b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe
Size

74KB
MD5

2c9ff6062fadcc369ae2cd5b69f98653
SHA1

62aa451128892bc11b735a5286492f5ca7dd45e0
SHA256

b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f
SHA512

e2c541779d56adf51156ead01fcd14b6e63852a468278975fbd3f887b0ab1efc168b2da59f9807412079aa0208004ba5e621fa2cb89d5abaac162650a4bf6def
SSDEEP

1536:l794+sChfgT1ErKHnqQHtc2fha/v/Op6hrv8H:lR4+UpFtNnZM/OErv8H

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papfgbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhkjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paoollik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahgad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fikbocki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plbmokop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjehmfch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhdohp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pomgjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgihfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klekfinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epffbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkafmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoclopne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cimcan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkimho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lifjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlfelogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bqkill32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgghjjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljgpkonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbenmk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlmbfqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhdohp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdlfhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbfgkffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llodgnja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpffeaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipflihfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onpjichj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjmcnbdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hahokfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmedjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bckkca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcmbee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oeehkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqaffn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pedlgbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clchbqoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biklho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmggfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aflaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Niipjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajbmdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcfahbpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgbjbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgobel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmhmh32.exe

Executes dropped EXE 64 IoCs

pid	Process
368	Hnoklk32.exe
2908	Hheoid32.exe
1464	Hnagak32.exe
1476	Hdlpneli.exe
3856	Hnddgjbj.exe
4504	Hdnldd32.exe
2672	Hfningai.exe
5108	Hofmfmhj.exe
1608	Hhnbpb32.exe
3368	Inkjhi32.exe
1472	Ifdonfka.exe
3900	Ibkpcg32.exe
1544	Ikcdlmgf.exe
4460	Iigdfa32.exe
212	Ibpiogmp.exe
1004	Jodjhkkj.exe
1192	Jilnqqbj.exe
1600	Jnifigpa.exe
1720	Jgakbm32.exe
4320	Jfbkpd32.exe
1808	Jkodhk32.exe
3172	Jfehed32.exe
3300	Jnpmjf32.exe
564	Kldmckic.exe
1420	Kfjapcii.exe
2836	Kgknhl32.exe
2588	Knefeffd.exe
3292	Kijjbofj.exe
3216	Kngcje32.exe
348	Kbekqdjh.exe
5072	Kbghfc32.exe
3316	Kiaqcnpb.exe
1684	Lbjelc32.exe
3020	Lehaho32.exe
4128	Lnqeqd32.exe
2876	Lifjnm32.exe
5040	Lbnngbbn.exe
3144	Llgcph32.exe
1480	Leoghn32.exe
1412	Llipehgk.exe
2172	Mhppji32.exe
2228	Mbedga32.exe
2460	Molelb32.exe
2080	Mefmimif.exe
4764	Mplafeil.exe
4564	Mhgfkg32.exe
4628	Moaogand.exe
1632	Mleoafmn.exe
2064	Mbognp32.exe
3644	Niipjj32.exe
1060	Npchgdcd.exe
3616	Ngmpcn32.exe
3776	Nlihle32.exe
1652	Niniei32.exe
4792	Nlleaeff.exe
404	Ngaionfl.exe
4644	Nlnbgddc.exe
2432	Nchjdo32.exe
4452	Nlqomd32.exe
3988	Ncjginjn.exe
5136	Oidofh32.exe
5176	Ooagno32.exe
5220	Oekpkigo.exe
5256	Olehhc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mlmbfqoj.exe	Mbenmk32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdehlip.exe	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Hcoejf32.dll	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Hnbfbhoh.dll	Aqkpeopg.exe
File created	C:\Windows\SysWOW64\Iddljmpc.exe	Iklgah32.exe
File opened for modification	C:\Windows\SysWOW64\Kjmmepfj.exe	Kilpmh32.exe
File opened for modification	C:\Windows\SysWOW64\Jjafok32.exe	Jgbjbp32.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Inbpkjag.dll	Bqfoamfj.exe
File created	C:\Windows\SysWOW64\Jkghalnb.dll	Djmibn32.exe
File created	C:\Windows\SysWOW64\Kinmcg32.exe	Kageaj32.exe
File created	C:\Windows\SysWOW64\Djiono32.dll	Dngjff32.exe
File created	C:\Windows\SysWOW64\Hbdmdpjg.dll	Jpenfp32.exe
File opened for modification	C:\Windows\SysWOW64\Dhhfedil.exe	Dannij32.exe
File created	C:\Windows\SysWOW64\Ljdceo32.exe	Lgffic32.exe
File opened for modification	C:\Windows\SysWOW64\Nccokk32.exe	Nnfgcd32.exe
File opened for modification	C:\Windows\SysWOW64\Qklmpalf.exe	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Fpbflg32.exe	Ekdnei32.exe
File opened for modification	C:\Windows\SysWOW64\Kcidmkpq.exe	Jlolpq32.exe
File created	C:\Windows\SysWOW64\Iajdgcab.exe	Ilnlom32.exe
File opened for modification	C:\Windows\SysWOW64\Enlcahgh.exe	Egbken32.exe
File created	C:\Windows\SysWOW64\Ndhcfaai.dll	Kbghfc32.exe
File opened for modification	C:\Windows\SysWOW64\Pemomqcn.exe	Pkhjph32.exe
File created	C:\Windows\SysWOW64\Ocgmoc32.dll	Ahgjejhd.exe
File opened for modification	C:\Windows\SysWOW64\Ahjgjj32.exe	Afkknogn.exe
File created	C:\Windows\SysWOW64\Lqkgbcff.exe	Ljaoeini.exe
File created	C:\Windows\SysWOW64\Kjeqge32.dll	Mmbanbmg.exe
File created	C:\Windows\SysWOW64\Ipdbmgdb.dll	Lckboblp.exe
File created	C:\Windows\SysWOW64\Fjecoi32.dll	Oemefcap.exe
File created	C:\Windows\SysWOW64\Ecjfni32.dll	Idbodn32.exe
File opened for modification	C:\Windows\SysWOW64\Hiiggoaf.exe	Hgkkkcbc.exe
File created	C:\Windows\SysWOW64\Oajpfn32.dll	Hiiggoaf.exe
File opened for modification	C:\Windows\SysWOW64\Ilafiihp.exe	Ikpjbq32.exe
File opened for modification	C:\Windows\SysWOW64\Gmfplibd.exe	Geohklaa.exe
File opened for modification	C:\Windows\SysWOW64\Eojiqb32.exe	Ekonpckp.exe
File created	C:\Windows\SysWOW64\Lljoca32.dll	Ccblbb32.exe
File opened for modification	C:\Windows\SysWOW64\Aobilkcl.exe	Amcmpodi.exe
File created	C:\Windows\SysWOW64\Iocmhlca.dll	Bjfogbjb.exe
File opened for modification	C:\Windows\SysWOW64\Cbbdjm32.exe	Cmflbf32.exe
File created	C:\Windows\SysWOW64\Pcgdhkem.exe	Pbhgoh32.exe
File created	C:\Windows\SysWOW64\Edogedqq.dll	Bidqko32.exe
File created	C:\Windows\SysWOW64\Alkdoago.dll	Iqpfjnba.exe
File created	C:\Windows\SysWOW64\Cjnffjkl.exe	Cbgnemjj.exe
File created	C:\Windows\SysWOW64\Gckoph32.dll	Hdhedh32.exe
File created	C:\Windows\SysWOW64\Cndepccb.dll	Phdnngdn.exe
File created	C:\Windows\SysWOW64\Qkipkani.exe	Qdphngfl.exe
File opened for modification	C:\Windows\SysWOW64\Ekdnei32.exe	Eejeiocj.exe
File created	C:\Windows\SysWOW64\Ncjginjn.exe	Nlqomd32.exe
File created	C:\Windows\SysWOW64\Hpopgneq.dll	Nlnkmnah.exe
File created	C:\Windows\SysWOW64\Eehnaq32.dll	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Djegekil.exe	Ddhomdje.exe
File opened for modification	C:\Windows\SysWOW64\Fkemfl32.exe	Fnalmh32.exe
File created	C:\Windows\SysWOW64\Bmbiamhi.exe	Bgeaifia.exe
File created	C:\Windows\SysWOW64\Fjmkoeqi.exe	Fpggamqc.exe
File created	C:\Windows\SysWOW64\Neogjl32.dll	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Ljobpiql.exe	Kcejco32.exe
File opened for modification	C:\Windows\SysWOW64\Maggnali.exe	Mjmoag32.exe
File created	C:\Windows\SysWOW64\Mmbanbmg.exe	Mjdebfnd.exe
File created	C:\Windows\SysWOW64\Lpochfji.exe	Llcghg32.exe
File opened for modification	C:\Windows\SysWOW64\Ppmcdq32.exe	Phelcc32.exe
File opened for modification	C:\Windows\SysWOW64\Pomgjn32.exe	Ogmijllo.exe
File created	C:\Windows\SysWOW64\Hmofee32.dll	Dikpbl32.exe
File created	C:\Windows\SysWOW64\Jlmcka32.dll	Hlcjhkdp.exe
File created	C:\Windows\SysWOW64\Knfeeimj.exe	Kdmqmc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9556	7732	WerFault.exe	924

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emlenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lieccf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeichoo.dll"	Cofecami.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olfghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjllddpj.dll"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhaoj32.dll"	Fdnhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idmdhm32.dll"	Lbjelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Effama32.dll"	Oekpkigo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dihlbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jkodhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehcfaboo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbighjdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Plbmokop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeddnh32.dll"	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikbfgppo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdphngfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmljnd.dll"	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilafiihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdkjpimd.dll"	Iigdfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajqgidij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefklj32.dll"	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkmnpkk.dll"	Agdhbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okcajg32.dll"	Fhdohp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acddcaom.dll"	Lieccf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkgohbq.dll"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodeaima.dll"	Bdapehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiplni32.dll"	Ccppmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eclbio32.dll"	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oidofh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpgeee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgffic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anaemfem.dll"	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Illddp32.dll"	Lkchelci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Diffglam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkhpmopi.dll"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kednfemc.dll"	Facqkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fimodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debbff32.dll"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnipccc.dll"	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bqilgmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmniml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehhlb32.dll"	Ihbdplfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fngbbg32.dll"	Lihpif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdnljan.dll"	Bmbiamhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Idieem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qebhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmeddp32.dll"	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hidgai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fnhbmgmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Npchgdcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gghpel32.dll"	Pemomqcn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 368	4652	b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe	93
PID 4652 wrote to memory of 368	4652	b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe	93
PID 4652 wrote to memory of 368	4652	b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe	93
PID 368 wrote to memory of 2908	368	Hnoklk32.exe	94
PID 368 wrote to memory of 2908	368	Hnoklk32.exe	94
PID 368 wrote to memory of 2908	368	Hnoklk32.exe	94
PID 2908 wrote to memory of 1464	2908	Hheoid32.exe	95
PID 2908 wrote to memory of 1464	2908	Hheoid32.exe	95
PID 2908 wrote to memory of 1464	2908	Hheoid32.exe	95
PID 1464 wrote to memory of 1476	1464	Hnagak32.exe	96
PID 1464 wrote to memory of 1476	1464	Hnagak32.exe	96
PID 1464 wrote to memory of 1476	1464	Hnagak32.exe	96
PID 1476 wrote to memory of 3856	1476	Hdlpneli.exe	97
PID 1476 wrote to memory of 3856	1476	Hdlpneli.exe	97
PID 1476 wrote to memory of 3856	1476	Hdlpneli.exe	97
PID 3856 wrote to memory of 4504	3856	Hnddgjbj.exe	98
PID 3856 wrote to memory of 4504	3856	Hnddgjbj.exe	98
PID 3856 wrote to memory of 4504	3856	Hnddgjbj.exe	98
PID 4504 wrote to memory of 2672	4504	Hdnldd32.exe	99
PID 4504 wrote to memory of 2672	4504	Hdnldd32.exe	99
PID 4504 wrote to memory of 2672	4504	Hdnldd32.exe	99
PID 2672 wrote to memory of 5108	2672	Hfningai.exe	100
PID 2672 wrote to memory of 5108	2672	Hfningai.exe	100
PID 2672 wrote to memory of 5108	2672	Hfningai.exe	100
PID 5108 wrote to memory of 1608	5108	Hofmfmhj.exe	101
PID 5108 wrote to memory of 1608	5108	Hofmfmhj.exe	101
PID 5108 wrote to memory of 1608	5108	Hofmfmhj.exe	101
PID 1608 wrote to memory of 3368	1608	Hhnbpb32.exe	102
PID 1608 wrote to memory of 3368	1608	Hhnbpb32.exe	102
PID 1608 wrote to memory of 3368	1608	Hhnbpb32.exe	102
PID 3368 wrote to memory of 1472	3368	Inkjhi32.exe	103
PID 3368 wrote to memory of 1472	3368	Inkjhi32.exe	103
PID 3368 wrote to memory of 1472	3368	Inkjhi32.exe	103
PID 1472 wrote to memory of 3900	1472	Ifdonfka.exe	105
PID 1472 wrote to memory of 3900	1472	Ifdonfka.exe	105
PID 1472 wrote to memory of 3900	1472	Ifdonfka.exe	105
PID 3900 wrote to memory of 1544	3900	Ibkpcg32.exe	106
PID 3900 wrote to memory of 1544	3900	Ibkpcg32.exe	106
PID 3900 wrote to memory of 1544	3900	Ibkpcg32.exe	106
PID 1544 wrote to memory of 4460	1544	Ikcdlmgf.exe	107
PID 1544 wrote to memory of 4460	1544	Ikcdlmgf.exe	107
PID 1544 wrote to memory of 4460	1544	Ikcdlmgf.exe	107
PID 4460 wrote to memory of 212	4460	Iigdfa32.exe	108
PID 4460 wrote to memory of 212	4460	Iigdfa32.exe	108
PID 4460 wrote to memory of 212	4460	Iigdfa32.exe	108
PID 212 wrote to memory of 1004	212	Ibpiogmp.exe	109
PID 212 wrote to memory of 1004	212	Ibpiogmp.exe	109
PID 212 wrote to memory of 1004	212	Ibpiogmp.exe	109
PID 1004 wrote to memory of 1192	1004	Jodjhkkj.exe	111
PID 1004 wrote to memory of 1192	1004	Jodjhkkj.exe	111
PID 1004 wrote to memory of 1192	1004	Jodjhkkj.exe	111
PID 1192 wrote to memory of 1600	1192	Jilnqqbj.exe	112
PID 1192 wrote to memory of 1600	1192	Jilnqqbj.exe	112
PID 1192 wrote to memory of 1600	1192	Jilnqqbj.exe	112
PID 1600 wrote to memory of 1720	1600	Jnifigpa.exe	113
PID 1600 wrote to memory of 1720	1600	Jnifigpa.exe	113
PID 1600 wrote to memory of 1720	1600	Jnifigpa.exe	113
PID 1720 wrote to memory of 4320	1720	Jgakbm32.exe	114
PID 1720 wrote to memory of 4320	1720	Jgakbm32.exe	114
PID 1720 wrote to memory of 4320	1720	Jgakbm32.exe	114
PID 4320 wrote to memory of 1808	4320	Jfbkpd32.exe	115
PID 4320 wrote to memory of 1808	4320	Jfbkpd32.exe	115
PID 4320 wrote to memory of 1808	4320	Jfbkpd32.exe	115
PID 1808 wrote to memory of 3172	1808	Jkodhk32.exe	116

C:\Users\Admin\AppData\Local\Temp\b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe
"C:\Users\Admin\AppData\Local\Temp\b4c991c24f12b7e3c334dd82bf745eb353f91695d56ff0ed39fa9d1f2fb9db7f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\Hnoklk32.exe
  C:\Windows\system32\Hnoklk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\Hheoid32.exe
    C:\Windows\system32\Hheoid32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\Hnagak32.exe
      C:\Windows\system32\Hnagak32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1464
    - - C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        23⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        24⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        25⤵
        Executes dropped EXE
        
        PID:564
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        26⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        27⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        28⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        29⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        30⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        31⤵
        Executes dropped EXE
        
        PID:348
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        33⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        35⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        36⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        38⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        39⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        40⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        41⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        42⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        43⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        44⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        45⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        46⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        47⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        48⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        49⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        50⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        53⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        54⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        55⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        56⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        57⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        58⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        59⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        61⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        63⤵
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        65⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        66⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        67⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        68⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        69⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        70⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        72⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        74⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        75⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        77⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5884
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        79⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        80⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        81⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        82⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        83⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        84⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        85⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        86⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        87⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        88⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        89⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        90⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        91⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        92⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        93⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        94⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        95⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        96⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        98⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        100⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        101⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        102⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        103⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        104⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        105⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        106⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        107⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        108⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        109⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        112⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        113⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        114⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        115⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        116⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        117⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        118⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        119⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        120⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        121⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        123⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        124⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        125⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        126⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        127⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        128⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        129⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        130⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        131⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        132⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        133⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        134⤵
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        135⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        136⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        137⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        138⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        139⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        140⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        141⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        142⤵
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        144⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        145⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        146⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        147⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        148⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        149⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        150⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        151⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        152⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        153⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        154⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        155⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        156⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        157⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        158⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        160⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        161⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        162⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        163⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        164⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        165⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        166⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        167⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        168⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        169⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        170⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        171⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        172⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        173⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        174⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        176⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        177⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        178⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        179⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        180⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        181⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        182⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        183⤵
        Drops file in System32 directory
        
        PID:7572
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        184⤵
        Drops file in System32 directory
        
        PID:7612
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        185⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        186⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        187⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        188⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        189⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        190⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        191⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        192⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        193⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        194⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        195⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        196⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        197⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        198⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        199⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        200⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        201⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        202⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        203⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        204⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7812
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        206⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        207⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        208⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        209⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        210⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        211⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        212⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        213⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        214⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        215⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        216⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        217⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        218⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        219⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        220⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        221⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        222⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        223⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        224⤵
        Drops file in System32 directory
        
        PID:4744
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        225⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        227⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        228⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        229⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        230⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        231⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        232⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        233⤵
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        235⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        236⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        237⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        238⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        239⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        240⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        241⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        242⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        243⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        246⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        247⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        248⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        249⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        250⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        251⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        252⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        253⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        254⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        255⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        257⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        258⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        259⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        260⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        261⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        262⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        263⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        264⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        265⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        266⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        267⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        268⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        269⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        270⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        271⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        272⤵
        Drops file in System32 directory
        
        PID:8496
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        273⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        274⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        275⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        276⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        277⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        278⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9212
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        280⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        281⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        282⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        283⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1640
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        286⤵
        Drops file in System32 directory
        
        PID:9144
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        287⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        288⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        289⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        290⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        291⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        292⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        294⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        295⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        296⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        297⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        298⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        299⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        300⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        301⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        302⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        303⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        304⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        305⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        306⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        307⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        308⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        309⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9580
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        311⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        312⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        314⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        315⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9836
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        317⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        318⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        319⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        320⤵
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        321⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        322⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        323⤵
        Modifies registry class
        
        PID:10140
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        324⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        325⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        326⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        327⤵
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        328⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        329⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        330⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        331⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        332⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        333⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        334⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        335⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        336⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        337⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        338⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        339⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        340⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        341⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        342⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        343⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        344⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        345⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        347⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        348⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        349⤵
        Drops file in System32 directory
        
        PID:10072
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        350⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        351⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        352⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        353⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        354⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        355⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        356⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        358⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        359⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        360⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        361⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        362⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9740
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        365⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        366⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        367⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        368⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        369⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        370⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        371⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        372⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        373⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        374⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        375⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        376⤵
        Drops file in System32 directory
        
        PID:10712
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        377⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        378⤵
        Drops file in System32 directory
        
        PID:10804
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10848
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        380⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        381⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        382⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        383⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        384⤵
        Drops file in System32 directory
        
        PID:11072
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        385⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        386⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        387⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        388⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        389⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10400
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        392⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        393⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        394⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        395⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        396⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        397⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        398⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        399⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        400⤵
        Modifies registry class
        
        PID:11012
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        401⤵
        Drops file in System32 directory
        
        PID:11108
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        402⤵
        Modifies registry class
        
        PID:11152
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        403⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        404⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        405⤵
        Modifies registry class
        
        PID:10352
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        406⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        407⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        408⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        409⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        410⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        411⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        412⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        413⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        414⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        415⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10756
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        417⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        418⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        419⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        420⤵
        Modifies registry class
        
        PID:10444
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        422⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        423⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        424⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        425⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        426⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        427⤵
        Modifies registry class
        
        PID:11200
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        428⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        429⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        430⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        431⤵
        Modifies registry class
        
        PID:11368
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        432⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        433⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        434⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        435⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        436⤵
        Drops file in System32 directory
        
        PID:11576
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        437⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        438⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        439⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        440⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        441⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        442⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        443⤵
        Drops file in System32 directory
        
        PID:11888
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        444⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        445⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        446⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        447⤵
        Drops file in System32 directory
        
        PID:12064
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        448⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        449⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        450⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        451⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        452⤵
        Modifies registry class
        
        PID:12264
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        453⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        454⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        455⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        456⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        457⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        458⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        459⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        460⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        461⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        462⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12008
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        464⤵
        Drops file in System32 directory
        
        PID:12072
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        465⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        466⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        467⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        468⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        469⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        470⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        471⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11676
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        472⤵
        Drops file in System32 directory
        
        PID:11824
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        473⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        474⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        475⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        476⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        477⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        478⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        479⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        480⤵
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        481⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        482⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        483⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        484⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12016
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        486⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11964
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        488⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        489⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11488
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        491⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        492⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        493⤵
        Modifies registry class
        
        PID:12380
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        494⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12464
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        496⤵
        Modifies registry class
        
        PID:12504
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12548
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        498⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        499⤵
        Drops file in System32 directory
        
        PID:12628
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        500⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12708
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        502⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12748
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12788
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        504⤵
        Drops file in System32 directory
        
        PID:12828
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        505⤵
        Modifies registry class
        
        PID:12876
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        506⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        507⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        508⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        509⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        510⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        511⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        512⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        513⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        514⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        515⤵
        Modifies registry class
        
        PID:13284
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        516⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        517⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        518⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        519⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        520⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12580
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        522⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12700
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12756
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        525⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12868
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        527⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        528⤵
        Drops file in System32 directory
        
        PID:13008
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        529⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        530⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        531⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        532⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        533⤵
        Drops file in System32 directory
        
        PID:12448
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        534⤵
        Drops file in System32 directory
        
        PID:12528
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        535⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        536⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        537⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        538⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        539⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        540⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        541⤵
        Drops file in System32 directory
        
        PID:13308
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        542⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        543⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        544⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        545⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        546⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        547⤵
        Modifies registry class
        
        PID:12652
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        548⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4448
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        550⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        551⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        552⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        553⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        554⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        555⤵
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        556⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        557⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        558⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        559⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        560⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        561⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        562⤵
        Modifies registry class
        
        PID:12488
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        563⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        564⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        565⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        566⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        567⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13508
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        569⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        570⤵
        
        PID:13596
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        571⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        572⤵
        Drops file in System32 directory
        
        PID:13696
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        573⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        574⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        575⤵
        
        PID:13820
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        576⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        577⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13960
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        579⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        580⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        581⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        582⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        583⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        584⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        585⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        586⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        587⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        588⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        589⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13564
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        591⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3372
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        593⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        594⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        595⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        596⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        597⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        598⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        599⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        600⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        601⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        602⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        603⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        604⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        605⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        606⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        607⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        608⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        609⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        610⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        611⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        612⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        613⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13840
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        615⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        616⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        617⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        618⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        619⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        620⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        621⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        622⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        623⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        624⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        625⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        626⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        627⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        628⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        629⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        630⤵
        Modifies registry class
        
        PID:3632
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        631⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        632⤵
        Modifies registry class
        
        PID:13660
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        633⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        634⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        635⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        636⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        637⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:404
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        638⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        639⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        640⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        641⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        642⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        643⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        644⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        645⤵
        
        PID:14284
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        646⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        647⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        648⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        649⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        650⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        651⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        652⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        653⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        654⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        655⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        656⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        657⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        658⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        659⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        660⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        661⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        662⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        663⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        664⤵
        Drops file in System32 directory
        
        PID:3132
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        665⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13200
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        666⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        667⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        668⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        669⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        670⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        671⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        672⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        673⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        674⤵
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        675⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        676⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        677⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        678⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        679⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        680⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        681⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        682⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        683⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        684⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        685⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        686⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        687⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        688⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        689⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        690⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        691⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        692⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        693⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        694⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        695⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        696⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        697⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        698⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        699⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        700⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        701⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        702⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        703⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        704⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        705⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        706⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        707⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        708⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        709⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        710⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        711⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        712⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        713⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        714⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        715⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        716⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        717⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        718⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        719⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        720⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        721⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        722⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        723⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        724⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        725⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        726⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        727⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        728⤵
        Drops file in System32 directory
        
        PID:13120
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        729⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        730⤵
        Drops file in System32 directory
        
        PID:7728
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        731⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        732⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        733⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        734⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        735⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        736⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        737⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        738⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        739⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        740⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        741⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        742⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        743⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        744⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        745⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1764
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        746⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        747⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        748⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        749⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        750⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        751⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        752⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        753⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        754⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        755⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        756⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        757⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        758⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        759⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        760⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        761⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        762⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        763⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        764⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        765⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        766⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        767⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        768⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        769⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        770⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        771⤵
        Drops file in System32 directory
        
        PID:13392
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        772⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        773⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        774⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        775⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        776⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        777⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        778⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        779⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        780⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        781⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        782⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        783⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        784⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        785⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        786⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        787⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        788⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        789⤵
        Drops file in System32 directory
        
        PID:7764
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        790⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        791⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        792⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        793⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        794⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        795⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        796⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        797⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        798⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        799⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        800⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        801⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        802⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        803⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        804⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        805⤵
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        806⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        807⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4384
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        808⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        809⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        810⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        811⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        812⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        813⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        814⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        815⤵
        Modifies registry class
        
        PID:7580
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        816⤵
        Modifies registry class
        
        PID:8984
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        817⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        818⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        819⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        820⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        821⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 420
        822⤵
        Program crash
        
        PID:9556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7732 -ip 7732
1⤵
PID:9512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
74KB

MD5
2f480f9a909ce23df4c4a7e0569a7e16

SHA1
d21d62025d42db94391d151cee50b2c18ceb2058

SHA256
fe2427cd9278d0399b545e40ad094be19f7591d4bb669e4d4b2049aaa6325c43

SHA512
014b61be2cd3e4fbc3514f2edc24ca729dd48fd7f2e1a6e5206b7a57f54c341a3ef3e4b9f44be832a4cbe963f8b789c33d8aa4a24c78cd3e86a2ae06ed6e7c5a

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
74KB

MD5
c06a9bb448fa864758c900a8af97d9c0

SHA1
02669fb13a7f181af9040c739dc3bd76e6d2e336

SHA256
30677d5f5ead3779a7d978dbd8f2af7a7a9ce7e55e15be53f5c9e2faeba8e672

SHA512
8cbd52c025eac0bec3ef1109f542e055541887a97b860bbf2ac138631f08cac79579e79235db7eb4dfea64d86f7ca116a49600a6b12d530d47b520100747357d

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
74KB

MD5
8d65b3cf5c927755c55734f8ff0b5d34

SHA1
1492a26b3132da27d135f432d7fbfe174bfcdff7

SHA256
1a6cc9fb7db907fcf70df0007bab07845a7c11729e44e3482b0dab7abb2fa2c7

SHA512
e1ae47a34f8aaee6a88c12147565b60396d99eeaaae3f718fd311afb8dc599c3564e63abc1c2d9783ed8e5be3f7bdbdbe53ebc2c0f1b68ffc2a9566486e8dd26

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
74KB

MD5
653eee6c80f8429f27073f30afac9a06

SHA1
061dd4d68470e908d5f09e8594e0a5fcf63646b5

SHA256
b6709b5fc8d628eb203f2c3fa17467958d62201a9943798ea0608a6d01462574

SHA512
70ad0bb0a66df0dfe885e45ad296f0c905c5c40ac1a4ecd8bf4ae470f90885aa92be06ddfd3a75abd4653fad110841c9f44b89cb937638b456882fb2485bb583

Download Submit
C:\Windows\SysWOW64\Clchbqoo.exe

Filesize
74KB

MD5
269f113c8a6dfe44bba36b4bb555b128

SHA1
4f882d18f0bb49dd767161218e43e15a8b997442

SHA256
dbfd0119e2e44b7763d482d8e9c22fbc25e3e52f949041b611501c4ad0e3bbfc

SHA512
94bde0d8e45b3acc8e5901ac9786ea6fc28922aadf3c6f8c6623c47e4645f58b6ba8bd638af56f9aa972645c919017984ca90129ba9d29839f88ddadd789becf

Download Submit
C:\Windows\SysWOW64\Cmdfgm32.exe

Filesize
74KB

MD5
a3cc6c88d6f48f443b9138364538baf6

SHA1
677df68d73c841ec391e0ce13bf8415bc47a8229

SHA256
9271c59f313f54614d3ee88bc8f27711f0e7e9fc48e59616a9851c773e99650f

SHA512
b7e18078572036e7eef428c8ffd4c2d3dde6b1e3f43cec12cb60504604e348ae6711c4e0352f23c2e77cdb14c9d17384b92afa34070ea95cea4cb3030dd4c9ef

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
74KB

MD5
e70e2bb6e6907b01ee8884a6457b4271

SHA1
d9f38e7da770514b5cae8aebe5ce30cd26095c9d

SHA256
ce9e8120248ca6c8c9404f93692414307805c6f7d1ef6b3f99ccb0b6da98d0cf

SHA512
2876ae6889548bc8c56a8bfaa660f1a4092ed12cae311b4a9b7013edcebfef6cfe9207c423cb2850a2548d6408d301587669c48fb88b3813e2d0560d6602d4f6

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
74KB

MD5
4fc5717933d2ede42617ffa90dd9fca7

SHA1
036e243a208c54f603c411679f74a081abc4f5ae

SHA256
24113838b54da6dada2eebf38ea07a83fb011f75b1e67e992753f40dfce63df6

SHA512
6058f87218f6ecd4fa9e27f7c8f0cd5366ca449b9e039860c751b8dcb1ee40d6fa33b379f045383aae5444129266c6a276f855ccfdd5b92d5ec0da5ff3addc23

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
74KB

MD5
4749b418c4fa9c2c0c21a61c87e41b71

SHA1
52d24b077742d220a38062cf003c0c86c96c99e4

SHA256
32d8f1d3bba2063ce296d476b276acbd7154662b5af24566f48519f11d3c80bc

SHA512
e7b4eb273baedececda09ebc83493e1645b659bf85f698ed0779266e038a6675c1b6b36507c5abd537d4ebc460f3de2a621a55d920eadea13ad0a788518ef73d

Download Submit
C:\Windows\SysWOW64\Fikbocki.exe

Filesize
74KB

MD5
e82dbfa24dad320be8aac6d9ff014273

SHA1
18e9dafaadaaa53aab7c1985d0fa37a638ddefbb

SHA256
0ce36c8216ddcd5704e2cdaf01994b8c8ce80a3d8dcd27df95e6f58e711bdbaf

SHA512
ba2f430469bcf22148a11a1a16b69cd7c308b283aa219436a96ea99dfc13dc6facf454888ba4985859e60f67ce0e100ce3228664100204134541efa17e490589

Download Submit
C:\Windows\SysWOW64\Fpbflg32.exe

Filesize
74KB

MD5
033e5ccf71f6245563e97ed1a9fbc1d9

SHA1
fd3f9ed17a3058d05d3aea1ef859574070260d56

SHA256
1b0136a9ef51014d031c9fdba76f64aa3e2f4d652e3e12c8be6504e3def9fce2

SHA512
638bda67efda10520a25481381e0cb95c0aebb1fb70db73c7799a02cc386e5005e10d3d7aca3ac15926407271bf3f0b5ddc2622747a67526de2f21424839d212

Download Submit
C:\Windows\SysWOW64\Gmcdffmq.exe

Filesize
74KB

MD5
310d446ef541985b4acddbba09eae8e6

SHA1
a86259fac5c6d4bbac2279b604bae25ac8c41bbe

SHA256
742e8e64dc89128473cb29765fd5e3fe2483fcc9c8cb574df2b9bf5e767dfbe6

SHA512
d614ce71a4a38e498a99af1a3334cdd25f6e9c592bc8c143fc36dbfd1d1e79d440f534bb179f136abb60d52cea927c6577487d2d9bbdbef8b4d7b87785eb2217

Download Submit
C:\Windows\SysWOW64\Gpnmbl32.exe

Filesize
74KB

MD5
56246032d3918cb4153e5b94f8394162

SHA1
0b31601b751381959923890aa44f7e839b72c2fc

SHA256
9b9a193f9b9aba72a73ee53237ce4abbe38a20d02da96e5fcd01c89315d461f1

SHA512
c33c7bb97cb0a773d70e61ba41e4178e6beb355b2b324368fcc8b5aee9e30d2e726f6268c7b16b5108b7e70a77eaaa7a64e449b7294e9109f560d0f0cb557fc0

Download Submit
C:\Windows\SysWOW64\Hdlpneli.exe

Filesize
74KB

MD5
837822f4b88bd498a0a9cf7225373c87

SHA1
6b642da1c9bd6d522f179d8d8564d4a55417061d

SHA256
f395c86e19eaca477bb3ae82fa14f05e68fd2686adb6fed7f45d037b103fb06e

SHA512
ff6409f06ffdf3b4b33a91f6f1630cb266e4c095fc2c8fa5b18ca1d90a11e359e532d092d702bdb215a462616fede8ddbc4bdaf8aed26dbeaed07f74b31995bb

Download Submit
C:\Windows\SysWOW64\Hdnldd32.exe

Filesize
74KB

MD5
15096e7879cab68a016bcfaf1b5bbf23

SHA1
daa30bb9fed1f6dccf021aa4d9b126bb0c533a42

SHA256
d136e4f3409f9d1a5e79efa83ff3215f638b1406e834863b923f2201b56eba86

SHA512
824c6a859cf58d98ad8e3f1b59883170d6983a21fd4fb45b268be3856f2527711a0b49d0f04deafa5c1fbaad65a99d9a066306b14248e0d79be7240a7174a7ce

Download Submit
C:\Windows\SysWOW64\Hedafk32.exe

Filesize
74KB

MD5
49183b6f3ec619786f2ce0318e19c688

SHA1
05f9f3e6d34c41207026843993bac616c98a4fa5

SHA256
916e3f64979866ce343321f31df36de2804ba97a0a6e0976ffa74e3f6bb77970

SHA512
391a44cba8ecd8d5a6abb6651d00dd3ac5afbc3bdddd4515502ea295f826b47c626df30ddc6c5c7d65924752ef982829a94923a39f2717a57eee23c8f43d0db8

Download Submit
C:\Windows\SysWOW64\Hfningai.exe

Filesize
74KB

MD5
5ee1f20449570155e7a6de65fd9046ae

SHA1
cd069e02872769e3bf0e304bb34ede617326e12c

SHA256
5c48d70f2f549687b024f4a2fb999cff2b668c364324d1344aeff136bbe94955

SHA512
ba79a076f4ed0bd39ac0f34c791940f870c254de740282fb2ad384a0d606d7ff8a9b10f1782dc7128d9b4432747a5b00599d520833fac626ec11c7606134ae73

Download Submit
C:\Windows\SysWOW64\Hheoid32.exe

Filesize
74KB

MD5
965b82a64ad4f9c9406d917c58323bff

SHA1
44e774de8a18e10c984efcd24d33a974e611e09e

SHA256
d5b7354bd23192f7ce6408077b0fa777bf7bfede51b73ef8e4673ed6b7802268

SHA512
03ad754ca54054d36bc8697286d0ea57a35dfd6efa4716af508c8af7ea6ec2a0d813b1b41c2119ab55c3704b4e9e4fb56ce5cfc82edd475c780faa5d47e0515d

Download Submit
C:\Windows\SysWOW64\Hhnbpb32.exe

Filesize
74KB

MD5
20112ac67a6ed245f7b370db9e2a0ebb

SHA1
bf4a888af0d5a647eca508849d62d5877be2197e

SHA256
960f49bbaa8929022074a4c893840d51df23020b498a02ccd29b1e0ddbd978ac

SHA512
c01a8576524cc63e4b20e632f38310faf918a5d0976289cffc5ee527a67d6fc8f50bf4d6e1db225b0168469ef397ec816408b58b1d45504d9a50135c18044214

Download Submit
C:\Windows\SysWOW64\Hnagak32.exe

Filesize
74KB

MD5
c434581911cde45bbe7f3b3f509fb482

SHA1
f45f8bd6374fcdcab75a53a4ed3749147e6d7f0a

SHA256
0ca54efb2431dd2026ff257fd81a82c76da925b95476f7538b682d568e20d135

SHA512
7fbfbd54b721d266f4ef2f1b1d33ad0f509c058423a510780795497e47381d54f1c8ebdc5d6b15ae7f6713ab48ffefbd68485b9b1bd4121906640a69435c4cf6

Download Submit
C:\Windows\SysWOW64\Hnddgjbj.exe

Filesize
74KB

MD5
c109b1260405b81ff3063bd1cfc138ce

SHA1
49c810ba51bfc275802a3e063094975cc1dbc2b4

SHA256
9bf2ffcf8f3c813158a7b4409adc33c4a4517e56405d36e3b69dc54fa9dc8761

SHA512
c1dd4608a1b728b44c7ec1aab8e38ad01da4f2de5d402f06bb7365a160cf24aee67a87775c141e9c0fa0fb596468b270f979b09e0da9ad27675576cdb3b26a0a

Download Submit
C:\Windows\SysWOW64\Hnoklk32.exe

Filesize
74KB

MD5
6945a11dfd5ae22b49bdbd12c8fd3c92

SHA1
1c96441fd9678ab0e5fe695f9b1d2c861abe655d

SHA256
f588f347990009958f7e80d94e94b9fa0ac510e45cdd3d6df788981c1f1a3afe

SHA512
872ddf5443a8cc1f346e6d535bdc27dc028b46baa0df7973da410f8db1d3edc5c95be8c0828aa8b5ff431c07bf73d43083ce07cb370ba3d3ef30d9c279cf3e97

Download Submit
C:\Windows\SysWOW64\Hofmfmhj.exe

Filesize
74KB

MD5
def0c283ddee18bfa44af9ced0f7ca79

SHA1
f751012d21dcf2ab2a4cd187b42813f540f5e245

SHA256
553f64ff2454c6f5e80c866ddbc01b92f40b804ab8e53360619d2101c3576f8b

SHA512
efe8b80968776444050e43f9e9a50bf8e46528b69daa058c81b9fdaaba9a85edb0022e03eb80fac49b0693992036a00841c04c6a3fb75f0a29a7aaffb16b150a

Download Submit
C:\Windows\SysWOW64\Ibkpcg32.exe

Filesize
74KB

MD5
cd031f58e3f338645296697357e4990e

SHA1
fca1bd94f039537dda20384377232765cb67cd1a

SHA256
c217ce0aeddd1dc02debfcbfb42aa63f0cc7e594e181cc71e7ec1427bd3d2630

SHA512
a32c77f10d33ded028a037b21f52a99141dc6845f5aaff5f71527921358913880e3fa2b4bf8b63942b5140dce9840ddb6c0df2f7b1d3d4cac28d875553a80b72

Download Submit
C:\Windows\SysWOW64\Ibpiogmp.exe

Filesize
74KB

MD5
12a52ff90a99aa4a201734bc1116a9fd

SHA1
571b6768efc9d5ffad47612d91d90f688cf32e58

SHA256
ee1dc7680404d1f62d7dc5e18c22114c6c59333b7aec2519966a6fec97211835

SHA512
f8786a3a124731b71bbcb9190bcd83abb06edcd37636de8ab9f44e206183198b279f04d5ac6c3777b61aa78c3970d79bf57916a58d0c4e70de07f0676a3fed0b

Download Submit
C:\Windows\SysWOW64\Ifdonfka.exe

Filesize
74KB

MD5
a7f452822a3ebeaca256dcdb98f42ae3

SHA1
73ed513c6da6b9f9ad317cb754fd154f0f3418ca

SHA256
92e0bba14162a0aa0f554c28b4df93d5ddc41ae35a6a74e0afa44e983ea96f1e

SHA512
322aaa74568a13dde9930f8da17d1c8f3424baac8c69de41c7eb8b424e56b82a28e8b7c052944fbf2aab3c45636d33f5d36cbd22e1641d16d9e7f89bfdf7010a

Download Submit
C:\Windows\SysWOW64\Iigdfa32.exe

Filesize
74KB

MD5
c616b38cdaf432d89babe81a30ac7769

SHA1
03d4410dd6e4dce13d7a83bfb34c67eabcb82477

SHA256
d9acbc4e337226f742c2aedf556cd037697ec3e5bf44345838f25a531161824f

SHA512
de660b93198d3a5b0a0b2e94c499c5c2ad4d6037fa5ed989fefc81d0a2eec67f487ba76aa0a1da6d2344cb74a980aa2cf4b4e38ba9623edafc7f2aaedec12d96

Download Submit
C:\Windows\SysWOW64\Ikcdlmgf.exe

Filesize
74KB

MD5
93fb8ef494886a61c599ded0d124b25a

SHA1
b6b8086247ae0b064b19b93280e24f291194eace

SHA256
068f20f6d530094c768ffd8fe6b0be3d9c8e1588fe6c12f02943660f0c92e9c6

SHA512
4c27ead2e8974a86bc214e3276d9c6f4b15c5696799cf093431e65208e82b55e6f0defbbf3ff054d2b293f66d492f4193c58faec22c1e95b516387b984e8567b

Download Submit
C:\Windows\SysWOW64\Ikdcmpnl.exe

Filesize
64KB

MD5
f62d78481d35e10f6a8837f6ba19c258

SHA1
094d1ac3dbfa2a0c01b419cfe43f1478adf1fc3b

SHA256
11d097c0e3719a1e4f9f2aad2b87beed7c9c663587dd989f2bac97862da58960

SHA512
0024f24fda0dfbb137d82f2b62d683da0c818696ac025d21cc9236199ee6869ede9d93b6aca25a9c5cc35d302e74b120ad3950da7cf6071454103b55c970342c

Download Submit
C:\Windows\SysWOW64\Inkjhi32.exe

Filesize
74KB

MD5
2812f3ae362f2c67d12dc1442123a9a5

SHA1
d43cb43fcb892c7497982a84cde01473978c3539

SHA256
489789c79c366b0db1a1ce9625fb549343f82b8896eb943576e2c7420988b8d1

SHA512
7d3d490f50748113e6f35b86b7243179de14a522ee78ebcf8a931b8be807395d44c4d4b153dbe4dbf7029e6991a2d5d25a111a95ff0877175906d733cc667710

Download Submit
C:\Windows\SysWOW64\Jfbkpd32.exe

Filesize
74KB

MD5
6757fc3e334b92ea5d57d3b189d3ccb2

SHA1
5628e1fc284c3e18b456554b585763842861d49c

SHA256
b2c2264750893f7381ba5c66f79c498190fc3151cc483a41f89683616215d8d2

SHA512
3635f532aa68cfe97ccf23655553707b7b59d966ec01876cc7e9afacd655f2948288fafef1556f7d163c629309590560ecf9f306cf2bd5444f63433a945155ce

Download Submit
C:\Windows\SysWOW64\Jfehed32.exe

Filesize
74KB

MD5
adf67313a658c2bc8f0d35cece2eada3

SHA1
91695dfd9390caa6d7d981d8a36a25f3cc7d07f5

SHA256
bb0be19d1c2341f24640170c4ff041a97852af18b126fc758e322d4aca6d523f

SHA512
3a384e05639b7efe30dc6b5c19f88e74ce30f5de6d64926e2890291fa9dcccfc84894ffcd70409f7b2332c595a57131e24d5425497febf30ded7e8bb946a84ee

Download Submit
C:\Windows\SysWOW64\Jgakbm32.exe

Filesize
74KB

MD5
27333e37e4eb1dbc0d43a4182a9e9da5

SHA1
31ba3d0312791ad562dffccb357b5e24cc474c56

SHA256
06d76bb328b6ef5c9e97e9c249f4fdb521d63d349d4142f7fc144550566e6583

SHA512
72446f0390db749d5fcf0e2b030ccb3c33840ec2edc1e88bfe42577753a9b197d8afbbbf134d1fdcbf27aa34f56b5aee2ec70797c961e96f44150202cd7d6eaa

Download Submit
C:\Windows\SysWOW64\Jilnqqbj.exe

Filesize
74KB

MD5
fc469f5534f5431f6f1efd79dc78ef5e

SHA1
a0d89b9f5c470762db12c3acd0b85f6d4a7e73ee

SHA256
87a7af6e060d7fea4de1011d093097f64e450c2d4ee9899244a06263f4ba004f

SHA512
2f0286c872ce7306a476946dd4ea8028dc6d3bd8ae42512fe5bab2ac3dbf2d06838d32e7c39796d6cf41aa63b168fee99c3893b633e2a986fbfe5cb52204ee0a

Download Submit
C:\Windows\SysWOW64\Jkodhk32.exe

Filesize
74KB

MD5
b435a6abeb2f36f493a45187951e1eb0

SHA1
09970e28e099b0361108533a6eadc968ceb03aaa

SHA256
d9182ebb0b3fa5ef43bf01bf0a132ad863df23e52a69967ae58932cc0f98e217

SHA512
1f1d7d689cf7788efbbc812e21d167734f168cdd15f4e1d6ec8c5fc45d0baa27bc8cc17f63fd886cf9f7e3cbb63895ce7451c612dfc56db2309854e9f64d213a

Download Submit
C:\Windows\SysWOW64\Jnifigpa.exe

Filesize
74KB

MD5
e627bcfadf357b73da0d5c440f69644c

SHA1
810d9b354f46259c5e99237a83f54d530b4490df

SHA256
940a704589f62452f2d9c37c98f9c1bb277b4f71a0b0da165d7df3167172fe3d

SHA512
c0599f91214a2bea1d9fd7a96375511e64fce0e6684042ca19edf40698210ded5f55eeeeac29800984be47d836ffb5e2aad4e4a3d069c90156fec4616daf0106

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
74KB

MD5
d0e34d8f7c90841b66fb18ae29d59495

SHA1
d1f673e5b59d4612d65166a298fee6ac077b2c70

SHA256
79dcf0f28eae8b90894800ffc2d807ba9e6a338b931111d95fb65af9f598815a

SHA512
cfa713d7c8f57bc49002e07edb5f2be63a6eb10261c86e65a84d3a799cb25f9e17d7a7462e68ffcbfb82b29ced22d8a98a7d0093fd591daa0a2901be365bf13e

Download Submit
C:\Windows\SysWOW64\Jodjhkkj.exe

Filesize
74KB

MD5
876844b5c7fd6d5b80227b75332c4ed4

SHA1
faa98dc873f18ebbf674f0ef0aedf88565580475

SHA256
9e009199465a02ae1109cfc5b621e97919801634882ba3ac3338a12e79fad0ea

SHA512
0be2392ae2d96b902adaf99e854c063a39cfeb85b3c22d93bc6c20266df7bb02191b1628c2d50e5cb2493ab1529a1691e3e8fe467136e24c8e55c2f8da555fcb

Download Submit
C:\Windows\SysWOW64\Kbekqdjh.exe

Filesize
74KB

MD5
7e51e23c37d44156d0b7ccdc9c20404c

SHA1
6c693cc0813557d52f231cdf7e34ce8c72d156fb

SHA256
3afec75552570953f1daccdab5db0c0622ce68c7933a2291d0c802fbb16d45a5

SHA512
ce92ad2a411fb46990d6e4147585e8e63ed91f127cae5a3f7631501113083edb9624e75d6970998ab02c3e4338d6004182da1b656709d9d4b565cf30dc5b040f

Download Submit
C:\Windows\SysWOW64\Kbghfc32.exe

Filesize
74KB

MD5
715ac22ff377d7ce411b9964b862cf99

SHA1
e81c31fc9e4fcf5e20b20301e39f866b4779b9b6

SHA256
410d08d2a1731c769fc28cbf7d2c2024c4de23851008f10105ebf1bdf51c4cfb

SHA512
e00115218b58d9cfb267a33006ad756135eace931ed296d13fb8a6dde66ed9da148f6099f818d4923e6d95c3346cc3ea997a5d223d703e8dd7aad40d144e1775

Download Submit
C:\Windows\SysWOW64\Kfjapcii.exe

Filesize
74KB

MD5
5dfd7857281c8c953ea78db65b89e04a

SHA1
05df8d0c0964fae4ecdf04255ad262945db0f34d

SHA256
9ded77f5f4d4986e746ba15a760692dcd39c7a0ab507d29b798778c126c39086

SHA512
307e5a08c7e768cd92aa97f757bb0a49524452e9e962aa2f864b5ee2ae238b3d717fcb88eeaa07b72bab4f1571d334e3fe35abac57c0cd8cfec07a0cc109086f

Download Submit
C:\Windows\SysWOW64\Kgknhl32.exe

Filesize
74KB

MD5
27dd92d2ae760e0dba0cb0a75ce26f67

SHA1
927e606b10af012d949c84e183b629ac69a2006f

SHA256
177814f713555905900b9f554f4ddc11b9740817419675b4920d6a7d81f0fed8

SHA512
8b84c3f891f0bd90f5abb099291bb3b04ff4f9b3750c031fed30a381a401eeacc60b65603834b8a86cee7e2f7f682a9bdd7c3ab70dca50d104d28863469d953c

Download Submit
C:\Windows\SysWOW64\Kiaqcnpb.exe

Filesize
74KB

MD5
c0b098c038c50e2afbe0194c2d376227

SHA1
608b4ee9825cb2c35c3cda1dcbd2d057798fb954

SHA256
75c8d8f986216e064020dac513afee4151ddc257e14a907ae129db10f882f4cc

SHA512
2840a883bf08cdaf0288925fc0e80560e253c3c1da7d26a6344f897fd6220ad1744454cb40fd5a18173976e9a7b8c30cef3d2b78fade058d460db6d6455dc9d6

Download Submit
C:\Windows\SysWOW64\Kijjbofj.exe

Filesize
74KB

MD5
32e57f3682c877477751bf142da1bfc8

SHA1
6d0eaf960a3fcdc617482856023095fdc56b21f4

SHA256
033ff1c247a2e98c9a4b4cd7d0bc53222a62cc1d29c481b313891626bfdd0f85

SHA512
993ad7899506b0b8df9b7d3e43c100492ed6faf2fec72e31c92e0b0efceaa17db189be08abc8b5ea8990d6df65ba87641718cdc422309a3afaae8bf5725a609a

Download Submit
C:\Windows\SysWOW64\Kldmckic.exe

Filesize
74KB

MD5
4a9c9750063d7eb3058e6e9d976f9ef7

SHA1
c7f7d60c29760ba898de70ed3e0827da48b7327d

SHA256
9c14fd0763ffe0d5bfcee892fda784d9bd0621220ebe609d0fb98c326fc50f13

SHA512
d489f05815c8dd1ba4ba4bb34696d125c8e9b775717d60adf80c2abd294e47de40d12f2595b7769ccf5cc3c3400e795769c92004dc23955ebeafb6b03e6f16e8

Download Submit
C:\Windows\SysWOW64\Knefeffd.exe

Filesize
74KB

MD5
a166554187db65332e34bd44e1aea328

SHA1
8d89797e056bcee64716efee1aa510b82bf85e3d

SHA256
5023c3504faf7f51e5044f53aaa4b69dd8ad8f64f970f2b71f11e9b2476ccdbd

SHA512
23b116cf3d0d3653831db756ea345b98cbe70c998983963acfbe1501a7b92da11393ed6296ded225073549efa46b41a89a890f153948050a6507d0d7663dd83b

Download Submit
C:\Windows\SysWOW64\Kngcje32.exe

Filesize
74KB

MD5
8af854189450684ea42dfb927341a34d

SHA1
646f872ea500b039d5c03b97eb9f78c94f1f0785

SHA256
89806a479f6c339fc516d1852ed1f46ac3e9c7cefe1c9549ef05d50f6425f6d4

SHA512
d4ab4d1493dd37a68628b2ed8a8d8f65cab978ae61ca3a047eaee602ea913bd8e60f233ee3d60da58d0c94eed3849984bc29c144f68e48ed56a60352f3ebda3e

Download Submit
C:\Windows\SysWOW64\Koijai32.dll

Filesize
7KB

MD5
5a6e3157694f4e1e29fe6418e3fdc27b

SHA1
005246483cddc4f60f91dfd83eb235265408cc87

SHA256
3ddef532a7a75c7ff610a1c8f92b92d1ab7f0f0f2324476395c72939a361fdb2

SHA512
f9293ae962183ac94110ab84665b6e7ba51e833c44409f57f06cae5b6d8e20a39d0a698f9766cb437d3a8438bb66e0e7c89048246f46bd7a087763b4bc75f929

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
74KB

MD5
6416906a33a1d87688f54c3e4de6fe7d

SHA1
5db3fdbf05d5562e73b106fd10577d459947ce79

SHA256
b73274d991d787daf34280f1cd473261ecc4166bb2ec5018c7672bef6672bbfb

SHA512
dbaa0e8875c4671e47fcb5cb5b639711a7233905b6c3d73be5528801024758b1ae8983f3d04c44028672b2cffe1bb45218d091ad595a35c695df3e76b137512f

Download Submit
C:\Windows\SysWOW64\Papfgbmg.exe

Filesize
74KB

MD5
fa930d1598b620b7d6a5b2399f492f1b

SHA1
d2e7fc593db3536557187622a048bffb0476f681

SHA256
dec0420a6508f090aba080bd3a2ee59e9ed59afe07e868d2c23a8000ecece470

SHA512
5cfcfdff7973d982b0968c561e889fffacf3b37b7bef1985b25e808b52ca135a93840e3308db1d64a463434a52c1abc93657305a202297ef142cb7530980ccc5

Download Submit
memory/212-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/348-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/368-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/404-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/564-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1004-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1192-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1412-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1420-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1464-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1472-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1480-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1600-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1608-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1632-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2064-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2172-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2672-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2836-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3172-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3216-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3300-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3316-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3368-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3644-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3776-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3856-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4320-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4452-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4460-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4628-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4652-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5108-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5136-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5176-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5220-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads