Pbhdafdd.exe
        657⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pkaijl32.exe
        
        C:\Windows\system32\Pkaijl32.exe
        658⤵
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Pbkagfba.exe
        
        C:\Windows\system32\Pbkagfba.exe
        659⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Pcojdnfm.exe
        
        C:\Windows\system32\Pcojdnfm.exe
        660⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Pndoagfc.exe
        
        C:\Windows\system32\Pndoagfc.exe
        661⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Pengna32.exe
        
        C:\Windows\system32\Pengna32.exe
        662⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Pkhokkel.exe
        
        C:\Windows\system32\Pkhokkel.exe
        663⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Qaegcb32.exe
        
        C:\Windows\system32\Qaegcb32.exe
        664⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        665⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Qagdia32.exe
        
        C:\Windows\system32\Qagdia32.exe
        666⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Agcikk32.exe
        
        C:\Windows\system32\Agcikk32.exe
        668⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Abimhd32.exe
        
        C:\Windows\system32\Abimhd32.exe
        669⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Ahffqk32.exe
        
        C:\Windows\system32\Ahffqk32.exe
        670⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Anpnmele.exe
        
        C:\Windows\system32\Anpnmele.exe
        671⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Aanjiqki.exe
        
        C:\Windows\system32\Aanjiqki.exe
        672⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Alcofi32.exe
        
        C:\Windows\system32\Alcofi32.exe
        673⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Aaqgop32.exe
        
        C:\Windows\system32\Aaqgop32.exe
        674⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Ajikhfpg.exe
        
        C:\Windows\system32\Ajikhfpg.exe
        675⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Aaccdp32.exe
        
        C:\Windows\system32\Aaccdp32.exe
        676⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ahmlaj32.exe
        
        C:\Windows\system32\Ahmlaj32.exe
        677⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Bngdndfn.exe
        
        C:\Windows\system32\Bngdndfn.exe
        678⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Beqljn32.exe
        
        C:\Windows\system32\Beqljn32.exe
        679⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Bbemdb32.exe
        
        C:\Windows\system32\Bbemdb32.exe
        680⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        681⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Bbgiibja.exe
        
        C:\Windows\system32\Bbgiibja.exe
        682⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1584
        
        C:\Windows\SysWOW64\Bhdbaihi.exe
        
        C:\Windows\system32\Bhdbaihi.exe
        683⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Bbifobho.exe
        
        C:\Windows\system32\Bbifobho.exe
        684⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Bhfogiff.exe
        
        C:\Windows\system32\Bhfogiff.exe
        685⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        686⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        687⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        688⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        689⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Cknnjcmo.exe
        
        C:\Windows\system32\Cknnjcmo.exe
        690⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        691⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Chbncg32.exe
        
        C:\Windows\system32\Chbncg32.exe
        692⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Cbgbpp32.exe
        
        C:\Windows\system32\Cbgbpp32.exe
        693⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Cdiohhbm.exe
        
        C:\Windows\system32\Cdiohhbm.exe
        694⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ddklnh32.exe
        
        C:\Windows\system32\Ddklnh32.exe
        695⤵
        
        PID:980
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        696⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        697⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Dhnnoe32.exe
        
        C:\Windows\system32\Dhnnoe32.exe
        698⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Dccbln32.exe
        
        C:\Windows\system32\Dccbln32.exe
        699⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        700⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        701⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Eedkniob.exe
        
        C:\Windows\system32\Eedkniob.exe
        702⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        703⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Eaklcj32.exe
        
        C:\Windows\system32\Eaklcj32.exe
        704⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ehgqed32.exe
        
        C:\Windows\system32\Ehgqed32.exe
        705⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Eoaianan.exe
        
        C:\Windows\system32\Eoaianan.exe
        706⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ednajepe.exe
        
        C:\Windows\system32\Ednajepe.exe
        707⤵
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        708⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        709⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        710⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        711⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fklcbocl.exe
        
        C:\Windows\system32\Fklcbocl.exe
        712⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        713⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Fllplajo.exe
        
        C:\Windows\system32\Fllplajo.exe
        714⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Fdgdpdgj.exe
        
        C:\Windows\system32\Fdgdpdgj.exe
        715⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Fkalmn32.exe
        
        C:\Windows\system32\Fkalmn32.exe
        716⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        717⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fkcibnmd.exe
        
        C:\Windows\system32\Fkcibnmd.exe
        718⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        719⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Gkffhmka.exe
        
        C:\Windows\system32\Gkffhmka.exe
        720⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Gfkjef32.exe
        
        C:\Windows\system32\Gfkjef32.exe
        721⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Goconkah.exe
        
        C:\Windows\system32\Goconkah.exe
        722⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        723⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Gcagdj32.exe
        
        C:\Windows\system32\Gcagdj32.exe
        724⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ghnpmqef.exe
        
        C:\Windows\system32\Ghnpmqef.exe
        725⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Gbgdef32.exe
        
        C:\Windows\system32\Gbgdef32.exe
        726⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Giqlbqcc.exe
        
        C:\Windows\system32\Giqlbqcc.exe
        727⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        728⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        729⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Hcimei32.exe
        
        C:\Windows\system32\Hcimei32.exe
        730⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        731⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Hfiffd32.exe
        
        C:\Windows\system32\Hfiffd32.exe
        732⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        733⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Hflclcle.exe
        
        C:\Windows\system32\Hflclcle.exe
        734⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        735⤵
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\Hcpcehko.exe
        
        C:\Windows\system32\Hcpcehko.exe
        736⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        737⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        738⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Ifplgc32.exe
        
        C:\Windows\system32\Ifplgc32.exe
        739⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Imjddmpl.exe
        
        C:\Windows\system32\Imjddmpl.exe
        740⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Ibgmldnd.exe
        
        C:\Windows\system32\Ibgmldnd.exe
        741⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        742⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        743⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Ipmjkh32.exe
        
        C:\Windows\system32\Ipmjkh32.exe
        744⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11636
        
        C:\Windows\SysWOW64\Ifgbhbbh.exe
        
        C:\Windows\system32\Ifgbhbbh.exe
        745⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        746⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Ickcaf32.exe
        
        C:\Windows\system32\Ickcaf32.exe
        747⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11756
        
        C:\Windows\SysWOW64\Iihkjm32.exe
        
        C:\Windows\system32\Iihkjm32.exe
        748⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        749⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Jpdqlgdc.exe
        
        C:\Windows\system32\Jpdqlgdc.exe
        750⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Jeaidn32.exe
        
        C:\Windows\system32\Jeaidn32.exe
        751⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11936
        
        C:\Windows\SysWOW64\Jpgmaf32.exe
        
        C:\Windows\system32\Jpgmaf32.exe
        752⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        753⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        754⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12068
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        755⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Klddgfbl.exe
        
        C:\Windows\system32\Klddgfbl.exe
        756⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        757⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Kihdqkaf.exe
        
        C:\Windows\system32\Kihdqkaf.exe
        758⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        759⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        760⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        761⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        762⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        763⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Lmkfah32.exe
        
        C:\Windows\system32\Lmkfah32.exe
        764⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        765⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Libggiik.exe
        
        C:\Windows\system32\Libggiik.exe
        766⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Ldgkdbia.exe
        
        C:\Windows\system32\Ldgkdbia.exe
        767⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        768⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        769⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Lemagjjj.exe
        
        C:\Windows\system32\Lemagjjj.exe
        770⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lpcedbjp.exe
        
        C:\Windows\system32\Lpcedbjp.exe
        771⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        772⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Mljficpd.exe
        
        C:\Windows\system32\Mljficpd.exe
        773⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        774⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        775⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Mpoepa32.exe
        
        C:\Windows\system32\Mpoepa32.exe
        776⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Nepgcgje.exe
        
        C:\Windows\system32\Nepgcgje.exe
        777⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        778⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Nnjljd32.exe
        
        C:\Windows\system32\Nnjljd32.exe
        779⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        780⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Ocknmjcf.exe
        
        C:\Windows\system32\Ocknmjcf.exe
        781⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        782⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        783⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1880
        
        C:\Windows\SysWOW64\Ocdqcikl.exe
        
        C:\Windows\system32\Ocdqcikl.exe
        784⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Pmmelo32.exe
        
        C:\Windows\system32\Pmmelo32.exe
        785⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        786⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Pmoabn32.exe
        
        C:\Windows\system32\Pmoabn32.exe
        787⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Pcijoh32.exe
        
        C:\Windows\system32\Pcijoh32.exe
        788⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Pjcbkbnc.exe
        
        C:\Windows\system32\Pjcbkbnc.exe
        789⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        790⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Pfjcpc32.exe
        
        C:\Windows\system32\Pfjcpc32.exe
        791⤵
        Drops file in System32 directory
        
        PID:11660
        
        C:\Windows\SysWOW64\Pqpgnl32.exe
        
        C:\Windows\system32\Pqpgnl32.exe
        792⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        793⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        794⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        795⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 240
        796⤵
        Program crash
        
        PID:6768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6956 -ip 6956
1⤵
PID:6172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
90KB

MD5
b467c63d1730f953138f2385956e4af1

SHA1
e00d42344eb4daa84561e9ae064b207c6e2a9143

SHA256
9abc8d13c6f20e71db555f1c9c149305952c2afa81c0253dc343cb7933ee1d2a

SHA512
2b723c7634e8e1bd10b2542c7431b01a02f4440dd4b64d39ff5fa117c6700814ac3e9b5bcb7365c9879f973e4f0a683133839cb3250b0f0221d7e8d6d064b650

Download Submit
C:\Windows\SysWOW64\Agpqnd32.exe

Filesize
90KB

MD5
72d049d85f620e6ca0285664e5d4eada

SHA1
3dfe15147c4069fb6448ab12410637d75f6ddfd1

SHA256
24897b48b4d18d0aaa4bf8dce64e7e57c09009a2df7291276273390ad1985440

SHA512
48fd795d2e55ed2780fdca521d59c0cbc6a818e6ba5fbb74ad4e58148741cf36f4d0753f4838c1e3bdc14f47f537cce12530175c29fccdf3d5d5bd788d544ef7

Download Submit
C:\Windows\SysWOW64\Aldeap32.exe

Filesize
90KB

MD5
b2dbd257698f90abeefa0629bfa4346c

SHA1
851ae0e2e612a7e5bbb2c161076c7b34775a0559

SHA256
d00258ec7ce31c5918400b6d44a040aa5fe8a04f29a82a13383fbed9cad1eb7f

SHA512
5eab7899d5655fcd92b1f10f5477af70e58ef6f962321e6775f163d42a4f3c39e5115623d10320a30e90293f325667a0250877aa219832caa1634ba6e2264ed5

Download Submit
C:\Windows\SysWOW64\Baegibae.exe

Filesize
90KB

MD5
3c414f050f41a9afb1228ca1be679126

SHA1
6c19e72e0a17e7c71df7770737126cb1d9c82f59

SHA256
cad1d97ce082218877db2d18d19f9ae52315b359b23b9658d2c87497ae15effa

SHA512
6e0daac2002bc1aed77d41e3bd08c7e14e3ecd881dd8ee45cdf18742edde99abd7dbfb1f222c9fa8d3eddeea031da82ef93a475502376943313c339f176e7201

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
90KB

MD5
625059865c71a34160046c6e97c25116

SHA1
8276d8b044dcee3ed8eaadebf66b37ba11c3f33b

SHA256
efe333121f81b0fac24ecbe3cbea01ed312dc5f6180cfa831f903266ecb23677

SHA512
a6bcb4e7164f390df7560740cc74e2e632fb33986f5a01b32e91d460725fa758079e8a13cad85f0d531686f531fccc8fd926e7fed3f368030a11cda17a57915a

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
90KB

MD5
964d73fceddb9f987696ec56aea3b723

SHA1
9fced8c882051d3d0480540391a0a8027d366b13

SHA256
30c5d83fef5da04cb4e38449c14a84feab164a1e851173fa85ecb1237f5fce84

SHA512
ab449c71d6f3679fec98eae9ed0b3cd301f1020f7f6b8489fbff59a242d65d79fcbb77ac78c24a32e651a54319fc767be84ffcedebdf1e76344706a2218c9815

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
90KB

MD5
957ed99e8562c6f64239510ccf735778

SHA1
2fb42ea1e73e62732af6a1e546eab4ceccd2f49b

SHA256
2faf9920c4dfd4e7e4b1b8ce6eafdb68e973060262aedd5a9e9ed282b4822aef

SHA512
cef9d48a9352dfb3dcb4aed98aa32f8cb3f14eb8839f6bc9c156261f2b901c4ceb8a6fb8d2cc39292de40ef1d1948654a767c5a98b6d3df36246fbcef19bffbd

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
90KB

MD5
a81d02eebb26793db0bdc049e69382d2

SHA1
37ee2373da95e2b2cca3c550b1f1a960624a8cc0

SHA256
49bc866e21a4e3e99c817bba2bce713bc9459e7aaab0d7f5883182bb1c91296f

SHA512
30856a5fb78e6d734871017fdef47318ef44dcf530fcc88d76d2f524887b6197c9ff301acac61f4d002fa9aefb9e8e4f575bb65b94730e85a9eebe044f887dbf

Download Submit
C:\Windows\SysWOW64\Cbhbbn32.exe

Filesize
90KB

MD5
e0288887d99fac427a665c29d4372232

SHA1
3ef06752672bd3ab88ca3cda9a9c58943fb7d3b8

SHA256
cbd84853bb17061c003ebb17e50ffb7885ba700ec8656f2f9471161229ac648a

SHA512
7445a9fc9756b8fc631a742b205138bd5bba8fdfba5f0b81a23ac59c54b9d76c4627348515e791e3ddc4d94ce33a8c610bdf0a688cf1521c96665b7f3a0e8314

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
90KB

MD5
de8da2307eccca607b5046b2b8ec839d

SHA1
ab039c50f7c8d2dd3434e8e623ff0b0f47fb29eb

SHA256
991b158c4883aa219919d47acc1a049dd4c865e5c7e2c18277b037c753944c58

SHA512
b5622fd730aefe422a0ab66f7aeadafc3f516c8ba96fd2372fd0d0dcecbe10be02e723c1badabc4989fed224e1a40068bea61e9810ce2ea3377938fa0f407a92

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
90KB

MD5
cbf2fe63aeb6929b7511ce86f1faa860

SHA1
5a68630db40bab3a9a969f3b10f24d469593d14e

SHA256
5d05879615e993e2803b3112476974a359078197e6b01ec92b639693c9135d53

SHA512
b45a93ae26f3fc741b7eca7153e35cd706f441b902feb72c71117c113dd59977dd54c05b81bbd31e0728b63805a85060e5bf979b6165e3e008e2386818c5784d

Download Submit
C:\Windows\SysWOW64\Coojpg32.exe

Filesize
90KB

MD5
1a2cd32ba2bae5e443edac81e3eaedd5

SHA1
5dbb185f02fad6fd8b74a7944692eb5f734ac99e

SHA256
d6d2459d3d78143596685ead67561ea324f08ac0189ae75d90a52cb9dac92c26

SHA512
37c4c44ee4f9bc7ec305f521e61363cc9a3b20b9762a93d3066821c15e0291623b7482f5cc27ecce32edede27e1b6191abb36c58e5939258a6726a935127af8f

Download Submit
C:\Windows\SysWOW64\Dalofi32.exe

Filesize
90KB

MD5
2d759feeebb6074d670b14bae485c616

SHA1
63d3b82eae64a1b312b9f975c14eaba08bd7f5f6

SHA256
a6e3bf072566341437501874869ca274859d2299d48e7db4f0e53b4048bec801

SHA512
4fac037b33641643076b1a7934322f2c39b35704d970dba8216eb5e793aec0d5d96d64c7f872ab1a77a7e4a76fd4f222a46ebf9bfd272184d45764d438fe8d64

Download Submit
C:\Windows\SysWOW64\Ddkbmj32.exe

Filesize
90KB

MD5
50b2d3b740571cc725af1514e4ec2446

SHA1
202f5bbeadb48d6ab39254bb27a25510cfe68511

SHA256
51b43b559a032cf3a7c5c2ae6baf688fc3c478c4c35b58e30661a1fb742aba90

SHA512
12d2fccd705cb3be8d947a5722156adea0e02ef42571d7e76cd9911b64688f3e74b78593645fb6faebf600b898d3d7ed27af3b57699839ec25e779a80b029234

Download Submit
C:\Windows\SysWOW64\Dhikci32.exe

Filesize
90KB

MD5
c633efd6f702706d34c6d7da10bd2794

SHA1
e0bae10dccb5f663a481f0eaa6700832b3ca7c29

SHA256
d271d4c9b9796a431d545753178a1e791be892d82c0ee30453896ffd7996cb21

SHA512
caeaf8608883167885c174cf60d9becd4638d8335b9d357bc1b2c9d7f50ddf2f9b9524bf843b9b2ec8834f63fb0009df84de16ac64008401c4dff9fffb27f72e

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
90KB

MD5
418763ebdfc9397c230433192810c360

SHA1
6fc8c5df8ea0fcfff7acde5694fb8fc6fb0b8df1

SHA256
c6237da487c9574c87a375ab09010e77bc74a0a0da3164a83cc35fae0a96ba77

SHA512
681005a535c352549e417cd6707dd265e533ae8931a10f4bf0016212a913aff7c9e7ca481747e0e102b2b4eeb348970a23a5927cab8bf7be2c4923890876d0bc

Download Submit
C:\Windows\SysWOW64\Ebplhp32.exe

Filesize
90KB

MD5
4883cb5ec4a542a6d9622aaa9ac98028

SHA1
eab7b185c347059852037dfdc8bcc53df230f98d

SHA256
5309c24131a349c0a2ce22d1126b0904f5717adf1db2fbe88ca7f345e5f250bb

SHA512
1a6b9290782114094d04ec33bcc63c94ec45032031368235b856cd9b4f523aef0e51a86198cc5870472ad5ab4b22834c35951ee86a9cf039fc3fdb4550256232

Download Submit
C:\Windows\SysWOW64\Eddodfhp.exe

Filesize
90KB

MD5
4558373677d33f3ac4764251cf4d64ab

SHA1
80fcda8a22973ab31cc5a85524a8863fc89cefa6

SHA256
c60ca5a87ee89d71539bc2991e0861de692fd4a37220bc3e9bc3ec7d5f4511be

SHA512
700b22d26994a17e64f3e26a1c8bc9b89da34c7e2eb66d7b1efa67eefd212fa1e944791651899a96ae4cfe5cd89ca5ac8f81fb379e286020a448382ab86b2631

Download Submit
C:\Windows\SysWOW64\Edplhjhi.exe

Filesize
90KB

MD5
cb26ab420c374edb18c5d0d2149e960e

SHA1
56e60b8ee4743dd63dfa74af5ae6f7fdfa36c715

SHA256
747a3bcb271c20e595904932ccf696f63bd433eb0df6c148db30b9ab5798c59f

SHA512
82932f50c6b33976c67b05563e9454a85a52683f9313f589207a2d3571e184382e32a9ffd198b220cd0ef0e17a84be455a4f8bc2cf0e15f9c981269a9ecf248e

Download Submit
C:\Windows\SysWOW64\Egegjn32.exe

Filesize
90KB

MD5
4b672f7b7a8785178244f5fabf0694d5

SHA1
81f5d0d0a2eec3eca6c0182843fb4afeb9355f96

SHA256
f11def10f61fb3a60c46c3cc122dcf0e6c9b8d136c22324f893240376c1145bb

SHA512
09dae9945976d3b7f7890c6f4f69682a6c6148f241b141b1455d2a1e388e8148617d3ae906f1844abd1f8b3c08382b38c37284983e3c09f0e6b80a1fcd0ad458

Download Submit
C:\Windows\SysWOW64\Ekonpckp.exe

Filesize
90KB

MD5
67c0dda0cf53058a4e5d009e91143082

SHA1
6e30849ccf79178b152f1adfc17cf3e7f1c609ab

SHA256
d635691e4e5ca0bbd828d6554a9d3dee01555a88a3c349c07d92b7b90d64ce4c

SHA512
9faaa451f97923ed37cc20086153b23e12d7b21cfe3cd33bbad92bc6d3a793a9e306c7d1fef531129434637577c72afc3fb5d21909c1c1d2a07f974370ed0735

Download Submit
C:\Windows\SysWOW64\Fhefmjlp.exe

Filesize
90KB

MD5
8797583fcbb207b9adcff1088a737efe

SHA1
442d71bcba63b73d5a344150395500568e7c27f7

SHA256
72b40fa00754e43a0bc70a9d0255ab9bfb564da042b441f2a107960c24bb07a0

SHA512
0c666d210aa4bbf0508634a99c2d22482e9d54beaff9e233cfc59a34a39b707db169dcddf4c9441a7faccebaba86acf6d20afd654c492fb80af1c3e115f73eb9

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
90KB

MD5
dd96a1f50e14e3b150902d6f65aec14a

SHA1
e03a6398515e43f4a1727a065c974867b51a1d4d

SHA256
3564fbae9925b93b96399154fa7091d36565f3770e500a8e478873521d2e5090

SHA512
ac70f8313faf4b7d9569a272700c787ed16657addfc7058089274aeb6a4f3bdfa65475b996c8f3fec3fe7ad7222bdecf5d3051e57470be8ada39735501db7d6c

Download Submit
C:\Windows\SysWOW64\Foapaa32.exe

Filesize
90KB

MD5
cf160fa5267ee6357fb85b3559ddf3ea

SHA1
a5306e2b21121e10ccec356eb1fda508326ee9d6

SHA256
04e9d0253dc8eb8585a5f55613dc29d046c15138099aac74add37003cf20096d

SHA512
f813ba01bb32ddfd348392c3e9b10b0a4d4bbe24d44d6835d481bdd6730f7aa9551015d3edb9075c0447325aa505531ae64d76a178deaee6d80a2c43950e8d51

Download Submit
C:\Windows\SysWOW64\Fqgedh32.exe

Filesize
90KB

MD5
48ae74d52f8f4d499c637c5f0aa1cc7e

SHA1
1c6809ab07ea9bb6ceef5b24a523429190efc5dd

SHA256
c8205c24a517dd5c11e67403a2f1ee85957f2466809c8ac7f06443806fd58bc5

SHA512
fb9a1da39520b52bfa4d19c45ce61d5add01eaebd993ac3323080b09254ddfd24786548affed2c171fb45dd7e989ab5549695bb5307fdaf05f6c722ce3107322

Download Submit
C:\Windows\SysWOW64\Gcmpgpkp.exe

Filesize
90KB

MD5
ec5c853fff80d946fb976015abe2c444

SHA1
f34263d89c0807d5d4383488f5b29178cdc02354

SHA256
b0ae43a3162f101e16d114b95952507d58a41f82aa3dc2198f027f3269556cb6

SHA512
7cda1e934576ad91499882fe7737caf3a035d3f63418e842b867e31316b4347038c94e310a8162b6792829f055490779175198afeaa808b58f7ee5a3250ea82c

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
90KB

MD5
be7518d0e8f2d589a61af0458a240695

SHA1
baecc4fd30223c27816a441c9dcfda0386ffa0c1

SHA256
e334403294d90bfeb5417456a72786745b1f3a511cd28198c27688caf592cbc1

SHA512
80bfb416a97830427d05b02de6cde0956e2529d1926dd526aaad05bf5d9affabf6e30d2348c72a431ad453ce97ea9cef7e755b8b3a7cedce4cc9c3bab8212e70

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
90KB

MD5
92c4efa5ef0b1ffff453ab80303c09f1

SHA1
2dd809e1928f980995c97ba65001fadcf4e9e657

SHA256
663148aceb7e4f38ab5e7de42af7c41121f8216bbc814a366ccbec6cfea79d2b

SHA512
edf6d7e55a53a4ae10697e4bf1d73a34b9630726dd54fe23ae44b6b675cf9d5382c57abf2e551d1575a1fc8b06a019586d2d56753539fab790a1247a31b71de8

Download Submit
C:\Windows\SysWOW64\Gngeik32.exe

Filesize
90KB

MD5
559fc12935303d15dfc2a3bd280385ab

SHA1
11fb8102b23e2af5304f9705b83b30e633727b3a

SHA256
6649f0409560ae908df3e857987938820582b97b1969f138d06026d76aa561e0

SHA512
07cfda833e23b342ee93402855c611e940f60c03aaef5e87c477ebb1e26277b84ab79e53453e17ef33822239dadecb5d1def1f8f8716c54545401a3714cc8364

Download Submit
C:\Windows\SysWOW64\Hkfoel32.dll

Filesize
7KB

MD5
2b29fd4be4e1d42f3704147c1b34e56a

SHA1
4304262706c52efb703f2711c4c466cc664b2957

SHA256
8fc89ef79f02cecdb0f43bcf8f3eb6f1c886f551e99e2cf90ae5cfbc2ba73020

SHA512
c83e82771350d2ecbc6a7a25e62fb364cab4759a78982099148ee052542f741eae8178a593ffd042ac3499dc8d2070f3155cee56d316dd74ecf721dccfd43705

Download Submit
C:\Windows\SysWOW64\Iacngdgj.exe

Filesize
90KB

MD5
64187d3a9f58533a7875d2c1a6c82ef9

SHA1
76043f093b256e19c1301ad9bbc6834acda1eeb0

SHA256
37dfaecb9349ce42110039522ffd6a768ad5086ee3b2bdc2dea07ea9cc3e8c43

SHA512
271c62137eda61ca6eedfd4be3ed86b5981f1020af3ced963673872d7bfad1321ec51d9ad1173776d4c3c37813286ee95de2d3c5ef90d17cbe7beb39ed72175a

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
90KB

MD5
7bc62ad2dacd45d9390a835347938ce5

SHA1
e81498080c8e0374cef1a0aa8b9f525760c607f9

SHA256
6f91e111ba1e963f2f0ac83e20ce91df21fe181de0e79049f8ab966abff36f80

SHA512
2ef3cb2c42c645467085828490a2691f15210442d2605d764f40a14a2519b71654031ac1ac71fc627f2508e96c094601a89ac09ee6fa341e818e094deb4a2cb5

Download Submit
C:\Windows\SysWOW64\Jhgiim32.exe

Filesize
90KB

MD5
db09b5f61da535609775744ed3f74a00

SHA1
d327f8f003c2922b7c01b9ace2ac4504709a8ca2

SHA256
d6e106c7528b24b76558a07e74c079b04d2d99e431bde861b9cf1a3d1ddd1bc5

SHA512
97c4464b5c46001a0a58db04a7e0d03482c4e6894ebb94ca1aeb09e4503af56fb88bbb2c9f860bb82ae4beb04b47b64f4237c850607128fe3f69179f2424f24d

Download Submit
C:\Windows\SysWOW64\Jihbip32.exe

Filesize
90KB

MD5
af7cbe46fdc41473bfb18f76a54f81f2

SHA1
1f7bfbd5a5a359d27a89a9c25d86fa8ef99a8b4d

SHA256
3f20db0e78337cbd2b0e8f6ad300cae2b045f0a1baae8ba98d221b7e24f93746

SHA512
775046b5a33dd421075abe950ea7110cd275732100a928a37bd22fe2a382b57f9682d8a3e59c9184323aa19765958d78bea9f0af97205b409cdd78df84a2e825

Download Submit
C:\Windows\SysWOW64\Jllhpkfk.exe

Filesize
90KB

MD5
99576f64f682ac77eb22a3a8949bf2b1

SHA1
95965abdb6b08e40b93fd2c7909bb45e268070bb

SHA256
5c614e3d133f63c053369fc462879440492b2c3c59bf7847ce30e73d0b7cc264

SHA512
1879d7ea907af8d9ce6885362537b4a9c44450140e7430f6647e13d5a7966aa4abfb629412ff028198dbf530b3ccf7381daf27b092f341ad6d4c8a8391a1c8ed

Download Submit
C:\Windows\SysWOW64\Joekag32.exe

Filesize
90KB

MD5
d3e67d69292fa2a4de5520f7573f91d6

SHA1
fce6ca594eae9dffc879aa03afe5bde13ff518fb

SHA256
aa368b0f119bfc5eaa58d6435a8df53a273e722354e2c4ac7818e7957df7ae06

SHA512
b3710e58cb236409f82fd341657857661457e47a005533211729a28fad33fce28c0f78b4284c326b289cd2c76eb5c285eb5a31a2139eb0d1aafbd61875c43105

Download Submit
C:\Windows\SysWOW64\Kibeoo32.exe

Filesize
90KB

MD5
8f221a45485778e6c1210f830447067d

SHA1
313c475278ce9b4a80ac0d4bc7584561aa33c53b

SHA256
830fa279c8a9f12902a3d3057560cb2b9d7b474b4f23b103cfa059f2c61be5f2

SHA512
6d0050767fa8e6c31b8cba02a9721740f8d1771abe2a928f1145a4712a3b42d11b27b0323d4035b7f52b4fb71cf3c0a5f3ed49a82af55c00d0d453ed156bef53

Download Submit
C:\Windows\SysWOW64\Kjcccm32.exe

Filesize
90KB

MD5
ccd70d42aea709c5feee495e29dfd77d

SHA1
8cf380ed64c2db48f8c29bf250c728571a8b271c

SHA256
db3e041175dd52ad263a377af63c2d4a3c3967e3a8c0000df63aaf6f78fa87f6

SHA512
09af6f7f146542b53d64e4884aef3d1091120e4f41bc85c447113b9d50d96f3aba37025dd214f82b6822db68a565ed3616cf91abbafdb1edb11ded62587914d2

Download Submit
C:\Windows\SysWOW64\Knkcmild.exe

Filesize
90KB

MD5
11b7a8a52f6d2afdcd53c38b655ac910

SHA1
9e298bde2c1a9c1ea58378b5549a6dcbbb353719

SHA256
cedd2656317209482bae43c89119c7d090018bb206a298674ed0aed07fe66548

SHA512
1ea9b88f732ea9e00d3ee1c385bdaed612ce91e164d7e9dfa56210381290e186deaaabd3861dfc6afc2ee905a890c1503d2aaf43dfe02d3db3071191fe004a30

Download Submit
C:\Windows\SysWOW64\Laacmbkm.exe

Filesize
90KB

MD5
2cd84adb62d062c09dc296ef393d6ae3

SHA1
cd103c6576553e4fe9455a61e7f1091576b33100

SHA256
f3b1d8b8572b26735cf79681766c2626c9323a50637cbd61785525867f1203af

SHA512
00d22a06388e2bdbd93109fbbe963822df345c05a14fb4286a8a35219c578e98560d767eb08c9858ae58ed193d39e6d93d938a0f207f7c0c1628fbf905c8633b

Download Submit
C:\Windows\SysWOW64\Lechkaga.exe

Filesize
90KB

MD5
228873b8ca5808357d3dbc8906d64673

SHA1
576249183f917aeca9763f4440eac7fa6b41aaf1

SHA256
fc4c3df3ccf9b5310ca966ccc7748ac2f8d2cbfc37de70b2c0c8e400bd59554d

SHA512
8bcd0fd9cccb1bbfa0cf75cb0fa2870e8c4a2a13bde0e7f072f422fe5f80b8853ff910b41bdf866bd2b7871403b25b58b13c8cfaf58aa133494e04aeb225887a

Download Submit
C:\Windows\SysWOW64\Ledepn32.exe

Filesize
90KB

MD5
c9b99c204a0faef910684d7eabb264bb

SHA1
5536ebe2b328c23140f15369cb6d99427828a395

SHA256
acd95df970f1bd3a34a74b7e188a6aad0dfd2bc925e43a840e81c0edef990098

SHA512
46267fc05da71a729b4a9b282aec36307348750722cf162f9180945604ddc959ac1e3f08f7f28af9b4e7a67899e298ee7bc4ab340105168b62e796158e99058e

Download Submit
C:\Windows\SysWOW64\Logicn32.exe

Filesize
90KB

MD5
6bae4c55ca6f44870d39ab5e13e38548

SHA1
7b149024dd233102a731cd83ecbbe9e119d68d9a

SHA256
10d682e11321068927ca6c6adead7a83008ba5dbf397e5de52f6dd998820ce0c

SHA512
a6c07b1966d1497428e3f8010512cee4f500536743aca9a6dd2f8cad67dc3917ffa983814a6ace03bbd7b46909b327997fbe24b0708d25fde345f5ea81ea7072

Download Submit
C:\Windows\SysWOW64\Mddidm32.exe

Filesize
90KB

MD5
d372d27d5315be2c1d3d4e1ca0b31ef9

SHA1
4873070cca123506033be8d792cee286bd66a432

SHA256
f66d56bbeb92da2d66b6af0b66f856314082900c329f94b074029abd278632d2

SHA512
78bdc1a7236d938dc637bdfeacb1365bec19a3ec3200fa7c6e2c8c0690e6ca0952fe35b53526f4edbe651508a2d4672b3d523fbddbedae523013abe42d8dbd65

Download Submit
C:\Windows\SysWOW64\Mkepineo.exe

Filesize
90KB

MD5
f4cea71b9e2792fc2ff31e0dbb871ffa

SHA1
c5c8d07eebfb0e050dc08018d0c35f41e32568a7

SHA256
b3a22d508b16dc99370b77b3e3e52392dd0ab84f99d7e981f292074885586173

SHA512
5868e2d7b220c76be003b808d4263c9918d1787baab1339a2e9319649b7bde3f39e97689e4300121c929ecdca34803dba569861cd382ceb617d70a9db714d712

Download Submit
C:\Windows\SysWOW64\Mofmobmo.exe

Filesize
90KB

MD5
fe08e100b6803174beb08c1f781c7578

SHA1
241672816275c94096c49c58e9ca6fe06c548a16

SHA256
4ee394e9a5da1784cf131dfec27c25ddf3524a558a4d276e1b88730c6ec3def5

SHA512
0e2a1ffa89a792d9aebc4134b1eb403b93361e731153c681ea0deeff96ba33a86b64380d901e0cbffa1b55ea8eed4828daaf5594e91eb4a122be3bdb2e21ede1

Download Submit
C:\Windows\SysWOW64\Mqpcdn32.exe

Filesize
90KB

MD5
47468ec64e925c00818d26a6388766ca

SHA1
a1418d55d86d38163b1e3a7de559f2b804d61273

SHA256
7d65bcd3c178a45c938518c706c587c9f3253c475aa100f5cb0c35c6cd107ce7

SHA512
b403a40f5dfa9e55b76eb31b110697e771d453db4832434d80046fcd04458e4906db6ae9e0fe9c73f22525f001650241d3886df7d333ceb8f8f69f54b428625b

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
90KB

MD5
164aa82a772733fc1e732c61ea62b566

SHA1
934179e3e3ff6d28deadd1d9ff72eafbbb85104f

SHA256
afd3c193d1558d3ca492665a606ffcf23ccb39c74ab6429c1e9e3507e04240d9

SHA512
fe906afc1bfbfa2bf1bd1af720aa73efe79684a4790a70e1724daf0091c53ad319f80716d8ed16f8de3ccc4fd90a47875b0144d10681fbf6eab847e8dcbd2418

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
90KB

MD5
cc1bf682ec9c8428a474b135d1d3187e

SHA1
5fdcc5e8366a74397a57162cc7a2adaa09aa90db

SHA256
3095f9424dc28aeacd5dc92eb303df285587591c1677613eca54a6572e61989c

SHA512
e6ec3105aba7565e4ede13605f91d152bf34180eb3cb58c0a4685997ba5fb16626ee514970c5837109b3c5778fd63f51a7957a38c1183393d0595ae7e45c47e0

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
90KB

MD5
7e78dffef118dfa5f1cf06e4119e5ce4

SHA1
102707043c7fba8e668cd892c0df47a9f710194d

SHA256
ee18169723a724020a477fac140169f9ca5175c3c907df02209efa89955b5061

SHA512
afb81c7cbcc325d3104136a7c5eacd577b1dfee137d591632dc7451dd5b6d97d8cc8cf5cd36214e2023538281477f25be4fda9515018b55e89d04f2b2c8a6dd5

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
64KB

MD5
95ef5cd7d378e5fba0848e18d1a0a876

SHA1
268d5ad5e273183e4d46ce6f0553ed52de59f886

SHA256
808a9265861992efe374d15ed5492beda9fc316124235f444d80c901ec7ff858

SHA512
ab777a76c7aec8d066ca77ecbc0cfadd3694873ed7e33a89cbcd8679dfe1722fb340dcfeffd2370eb4a2447800115388cf2d70b26b755d6c25cf14b9f813a53c

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
90KB

MD5
2197b3ba5007e0c51865be9a4ae2fbe5

SHA1
0018bff1ad73039f837d7c24efa3b837973cdc64

SHA256
7c26373794ed09963ddcee7418a86ee95c0fe2ef39615383d1bad057b1d62f31

SHA512
785dfea2627734a1a8d302ec5495e8d6d6387af5ef268c655aa685f0d6c3f3ffab62723e7b621d1db107b567284a336765f5479aa5198549a70566315886a73f

Download Submit
C:\Windows\SysWOW64\Odbgbb32.exe

Filesize
90KB

MD5
0679e72d1ba78423eaeaafaf1e7ddc05

SHA1
53e20d17032b13901d032b15ffb8fad7e198b9a0

SHA256
6c5c306a56fdf0b7f2993dd52ff168b7f7a31bd1c9a82dad96a868c915b9c77d

SHA512
74e96e4ffadea938aed0b8887619e5a88e32313df1168d82a9076e6b595aa37e120c53e8ef5647a902a6448df16d9cdb586d161d2f2bace32b091a8b500c4610

Download Submit
C:\Windows\SysWOW64\Odidld32.exe

Filesize
90KB

MD5
4c89359c900de30afdedc977e4d9b9aa

SHA1
bcb926fa1edd5f49b5c9903a972ae023f6af8814

SHA256
c227a7c246228305a7071bedb7090cec952dd27a3a69c8543cca1d9153b3dcad

SHA512
09bb95af9b2e649fb813d66d6d983648f72f4a9b63ee2abff90072165327585e0b53870f6c9600fbaf1eeda08f73eab46102bfe86abc5aff03a0770d214b6f3b

Download Submit
C:\Windows\SysWOW64\Opeiadfg.exe

Filesize
90KB

MD5
f7d37b652730c47e1734f23b9044db99

SHA1
a37a6123829acdf4d93d25fac1ba503d7523da62

SHA256
df3415619c0cb2cc102eccc4a46250b53b452d53033f21e5b0a4c8858e9bc437

SHA512
ee8ed20837ed503cbd762f6710ac770646ba132115193aa703f01e628c3f552e567d5be3a3f50428101ec16b25545258eb1b2a27cd7157c24b255d8630315f4b

Download Submit
C:\Windows\SysWOW64\Oplfkeob.exe

Filesize
90KB

MD5
6733ad192bf42db01f064666a8369aaf

SHA1
4a158c7b013a26d8c9dbad550e8fa5043b3281f6

SHA256
7de72ef1d0e9c1e1ea6a13c8c7e1068119aa8d5fe34570c0fe275fe98e9fab3a

SHA512
1cbc9c926e243916b5989a9f067e0721bb1f0956a1a71a1f8213ee04438170468609c76d17663bff7c79349da7e5faef4ba6f5a119a1671d32d032f5f846c7ff

Download Submit
C:\Windows\SysWOW64\Pfjcpc32.exe

Filesize
90KB

MD5
b9a8a47a2644c4c0488c79102f5a266d

SHA1
d1fe39a09a1feba8a2fdf72dfedd092d8486de67

SHA256
ccf1c5980a5c54c2c15bb918d64bbd416a0ec2c6f9b40ae1246250d28f7aad5e

SHA512
96b43149e2c85845cc314bfafb34aa2cb179eb5b57b6485e7817748eaefcb6eb6399f625f0fca727c9212897c3a55f979a34b1dd2de4d5fd3797b8eab3c3054e

Download Submit
C:\Windows\SysWOW64\Pfpidk32.exe

Filesize
90KB

MD5
1b77d9c44eece184f9d71dad6714d2c0

SHA1
4cbd12170f299df53961d6b67b8ced001478112a

SHA256
b88254cfd90890e92729c4a18e2d05baca6d8c4dd8a0ff52ee91e515be5e21ef

SHA512
5a211748792167d633b53dffca61f5d6a041dc9f876659c07db14f3f9c7a4a81f6fd5e7d79f14f4fb67f01c241d20294637e8032fe502a52ae8e9e50c3ce6786

Download Submit
C:\Windows\SysWOW64\Pidlqb32.exe

Filesize
90KB

MD5
26c1a4de29a62cb2b7b4ba3eb3b9df50

SHA1
8661cec1d6cc8ef4948f4b47d6569ab24a8187fb

SHA256
873a10b8ab6b4bcb2a339edb4470dd65e837924359c9fa3464525e5302291b5f

SHA512
02acf2b506cd23f38f6872d6bf971085e693eb1c40c3049f6741ef24e8eaebfe740b1d075799614a0b55e4a7a047ab0aa5a32efe6d15db33268b928b14215465

Download Submit
C:\Windows\SysWOW64\Plgpjhnf.exe

Filesize
90KB

MD5
911688afb9916a0b2047791a06f94d12

SHA1
3a535be57be71ba5e13bfbf446abac9c01c5bf5a

SHA256
d6de23ea0774cbab361ef2744d1619a208af1ca1d2790c7d1a76c751f4bd4df7

SHA512
52fddd3058ddf2c1c3a71c6fa3cc0935594ad06f34ec3d782be163db4b55ccfb87ce03dc954542fb8af9d684a753adb61b8dc60845070ad3bf73f9867463a12f

Download Submit
C:\Windows\SysWOW64\Pmnbfhal.exe

Filesize
90KB

MD5
3c9b2728cf9313ed7740693dbccd115c

SHA1
23ff74c08d0d9cd75a1a7c8571ec8f24eb53205d

SHA256
13a13ae05bde38c3179a7faaed7d2049d9ce6a5d4f80c80e4e37bdd945482224

SHA512
0ea7ae3a89c83c9dc791731eca3baff7ce143a5308a93b1b92801a7d47d741f6209be677302efb239b18f4eb7de95ae6041088476ec017b58e925a45714959f3

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
64KB

MD5
82f93d77e1b0750c19b9e0b159b926aa

SHA1
ce2ad00c68b66d29a8ecb477be927a66f4b035cf

SHA256
34f1a553234712b20eed0653ef7db035d39e549ba9e72ed98520003ac01df860

SHA512
3ff46bff6dcb5e92aa925a94d86b16779ab75459c18eb28facdd0aaab870f0cb0999899371ab015e6b23cdc254f015ee181d74f25a02d3e92a50f45d2bb2454e

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
90KB

MD5
6d83807bd7fd20b5625f42fa04bd0a97

SHA1
1b58c2f5eb8b027c1867dea18d12427a05046018

SHA256
6365852077fd16292a2985301f1f3fc6430849ddfd79a5e383b3d01c9dc68734

SHA512
489cdbdcf2a6426f76feb83dddfab12f487730d74e4bb87486761746cf4febf65db0a54da4c20455f6ca7a45ef92c077264936ad29add9c0bbab163f46a3e654

Download Submit
memory/456-47-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/776-281-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/832-269-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1044-216-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1144-199-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1268-299-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1416-224-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1500-79-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1644-184-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1728-63-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1788-332-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1912-103-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1928-293-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1988-128-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2160-208-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2240-156-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2260-305-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2304-248-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2320-95-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2588-144-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2660-207-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2820-192-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2924-231-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3056-112-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3220-317-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3472-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3504-263-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3536-24-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3676-275-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4044-136-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4144-287-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4192-255-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4252-335-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4272-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4340-119-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4440-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4516-323-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4612-40-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4620-240-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4656-72-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4684-55-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4712-87-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4784-160-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4860-311-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4940-175-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4996-168-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5032-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5140-341-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5188-347-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5232-353-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5272-359-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5312-365-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5352-371-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5400-377-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5448-383-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5504-389-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5544-395-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5588-401-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5640-407-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5700-413-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5744-421-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5788-425-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5828-431-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5868-437-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads