0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65

Analysis

max time kernel
152s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe
Size

45KB
MD5

a7e77bd9e37e87c0da733979d804919f
SHA1

79057419c5e127d3a905139b14ef15938f609397
SHA256

0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65
SHA512

a2f1bcf921d4b480029667dcd215123fc8f77352160645499ad25aa6799e01516e306a5aa078ad45e3447909198f4bd72abc014e97eaaaf66b6349b194ec8c45
SSDEEP

768:j9Qp8NK352IVSwMKX1ajUwmZ1vyukw2WpukS/1H5WT:BNq2rfKX8OZxyu72CYW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdpicj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epgdch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhaeli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplcnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihkpgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glngep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjecjahd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljjpnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcinie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jabgkpad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhljpcfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haafnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppepkmhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jekqgnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbpihlbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfill32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfjpppbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpfmlghd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjmodffo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkobdeok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlbbel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inejlibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bafnmnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhgeao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emfebjgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmbaggce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooclapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hklglk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkabefqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iannpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leenanik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bichcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbnjcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eomfae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oepipo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbdano32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hahlnefd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inecac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngbgmpcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehifpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldbjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdinf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anaofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efdbhpbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhfenc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgekh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amibqhed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahiiqafa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfhbifgq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dplebmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oomelheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibmmbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffjdjmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boknic32.exe

Executes dropped EXE 64 IoCs

pid	Process
2620	Mmmqhl32.exe
748	Njjdho32.exe
1008	Nfaemp32.exe
2336	Npiiffqe.exe
5048	Ogcnmc32.exe
3360	Oclkgccf.exe
1648	Ocohmc32.exe
3508	Paeelgnj.exe
1924	Pnifekmd.exe
3656	Pjbcplpe.exe
1812	Phfcipoo.exe
1204	Qfkqjmdg.exe
1232	Qfmmplad.exe
1752	Ahmjjoig.exe
560	Adcjop32.exe
1624	Aajhndkb.exe
2360	Amcehdod.exe
2004	Bhhiemoj.exe
1516	Bgnffj32.exe
1004	Bdagpnbk.exe
1636	Bkphhgfc.exe
3816	Cammjakm.exe
3652	Cpbjkn32.exe
4104	Cpdgqmnb.exe
2840	Dnonkq32.exe
2024	Dhgonidg.exe
4608	Ekjded32.exe
1444	Egaejeej.exe
4068	Eomffaag.exe
3844	Fooclapd.exe
1760	Fbplml32.exe
1068	Finnef32.exe
3300	Fajbjh32.exe
3996	Gpolbo32.exe
4220	Glfmgp32.exe
2928	Hlkfbocp.exe
1724	Hiacacpg.exe
2936	Hnbeeiji.exe
4988	Hihibbjo.exe
2388	Iehmmb32.exe
4316	Joqafgni.exe
2592	Jemfhacc.exe
3224	Jhnojl32.exe
4856	Jbepme32.exe
3292	Kekbjo32.exe
1804	Ljbnfleo.exe
4780	Mledmg32.exe
2304	Nbbeml32.exe
644	Ncbafoge.exe
1480	Oophlo32.exe
1656	Omfekbdh.exe
3316	Piocecgj.exe
976	Pcegclgp.exe
4516	Paihlpfi.exe
1836	Qamago32.exe
4960	Qjhbfd32.exe
4088	Apjdikqd.exe
1120	Baepolni.exe
2992	Cmbgdl32.exe
4708	Cpfmlghd.exe
2384	Dgbanq32.exe
1944	Ddklbd32.exe
1564	Edfknb32.exe
2240	Fboecfii.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Haaocp32.exe	Hhhkjj32.exe
File created	C:\Windows\SysWOW64\Icpnjl32.dll	Ndphpk32.exe
File created	C:\Windows\SysWOW64\Hjmchc32.dll	Hmbflc32.exe
File created	C:\Windows\SysWOW64\Egaejeej.exe	Ekjded32.exe
File opened for modification	C:\Windows\SysWOW64\Ilgcblnp.exe	Iibaeb32.exe
File created	C:\Windows\SysWOW64\Kmaooihb.exe	Kfggbope.exe
File created	C:\Windows\SysWOW64\Ppeipfdm.exe	Plbfohbl.exe
File created	C:\Windows\SysWOW64\Ehkllbpl.dll	Aqmldddb.exe
File created	C:\Windows\SysWOW64\Fpckjlje.exe	Fnqebaog.exe
File created	C:\Windows\SysWOW64\Npmkdm32.dll	Kdjhkp32.exe
File created	C:\Windows\SysWOW64\Mjbikolk.dll	Jcmkjeko.exe
File opened for modification	C:\Windows\SysWOW64\Haclio32.exe	Haaocp32.exe
File created	C:\Windows\SysWOW64\Hlnbhlof.dll	Gfbpfedp.exe
File opened for modification	C:\Windows\SysWOW64\Bmkcjd32.exe	Bjlgnh32.exe
File created	C:\Windows\SysWOW64\Gkhkdjli.exe	Gdobgp32.exe
File created	C:\Windows\SysWOW64\Ogokeh32.dll	Ppepkmhi.exe
File created	C:\Windows\SysWOW64\Efgono32.exe	Eomfae32.exe
File created	C:\Windows\SysWOW64\Fbgnbigb.dll	Nkgmmpab.exe
File created	C:\Windows\SysWOW64\Ehddpdlc.exe	Dkedjbgg.exe
File created	C:\Windows\SysWOW64\Gfbpfedp.exe	Gohhik32.exe
File created	C:\Windows\SysWOW64\Pmomfb32.dll	Ccnnmmbp.exe
File opened for modification	C:\Windows\SysWOW64\Gqmnpk32.exe	Fljlom32.exe
File opened for modification	C:\Windows\SysWOW64\Phfhfa32.exe	Omlkmign.exe
File created	C:\Windows\SysWOW64\Fqhfobnm.dll	Cqfahh32.exe
File created	C:\Windows\SysWOW64\Dhdkig32.exe	Cajblmci.exe
File created	C:\Windows\SysWOW64\Bijnai32.dll	Laqhao32.exe
File opened for modification	C:\Windows\SysWOW64\Nolekd32.exe	Mdddhlbl.exe
File opened for modification	C:\Windows\SysWOW64\Agjhbbob.exe	Pgeogb32.exe
File created	C:\Windows\SysWOW64\Jjcqffkm.exe	Jqklnp32.exe
File created	C:\Windows\SysWOW64\Pnbmmabm.dll	Ehifpm32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlmdd32.exe	Olfgbl32.exe
File created	C:\Windows\SysWOW64\Nolekd32.exe	Mdddhlbl.exe
File created	C:\Windows\SysWOW64\Pofbggpf.dll	Iohlcg32.exe
File created	C:\Windows\SysWOW64\Cfoece32.dll	Elagjihh.exe
File opened for modification	C:\Windows\SysWOW64\Mnochl32.exe	Mgdklb32.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jjihfbno.exe
File opened for modification	C:\Windows\SysWOW64\Aifpoj32.exe	Apnkfelb.exe
File created	C:\Windows\SysWOW64\Mkcjlf32.exe	Mdibplaf.exe
File opened for modification	C:\Windows\SysWOW64\Phaabm32.exe	Pmlmdd32.exe
File created	C:\Windows\SysWOW64\Mkdkdafo.dll	Falcli32.exe
File opened for modification	C:\Windows\SysWOW64\Jojboa32.exe	Jhpjbgne.exe
File created	C:\Windows\SysWOW64\Iannpa32.exe	Ibmmbj32.exe
File created	C:\Windows\SysWOW64\Dampal32.exe	Dhdkig32.exe
File created	C:\Windows\SysWOW64\Jaadfkaa.dll	Medqmb32.exe
File created	C:\Windows\SysWOW64\Bjjcea32.dll	Oiihkncb.exe
File opened for modification	C:\Windows\SysWOW64\Bfchcijo.exe	Bmkcjd32.exe
File created	C:\Windows\SysWOW64\Imfill32.exe	Igmqpbab.exe
File created	C:\Windows\SysWOW64\Lqhdlc32.exe	Lfbpnjjd.exe
File created	C:\Windows\SysWOW64\Phmknd32.dll	Kjopbd32.exe
File created	C:\Windows\SysWOW64\Iibaeb32.exe	Hommhi32.exe
File opened for modification	C:\Windows\SysWOW64\Dfjgjf32.exe	Dpqonl32.exe
File opened for modification	C:\Windows\SysWOW64\Aepklffh.exe	Qkjgomgb.exe
File created	C:\Windows\SysWOW64\Ojigbcoh.dll	Boeelcmm.exe
File created	C:\Windows\SysWOW64\Hbjonepq.exe	Cninnnfe.exe
File opened for modification	C:\Windows\SysWOW64\Diopep32.exe	Dhpdkm32.exe
File opened for modification	C:\Windows\SysWOW64\Fkbkoo32.exe	Fiaogfai.exe
File created	C:\Windows\SysWOW64\Gbjlgj32.exe	Gbhpajlj.exe
File created	C:\Windows\SysWOW64\Bjcfeola.exe	Bcinie32.exe
File created	C:\Windows\SysWOW64\Kadnfkji.exe	Jnalem32.exe
File created	C:\Windows\SysWOW64\Lgnpeenp.dll	Pplcnf32.exe
File opened for modification	C:\Windows\SysWOW64\Mgngih32.exe	Mkgfdgpq.exe
File created	C:\Windows\SysWOW64\Jedjkkmo.exe	Jojboa32.exe
File created	C:\Windows\SysWOW64\Ohgokknb.exe	Oookbega.exe
File created	C:\Windows\SysWOW64\Bdcngdld.dll	Ajcdhj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlfniafa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igcojdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Appaki32.dll"	Ggnenagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnlgk32.dll"	Olphlcdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohahkojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhbbob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kblidkhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgqdal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oagpne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emioab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdaqhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlnbhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qpmmfbfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqbjnc32.dll"	Lflpmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pblhalfm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkhkdjli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqdpfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pllnbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmgcej32.dll"	Cnokhonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbkeacqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anfbja32.dll"	Ebnocpfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfjpppbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hingefqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paapjc32.dll"	Pmlmdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dncmld32.dll"	Cmdhnhkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqnofkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donjdabe.dll"	Mncmck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edkddeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olnedl32.dll"	Gnkajapa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbneij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odhipp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkgicccd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obbcmknk.dll"	Bbbkbbkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olqqdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfdnol32.dll"	Hbegakcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfddi32.dll"	Acjjpllp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfbpfedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pidaleei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbpihlbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifoah32.dll"	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbbcimhh.dll"	Feifgnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imjgbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajqmddce.dll"	Phfhfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cniekq32.dll"	Dnmgni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbmmabm.dll"	Ehifpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inkjao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbikdbnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pncmdhlq.dll"	Gqnejaff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaimko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqbagd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnpice32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phioej32.dll"	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Modffifb.dll"	Plhgdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejaecdnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chkhbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kopmaddf.dll"	Igdnkhoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beomhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkfelqpk.dll"	Jmplbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpfcelml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqnnomfq.dll"	Foonjd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2620	3264	0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe	95
PID 3264 wrote to memory of 2620	3264	0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe	95
PID 3264 wrote to memory of 2620	3264	0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe	95
PID 2620 wrote to memory of 748	2620	Mmmqhl32.exe	96
PID 2620 wrote to memory of 748	2620	Mmmqhl32.exe	96
PID 2620 wrote to memory of 748	2620	Mmmqhl32.exe	96
PID 748 wrote to memory of 1008	748	Njjdho32.exe	97
PID 748 wrote to memory of 1008	748	Njjdho32.exe	97
PID 748 wrote to memory of 1008	748	Njjdho32.exe	97
PID 1008 wrote to memory of 2336	1008	Nfaemp32.exe	98
PID 1008 wrote to memory of 2336	1008	Nfaemp32.exe	98
PID 1008 wrote to memory of 2336	1008	Nfaemp32.exe	98
PID 2336 wrote to memory of 5048	2336	Npiiffqe.exe	99
PID 2336 wrote to memory of 5048	2336	Npiiffqe.exe	99
PID 2336 wrote to memory of 5048	2336	Npiiffqe.exe	99
PID 5048 wrote to memory of 3360	5048	Ogcnmc32.exe	100
PID 5048 wrote to memory of 3360	5048	Ogcnmc32.exe	100
PID 5048 wrote to memory of 3360	5048	Ogcnmc32.exe	100
PID 3360 wrote to memory of 1648	3360	Oclkgccf.exe	101
PID 3360 wrote to memory of 1648	3360	Oclkgccf.exe	101
PID 3360 wrote to memory of 1648	3360	Oclkgccf.exe	101
PID 1648 wrote to memory of 3508	1648	Ocohmc32.exe	102
PID 1648 wrote to memory of 3508	1648	Ocohmc32.exe	102
PID 1648 wrote to memory of 3508	1648	Ocohmc32.exe	102
PID 3508 wrote to memory of 1924	3508	Paeelgnj.exe	103
PID 3508 wrote to memory of 1924	3508	Paeelgnj.exe	103
PID 3508 wrote to memory of 1924	3508	Paeelgnj.exe	103
PID 1924 wrote to memory of 3656	1924	Pnifekmd.exe	104
PID 1924 wrote to memory of 3656	1924	Pnifekmd.exe	104
PID 1924 wrote to memory of 3656	1924	Pnifekmd.exe	104
PID 3656 wrote to memory of 1812	3656	Pjbcplpe.exe	105
PID 3656 wrote to memory of 1812	3656	Pjbcplpe.exe	105
PID 3656 wrote to memory of 1812	3656	Pjbcplpe.exe	105
PID 1812 wrote to memory of 1204	1812	Phfcipoo.exe	106
PID 1812 wrote to memory of 1204	1812	Phfcipoo.exe	106
PID 1812 wrote to memory of 1204	1812	Phfcipoo.exe	106
PID 1204 wrote to memory of 1232	1204	Qfkqjmdg.exe	107
PID 1204 wrote to memory of 1232	1204	Qfkqjmdg.exe	107
PID 1204 wrote to memory of 1232	1204	Qfkqjmdg.exe	107
PID 1232 wrote to memory of 1752	1232	Qfmmplad.exe	108
PID 1232 wrote to memory of 1752	1232	Qfmmplad.exe	108
PID 1232 wrote to memory of 1752	1232	Qfmmplad.exe	108
PID 1752 wrote to memory of 560	1752	Ahmjjoig.exe	109
PID 1752 wrote to memory of 560	1752	Ahmjjoig.exe	109
PID 1752 wrote to memory of 560	1752	Ahmjjoig.exe	109
PID 560 wrote to memory of 1624	560	Adcjop32.exe	110
PID 560 wrote to memory of 1624	560	Adcjop32.exe	110
PID 560 wrote to memory of 1624	560	Adcjop32.exe	110
PID 1624 wrote to memory of 2360	1624	Aajhndkb.exe	111
PID 1624 wrote to memory of 2360	1624	Aajhndkb.exe	111
PID 1624 wrote to memory of 2360	1624	Aajhndkb.exe	111
PID 2360 wrote to memory of 2004	2360	Amcehdod.exe	112
PID 2360 wrote to memory of 2004	2360	Amcehdod.exe	112
PID 2360 wrote to memory of 2004	2360	Amcehdod.exe	112
PID 2004 wrote to memory of 1516	2004	Bhhiemoj.exe	113
PID 2004 wrote to memory of 1516	2004	Bhhiemoj.exe	113
PID 2004 wrote to memory of 1516	2004	Bhhiemoj.exe	113
PID 1516 wrote to memory of 1004	1516	Bgnffj32.exe	114
PID 1516 wrote to memory of 1004	1516	Bgnffj32.exe	114
PID 1516 wrote to memory of 1004	1516	Bgnffj32.exe	114
PID 1004 wrote to memory of 1636	1004	Bdagpnbk.exe	115
PID 1004 wrote to memory of 1636	1004	Bdagpnbk.exe	115
PID 1004 wrote to memory of 1636	1004	Bdagpnbk.exe	115
PID 1636 wrote to memory of 3816	1636	Bkphhgfc.exe	116

C:\Users\Admin\AppData\Local\Temp\0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe
"C:\Users\Admin\AppData\Local\Temp\0a2c6fe5f0c6260358684c0a305efea5c54ead121a2d06f82c2c14edb60eec65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\Mmmqhl32.exe
  C:\Windows\system32\Mmmqhl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\Njjdho32.exe
    C:\Windows\system32\Njjdho32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\Nfaemp32.exe
      C:\Windows\system32\Nfaemp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
      - C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        23⤵
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        24⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        25⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        26⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        27⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        29⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        30⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        32⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        33⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        36⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        37⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        38⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        39⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        40⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        41⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        42⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        43⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        44⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        45⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        46⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        47⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        48⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        49⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        50⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        51⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        52⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        53⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        54⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        55⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        56⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        57⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        58⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        59⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        60⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        62⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        63⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        64⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        65⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        66⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        67⤵
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1040
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        69⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        70⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        71⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        72⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        74⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        75⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        76⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        77⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        78⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        79⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        80⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        81⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        82⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        84⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        86⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        87⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        88⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        89⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        90⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        91⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        92⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        93⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        94⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        95⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        96⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        97⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        98⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        99⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        100⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        101⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        102⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        103⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Fnqebaog.exe
        
        C:\Windows\system32\Fnqebaog.exe
        104⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        105⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        106⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        108⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Hfnpca32.exe
        
        C:\Windows\system32\Hfnpca32.exe
        109⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        110⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        111⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        112⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ifmldo32.exe
        
        C:\Windows\system32\Ifmldo32.exe
        113⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        114⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jeilne32.exe
        
        C:\Windows\system32\Jeilne32.exe
        115⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        116⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        117⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Keekjc32.exe
        
        C:\Windows\system32\Keekjc32.exe
        118⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        119⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        120⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        121⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Lhmjlm32.exe
        
        C:\Windows\system32\Lhmjlm32.exe
        122⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        123⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Mgngih32.exe
        
        C:\Windows\system32\Mgngih32.exe
        124⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        125⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        126⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        127⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        128⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        129⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ngnppfgb.exe
        
        C:\Windows\system32\Ngnppfgb.exe
        130⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        131⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        132⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        134⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Agmehamp.exe
        
        C:\Windows\system32\Agmehamp.exe
        135⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        136⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        137⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        138⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Bichcc32.exe
        
        C:\Windows\system32\Bichcc32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        140⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        141⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bflagg32.exe
        
        C:\Windows\system32\Bflagg32.exe
        142⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        143⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        144⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        145⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Diopep32.exe
        
        C:\Windows\system32\Diopep32.exe
        147⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        148⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        149⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        150⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        152⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        153⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        154⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        155⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        156⤵
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        157⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        158⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        159⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        160⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        161⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        162⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Gchflq32.exe
        
        C:\Windows\system32\Gchflq32.exe
        163⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        164⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        165⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        166⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        167⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        168⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        169⤵
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        170⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        171⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Kfaglf32.exe
        
        C:\Windows\system32\Kfaglf32.exe
        172⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        173⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        175⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        176⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Ljjpnb32.exe
        
        C:\Windows\system32\Ljjpnb32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        178⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        179⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        180⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        181⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        182⤵
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        183⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        184⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Ndjcne32.exe
        
        C:\Windows\system32\Ndjcne32.exe
        185⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        186⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        187⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        188⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        189⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        190⤵
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        191⤵
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        192⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        193⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Phpklp32.exe
        
        C:\Windows\system32\Phpklp32.exe
        194⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        195⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        196⤵
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        197⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        198⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        199⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        200⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        201⤵
        
        PID:500
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        202⤵
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        203⤵
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        204⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        205⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        206⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        207⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        208⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4412
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        210⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        211⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        212⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        213⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        214⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Elfhmc32.exe
        
        C:\Windows\system32\Elfhmc32.exe
        215⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Ebpqjmpd.exe
        
        C:\Windows\system32\Ebpqjmpd.exe
        216⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Eliecc32.exe
        
        C:\Windows\system32\Eliecc32.exe
        217⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Eaenkj32.exe
        
        C:\Windows\system32\Eaenkj32.exe
        218⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Elkbhbeb.exe
        
        C:\Windows\system32\Elkbhbeb.exe
        219⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        220⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Folkjnbc.exe
        
        C:\Windows\system32\Folkjnbc.exe
        221⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Fiaogfai.exe
        
        C:\Windows\system32\Fiaogfai.exe
        222⤵
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\Fkbkoo32.exe
        
        C:\Windows\system32\Fkbkoo32.exe
        223⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        224⤵
        Drops file in System32 directory
        
        PID:1216
        
        C:\Windows\SysWOW64\Fhflhcfa.exe
        
        C:\Windows\system32\Fhflhcfa.exe
        225⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Fblpflfg.exe
        
        C:\Windows\system32\Fblpflfg.exe
        226⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Fhiinbdo.exe
        
        C:\Windows\system32\Fhiinbdo.exe
        227⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Femigg32.exe
        
        C:\Windows\system32\Femigg32.exe
        228⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Flgadake.exe
        
        C:\Windows\system32\Flgadake.exe
        229⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Glngep32.exe
        
        C:\Windows\system32\Glngep32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2548
        
        C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        231⤵
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Gbjlgj32.exe
        
        C:\Windows\system32\Gbjlgj32.exe
        232⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Goamlkpk.exe
        
        C:\Windows\system32\Goamlkpk.exe
        233⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        234⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4728
        
        C:\Windows\SysWOW64\Hklglk32.exe
        
        C:\Windows\system32\Hklglk32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4052
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        237⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Hahlnefd.exe
        
        C:\Windows\system32\Hahlnefd.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3292
        
        C:\Windows\SysWOW64\Hommhi32.exe
        
        C:\Windows\system32\Hommhi32.exe
        239⤵
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\Iibaeb32.exe
        
        C:\Windows\system32\Iibaeb32.exe
        240⤵
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        241⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        242⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        243⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        244⤵
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        245⤵
        
        PID:732
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        246⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        247⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Kbinlp32.exe
        
        C:\Windows\system32\Kbinlp32.exe
        248⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        249⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3208
        
        C:\Windows\SysWOW64\Kfggbope.exe
        
        C:\Windows\system32\Kfggbope.exe
        251⤵
        Drops file in System32 directory
        
        PID:3772
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        252⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        253⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        254⤵
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Lijlii32.exe
        
        C:\Windows\system32\Lijlii32.exe
        255⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        256⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Mlgegcng.exe
        
        C:\Windows\system32\Mlgegcng.exe
        257⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        258⤵
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Mmfaafej.exe
        
        C:\Windows\system32\Mmfaafej.exe
        259⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        260⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Nlphmafm.exe
        
        C:\Windows\system32\Nlphmafm.exe
        261⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Oinkmdml.exe
        
        C:\Windows\system32\Oinkmdml.exe
        262⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Odcojm32.exe
        
        C:\Windows\system32\Odcojm32.exe
        263⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Olndnp32.exe
        
        C:\Windows\system32\Olndnp32.exe
        264⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Okodlgbl.exe
        
        C:\Windows\system32\Okodlgbl.exe
        265⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Olqqdo32.exe
        
        C:\Windows\system32\Olqqdo32.exe
        266⤵
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Pmpmnb32.exe
        
        C:\Windows\system32\Pmpmnb32.exe
        267⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Pkdngf32.exe
        
        C:\Windows\system32\Pkdngf32.exe
        268⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Plejoode.exe
        
        C:\Windows\system32\Plejoode.exe
        269⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Pkfjmfld.exe
        
        C:\Windows\system32\Pkfjmfld.exe
        270⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Plhgdn32.exe
        
        C:\Windows\system32\Plhgdn32.exe
        271⤵
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Pgmkbg32.exe
        
        C:\Windows\system32\Pgmkbg32.exe
        272⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Pilgnb32.exe
        
        C:\Windows\system32\Pilgnb32.exe
        273⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ppepkmhi.exe
        
        C:\Windows\system32\Ppepkmhi.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Pgphggpe.exe
        
        C:\Windows\system32\Pgphggpe.exe
        275⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Apobakpn.exe
        
        C:\Windows\system32\Apobakpn.exe
        276⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Addahh32.exe
        
        C:\Windows\system32\Addahh32.exe
        277⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Bcinie32.exe
        
        C:\Windows\system32\Bcinie32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Bjcfeola.exe
        
        C:\Windows\system32\Bjcfeola.exe
        279⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        280⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Cqfahh32.exe
        
        C:\Windows\system32\Cqfahh32.exe
        281⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Ckclfp32.exe
        
        C:\Windows\system32\Ckclfp32.exe
        282⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Cmdhnhkp.exe
        
        C:\Windows\system32\Cmdhnhkp.exe
        283⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Dcgcaq32.exe
        
        C:\Windows\system32\Dcgcaq32.exe
        284⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Dnmgni32.exe
        
        C:\Windows\system32\Dnmgni32.exe
        285⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Ecjpfp32.exe
        
        C:\Windows\system32\Ecjpfp32.exe
        286⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Enoddi32.exe
        
        C:\Windows\system32\Enoddi32.exe
        287⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ejfeij32.exe
        
        C:\Windows\system32\Ejfeij32.exe
        288⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Emgnje32.exe
        
        C:\Windows\system32\Emgnje32.exe
        289⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fcjimnjl.exe
        
        C:\Windows\system32\Fcjimnjl.exe
        290⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Fjdajhbi.exe
        
        C:\Windows\system32\Fjdajhbi.exe
        291⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Galfhpmf.exe
        
        C:\Windows\system32\Galfhpmf.exe
        292⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Gkdjaf32.exe
        
        C:\Windows\system32\Gkdjaf32.exe
        293⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Haobnpkc.exe
        
        C:\Windows\system32\Haobnpkc.exe
        294⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hhhkjj32.exe
        
        C:\Windows\system32\Hhhkjj32.exe
        295⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Haaocp32.exe
        
        C:\Windows\system32\Haaocp32.exe
        296⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Haclio32.exe
        
        C:\Windows\system32\Haclio32.exe
        297⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Hlipfh32.exe
        
        C:\Windows\system32\Hlipfh32.exe
        298⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ihfglhfp.exe
        
        C:\Windows\system32\Ihfglhfp.exe
        299⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Iejgelej.exe
        
        C:\Windows\system32\Iejgelej.exe
        300⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ioclnblj.exe
        
        C:\Windows\system32\Ioclnblj.exe
        301⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ihkpgg32.exe
        
        C:\Windows\system32\Ihkpgg32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Inhion32.exe
        
        C:\Windows\system32\Inhion32.exe
        303⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Jklihbol.exe
        
        C:\Windows\system32\Jklihbol.exe
        304⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Jafaem32.exe
        
        C:\Windows\system32\Jafaem32.exe
        305⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Jhpjbgne.exe
        
        C:\Windows\system32\Jhpjbgne.exe
        306⤵
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Jojboa32.exe
        
        C:\Windows\system32\Jojboa32.exe
        307⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Jedjkkmo.exe
        
        C:\Windows\system32\Jedjkkmo.exe
        308⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Jlnbhe32.exe
        
        C:\Windows\system32\Jlnbhe32.exe
        309⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Jefgak32.exe
        
        C:\Windows\system32\Jefgak32.exe
        310⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jlponebi.exe
        
        C:\Windows\system32\Jlponebi.exe
        311⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jnalem32.exe
        
        C:\Windows\system32\Jnalem32.exe
        312⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Kadnfkji.exe
        
        C:\Windows\system32\Kadnfkji.exe
        313⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Kbfjljhf.exe
        
        C:\Windows\system32\Kbfjljhf.exe
        314⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Kojkeogp.exe
        
        C:\Windows\system32\Kojkeogp.exe
        315⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Khbpndnp.exe
        
        C:\Windows\system32\Khbpndnp.exe
        316⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Mbnjcg32.exe
        
        C:\Windows\system32\Mbnjcg32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Nicalpak.exe
        
        C:\Windows\system32\Nicalpak.exe
        318⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Npmjij32.exe
        
        C:\Windows\system32\Npmjij32.exe
        319⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Nifnao32.exe
        
        C:\Windows\system32\Nifnao32.exe
        320⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ofjokc32.exe
        
        C:\Windows\system32\Ofjokc32.exe
        321⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Plbfohbl.exe
        
        C:\Windows\system32\Plbfohbl.exe
        322⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Ppeipfdm.exe
        
        C:\Windows\system32\Ppeipfdm.exe
        323⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ppgeff32.exe
        
        C:\Windows\system32\Ppgeff32.exe
        324⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Qednnm32.exe
        
        C:\Windows\system32\Qednnm32.exe
        325⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Qpibke32.exe
        
        C:\Windows\system32\Qpibke32.exe
        326⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        327⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Qlpcpffl.exe
        
        C:\Windows\system32\Qlpcpffl.exe
        328⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Apnkfelb.exe
        
        C:\Windows\system32\Apnkfelb.exe
        329⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Aifpoj32.exe
        
        C:\Windows\system32\Aifpoj32.exe
        330⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Apqhldjp.exe
        
        C:\Windows\system32\Apqhldjp.exe
        331⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Algiaepd.exe
        
        C:\Windows\system32\Algiaepd.exe
        332⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        333⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Amgekh32.exe
        
        C:\Windows\system32\Amgekh32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Agojdnng.exe
        
        C:\Windows\system32\Agojdnng.exe
        335⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        337⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Blnoad32.exe
        
        C:\Windows\system32\Blnoad32.exe
        338⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ccajdmin.exe
        
        C:\Windows\system32\Ccajdmin.exe
        339⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Cljomc32.exe
        
        C:\Windows\system32\Cljomc32.exe
        340⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Cjnoggoh.exe
        
        C:\Windows\system32\Cjnoggoh.exe
        341⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Cphgca32.exe
        
        C:\Windows\system32\Cphgca32.exe
        342⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Cgbppknb.exe
        
        C:\Windows\system32\Cgbppknb.exe
        343⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Comddn32.exe
        
        C:\Windows\system32\Comddn32.exe
        344⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        345⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Dnqaheai.exe
        
        C:\Windows\system32\Dnqaheai.exe
        346⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Dflflg32.exe
        
        C:\Windows\system32\Dflflg32.exe
        347⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Dlfniafa.exe
        
        C:\Windows\system32\Dlfniafa.exe
        348⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Dcglfjgf.exe
        
        C:\Windows\system32\Dcglfjgf.exe
        349⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        350⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Eflocepa.exe
        
        C:\Windows\system32\Eflocepa.exe
        351⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ecpomiok.exe
        
        C:\Windows\system32\Ecpomiok.exe
        352⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ejjgic32.exe
        
        C:\Windows\system32\Ejjgic32.exe
        353⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        354⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Egnhcgeb.exe
        
        C:\Windows\system32\Egnhcgeb.exe
        355⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ffjkdc32.exe
        
        C:\Windows\system32\Ffjkdc32.exe
        356⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Fapobl32.exe
        
        C:\Windows\system32\Fapobl32.exe
        357⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Gjhdkajh.exe
        
        C:\Windows\system32\Gjhdkajh.exe
        358⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ggldde32.exe
        
        C:\Windows\system32\Ggldde32.exe
        359⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ghcjedcj.exe
        
        C:\Windows\system32\Ghcjedcj.exe
        360⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Gpnoigpe.exe
        
        C:\Windows\system32\Gpnoigpe.exe
        361⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        362⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hhhdpd32.exe
        
        C:\Windows\system32\Hhhdpd32.exe
        363⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Hmdlhk32.exe
        
        C:\Windows\system32\Hmdlhk32.exe
        364⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        365⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Idmafc32.exe
        
        C:\Windows\system32\Idmafc32.exe
        366⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        367⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        368⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Lhiodm32.exe
        
        C:\Windows\system32\Lhiodm32.exe
        369⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Locgagli.exe
        
        C:\Windows\system32\Locgagli.exe
        370⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ldpoinjq.exe
        
        C:\Windows\system32\Ldpoinjq.exe
        371⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        372⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Mdibplaf.exe
        
        C:\Windows\system32\Mdibplaf.exe
        373⤵
        Drops file in System32 directory
        
        PID:7396
        
        C:\Windows\SysWOW64\Mkcjlf32.exe
        
        C:\Windows\system32\Mkcjlf32.exe
        374⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Mbmbiqqp.exe
        
        C:\Windows\system32\Mbmbiqqp.exe
        375⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        376⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Nocphd32.exe
        
        C:\Windows\system32\Nocphd32.exe
        377⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        378⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        379⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ngaabfio.exe
        
        C:\Windows\system32\Ngaabfio.exe
        380⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Nbfeoohe.exe
        
        C:\Windows\system32\Nbfeoohe.exe
        381⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        382⤵
        Modifies registry class
        
        PID:3276
        
        C:\Windows\SysWOW64\Onbpop32.exe
        
        C:\Windows\system32\Onbpop32.exe
        383⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Oeekbhif.exe
        
        C:\Windows\system32\Oeekbhif.exe
        384⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pgdgodhj.exe
        
        C:\Windows\system32\Pgdgodhj.exe
        385⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pnnokn32.exe
        
        C:\Windows\system32\Pnnokn32.exe
        386⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ppmleagi.exe
        
        C:\Windows\system32\Ppmleagi.exe
        387⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Pblhalfm.exe
        
        C:\Windows\system32\Pblhalfm.exe
        388⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Qiocde32.exe
        
        C:\Windows\system32\Qiocde32.exe
        389⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        390⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Qajhigcj.exe
        
        C:\Windows\system32\Qajhigcj.exe
        391⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ahdpea32.exe
        
        C:\Windows\system32\Ahdpea32.exe
        392⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        393⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Aaoadg32.exe
        
        C:\Windows\system32\Aaoadg32.exe
        394⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Ahiiqafa.exe
        
        C:\Windows\system32\Ahiiqafa.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        396⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        397⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        398⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Bhblfpng.exe
        
        C:\Windows\system32\Bhblfpng.exe
        399⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4684
        
        C:\Windows\SysWOW64\Bhgeao32.exe
        
        C:\Windows\system32\Bhgeao32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Baojkdqb.exe
        
        C:\Windows\system32\Baojkdqb.exe
        402⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ciioaa32.exe
        
        C:\Windows\system32\Ciioaa32.exe
        403⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Cpbgnlfo.exe
        
        C:\Windows\system32\Cpbgnlfo.exe
        404⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Ccacjgfb.exe
        
        C:\Windows\system32\Ccacjgfb.exe
        405⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Chnlbndj.exe
        
        C:\Windows\system32\Chnlbndj.exe
        406⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Dapcab32.exe
        
        C:\Windows\system32\Dapcab32.exe
        407⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        408⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Dhlhcl32.exe
        
        C:\Windows\system32\Dhlhcl32.exe
        409⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Dofpqfof.exe
        
        C:\Windows\system32\Dofpqfof.exe
        410⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Djkdnool.exe
        
        C:\Windows\system32\Djkdnool.exe
        411⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Dagiba32.exe
        
        C:\Windows\system32\Dagiba32.exe
        412⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Dphipidf.exe
        
        C:\Windows\system32\Dphipidf.exe
        413⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Efdbhpbn.exe
        
        C:\Windows\system32\Efdbhpbn.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4220
        
        C:\Windows\SysWOW64\Eomfae32.exe
        
        C:\Windows\system32\Eomfae32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\Efgono32.exe
        
        C:\Windows\system32\Efgono32.exe
        416⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Elagjihh.exe
        
        C:\Windows\system32\Elagjihh.exe
        417⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Ebnocpfp.exe
        
        C:\Windows\system32\Ebnocpfp.exe
        418⤵
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Eflhiolf.exe
        
        C:\Windows\system32\Eflhiolf.exe
        419⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Emhmkh32.exe
        
        C:\Windows\system32\Emhmkh32.exe
        420⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        421⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Fjqgpl32.exe
        
        C:\Windows\system32\Fjqgpl32.exe
        422⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Godehbed.exe
        
        C:\Windows\system32\Godehbed.exe
        424⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Hjjbmhfg.exe
        
        C:\Windows\system32\Hjjbmhfg.exe
        425⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Hadkib32.exe
        
        C:\Windows\system32\Hadkib32.exe
        426⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Hbegakcb.exe
        
        C:\Windows\system32\Hbegakcb.exe
        427⤵
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        428⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ibmmbj32.exe
        
        C:\Windows\system32\Ibmmbj32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Iannpa32.exe
        
        C:\Windows\system32\Iannpa32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3084
        
        C:\Windows\SysWOW64\Ifjfhh32.exe
        
        C:\Windows\system32\Ifjfhh32.exe
        431⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Imdndbkn.exe
        
        C:\Windows\system32\Imdndbkn.exe
        432⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Idnfal32.exe
        
        C:\Windows\system32\Idnfal32.exe
        433⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Jjhonfjg.exe
        
        C:\Windows\system32\Jjhonfjg.exe
        434⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2204
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        436⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        437⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Jiphebml.exe
        
        C:\Windows\system32\Jiphebml.exe
        438⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Jpjqaldi.exe
        
        C:\Windows\system32\Jpjqaldi.exe
        439⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Jfdinf32.exe
        
        C:\Windows\system32\Jfdinf32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Jaimko32.exe
        
        C:\Windows\system32\Jaimko32.exe
        441⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Jbkjcgaj.exe
        
        C:\Windows\system32\Jbkjcgaj.exe
        442⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Jidbpa32.exe
        
        C:\Windows\system32\Jidbpa32.exe
        443⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Kfhbifgq.exe
        
        C:\Windows\system32\Kfhbifgq.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2548
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        445⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Kbocng32.exe
        
        C:\Windows\system32\Kbocng32.exe
        446⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Kkfkod32.exe
        
        C:\Windows\system32\Kkfkod32.exe
        447⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Kbapdfkb.exe
        
        C:\Windows\system32\Kbapdfkb.exe
        448⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Kmgdaokh.exe
        
        C:\Windows\system32\Kmgdaokh.exe
        449⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        450⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Mgdklb32.exe
        
        C:\Windows\system32\Mgdklb32.exe
        451⤵
        Drops file in System32 directory
        
        PID:3300
        
        C:\Windows\SysWOW64\Mnochl32.exe
        
        C:\Windows\system32\Mnochl32.exe
        452⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        453⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Mjednmla.exe
        
        C:\Windows\system32\Mjednmla.exe
        454⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Mpoljg32.exe
        
        C:\Windows\system32\Mpoljg32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3200
        
        C:\Windows\SysWOW64\Mgidgakk.exe
        
        C:\Windows\system32\Mgidgakk.exe
        456⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        458⤵
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Nqdeefpi.exe
        
        C:\Windows\system32\Nqdeefpi.exe
        459⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Ngnnbq32.exe
        
        C:\Windows\system32\Ngnnbq32.exe
        460⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        461⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ngbgmpcq.exe
        
        C:\Windows\system32\Ngbgmpcq.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Nnmojj32.exe
        
        C:\Windows\system32\Nnmojj32.exe
        463⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        464⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Ocldhqgb.exe
        
        C:\Windows\system32\Ocldhqgb.exe
        465⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        466⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        467⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        468⤵
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Ogljcokf.exe
        
        C:\Windows\system32\Ogljcokf.exe
        469⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        470⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Aloekjod.exe
        
        C:\Windows\system32\Aloekjod.exe
        471⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Anmagenh.exe
        
        C:\Windows\system32\Anmagenh.exe
        472⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Acjjpllp.exe
        
        C:\Windows\system32\Acjjpllp.exe
        473⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Bbemdb32.exe
        
        C:\Windows\system32\Bbemdb32.exe
        474⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1172
        
        C:\Windows\SysWOW64\Boknic32.exe
        
        C:\Windows\system32\Boknic32.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1624
        
        C:\Windows\SysWOW64\Beefenie.exe
        
        C:\Windows\system32\Beefenie.exe
        477⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Bonjnc32.exe
        
        C:\Windows\system32\Bonjnc32.exe
        478⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Bdkbgj32.exe
        
        C:\Windows\system32\Bdkbgj32.exe
        479⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bopgdcnc.exe
        
        C:\Windows\system32\Bopgdcnc.exe
        480⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Bejoqm32.exe
        
        C:\Windows\system32\Bejoqm32.exe
        481⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Cbnpja32.exe
        
        C:\Windows\system32\Cbnpja32.exe
        482⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Chkhbh32.exe
        
        C:\Windows\system32\Chkhbh32.exe
        483⤵
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        484⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Cdaigi32.exe
        
        C:\Windows\system32\Cdaigi32.exe
        485⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Ckladcoa.exe
        
        C:\Windows\system32\Ckladcoa.exe
        486⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ceaealoh.exe
        
        C:\Windows\system32\Ceaealoh.exe
        487⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Clknnf32.exe
        
        C:\Windows\system32\Clknnf32.exe
        488⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ckpjob32.exe
        
        C:\Windows\system32\Ckpjob32.exe
        489⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        490⤵
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Dhdkig32.exe
        
        C:\Windows\system32\Dhdkig32.exe
        491⤵
        Drops file in System32 directory
        
        PID:376
        
        C:\Windows\SysWOW64\Dampal32.exe
        
        C:\Windows\system32\Dampal32.exe
        492⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        493⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Ehddpdlc.exe
        
        C:\Windows\system32\Ehddpdlc.exe
        494⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Eoollocp.exe
        
        C:\Windows\system32\Eoollocp.exe
        495⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Edkddeag.exe
        
        C:\Windows\system32\Edkddeag.exe
        496⤵
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Ecmebm32.exe
        
        C:\Windows\system32\Ecmebm32.exe
        497⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Ekhjgoga.exe
        
        C:\Windows\system32\Ekhjgoga.exe
        498⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fhljpcfk.exe
        
        C:\Windows\system32\Fhljpcfk.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Fcanmlea.exe
        
        C:\Windows\system32\Fcanmlea.exe
        500⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        501⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Fljcfa32.exe
        
        C:\Windows\system32\Fljcfa32.exe
        502⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        503⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Fojlhmic.exe
        
        C:\Windows\system32\Fojlhmic.exe
        504⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ffdddg32.exe
        
        C:\Windows\system32\Ffdddg32.exe
        505⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Flnlaahl.exe
        
        C:\Windows\system32\Flnlaahl.exe
        506⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Fbkdjh32.exe
        
        C:\Windows\system32\Fbkdjh32.exe
        507⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Fhemfbnq.exe
        
        C:\Windows\system32\Fhemfbnq.exe
        508⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        509⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        510⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        511⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Ghjfaa32.exe
        
        C:\Windows\system32\Ghjfaa32.exe
        512⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Goconkah.exe
        
        C:\Windows\system32\Goconkah.exe
        513⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Gfngke32.exe
        
        C:\Windows\system32\Gfngke32.exe
        514⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Gmhogppb.exe
        
        C:\Windows\system32\Gmhogppb.exe
        515⤵
        
        PID:496
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        516⤵
        
        PID:712
        
        C:\Windows\SysWOW64\Ghnpmqef.exe
        
        C:\Windows\system32\Ghnpmqef.exe
        517⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        518⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Gfbpfedp.exe
        
        C:\Windows\system32\Gfbpfedp.exe
        519⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        520⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        521⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jbcmhb32.exe
        
        C:\Windows\system32\Jbcmhb32.exe
        522⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Jefbomoe.exe
        
        C:\Windows\system32\Jefbomoe.exe
        523⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Jlpklg32.exe
        
        C:\Windows\system32\Jlpklg32.exe
        524⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Jehoemmb.exe
        
        C:\Windows\system32\Jehoemmb.exe
        525⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Kemhpl32.exe
        
        C:\Windows\system32\Kemhpl32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        527⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        528⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Lgkakm32.exe
        
        C:\Windows\system32\Lgkakm32.exe
        529⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        530⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        531⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        532⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        533⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Pfjcpc32.exe
        
        C:\Windows\system32\Pfjcpc32.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2388
        
        C:\Windows\SysWOW64\Bcebadof.exe
        
        C:\Windows\system32\Bcebadof.exe
        535⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Bnmcdm32.exe
        
        C:\Windows\system32\Bnmcdm32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Chagiqhm.exe
        
        C:\Windows\system32\Chagiqhm.exe
        537⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        538⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Degdgd32.exe
        
        C:\Windows\system32\Degdgd32.exe
        539⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Dmefafql.exe
        
        C:\Windows\system32\Dmefafql.exe
        540⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Egbdekcg.exe
        
        C:\Windows\system32\Egbdekcg.exe
        541⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Eoneah32.exe
        
        C:\Windows\system32\Eoneah32.exe
        542⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Emcbcd32.exe
        
        C:\Windows\system32\Emcbcd32.exe
        543⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ehifpm32.exe
        
        C:\Windows\system32\Ehifpm32.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Fobomglo.exe
        
        C:\Windows\system32\Fobomglo.exe
        545⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Fhkcfmbp.exe
        
        C:\Windows\system32\Fhkcfmbp.exe
        546⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Fkiobhac.exe
        
        C:\Windows\system32\Fkiobhac.exe
        547⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Fachob32.exe
        
        C:\Windows\system32\Fachob32.exe
        548⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Fddqpn32.exe
        
        C:\Windows\system32\Fddqpn32.exe
        549⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        550⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ggqingie.exe
        
        C:\Windows\system32\Ggqingie.exe
        551⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Gnkajapa.exe
        
        C:\Windows\system32\Gnkajapa.exe
        552⤵
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        553⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7236
        
        C:\Windows\SysWOW64\Hgebif32.exe
        
        C:\Windows\system32\Hgebif32.exe
        555⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Holjjd32.exe
        
        C:\Windows\system32\Holjjd32.exe
        556⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hffbfn32.exe
        
        C:\Windows\system32\Hffbfn32.exe
        557⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Hggonfbm.exe
        
        C:\Windows\system32\Hggonfbm.exe
        558⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Hdpicj32.exe
        
        C:\Windows\system32\Hdpicj32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1688
        
        C:\Windows\SysWOW64\Inkjao32.exe
        
        C:\Windows\system32\Inkjao32.exe
        560⤵
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        561⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Igcojdhp.exe
        
        C:\Windows\system32\Igcojdhp.exe
        562⤵
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Ibicgmhe.exe
        
        C:\Windows\system32\Ibicgmhe.exe
        563⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Igfkpd32.exe
        
        C:\Windows\system32\Igfkpd32.exe
        564⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Inpclnnj.exe
        
        C:\Windows\system32\Inpclnnj.exe
        565⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        566⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ioopfa32.exe
        
        C:\Windows\system32\Ioopfa32.exe
        567⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jelioh32.exe
        
        C:\Windows\system32\Jelioh32.exe
        568⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Jbpihlbn.exe
        
        C:\Windows\system32\Jbpihlbn.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Jijaef32.exe
        
        C:\Windows\system32\Jijaef32.exe
        570⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        571⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Jfnbnk32.exe
        
        C:\Windows\system32\Jfnbnk32.exe
        572⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Jgonfcnb.exe
        
        C:\Windows\system32\Jgonfcnb.exe
        573⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Jnifbmfo.exe
        
        C:\Windows\system32\Jnifbmfo.exe
        574⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Jgakkb32.exe
        
        C:\Windows\system32\Jgakkb32.exe
        575⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Jfbkijdo.exe
        
        C:\Windows\system32\Jfbkijdo.exe
        576⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Jgdhab32.exe
        
        C:\Windows\system32\Jgdhab32.exe
        577⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jnnpnl32.exe
        
        C:\Windows\system32\Jnnpnl32.exe
        578⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kicdke32.exe
        
        C:\Windows\system32\Kicdke32.exe
        579⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Kblidkhp.exe
        
        C:\Windows\system32\Kblidkhp.exe
        580⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Khhalafg.exe
        
        C:\Windows\system32\Khhalafg.exe
        581⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Kbneij32.exe
        
        C:\Windows\system32\Kbneij32.exe
        582⤵
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Kpbfbo32.exe
        
        C:\Windows\system32\Kpbfbo32.exe
        583⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Lbjeei32.exe
        
        C:\Windows\system32\Lbjeei32.exe
        584⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Licmbccm.exe
        
        C:\Windows\system32\Licmbccm.exe
        585⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Lblakh32.exe
        
        C:\Windows\system32\Lblakh32.exe
        586⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Lifjgb32.exe
        
        C:\Windows\system32\Lifjgb32.exe
        587⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Locbpi32.exe
        
        C:\Windows\system32\Locbpi32.exe
        588⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Lemjlcgo.exe
        
        C:\Windows\system32\Lemjlcgo.exe
        589⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Mhncnodp.exe
        
        C:\Windows\system32\Mhncnodp.exe
        590⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        591⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Mimphakb.exe
        
        C:\Windows\system32\Mimphakb.exe
        592⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        593⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Mbhafgpp.exe
        
        C:\Windows\system32\Mbhafgpp.exe
        594⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Miaica32.exe
        
        C:\Windows\system32\Miaica32.exe
        595⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Mplapkoj.exe
        
        C:\Windows\system32\Mplapkoj.exe
        596⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Mehjhbma.exe
        
        C:\Windows\system32\Mehjhbma.exe
        597⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Mlbbel32.exe
        
        C:\Windows\system32\Mlbbel32.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Nfhfbedd.exe
        
        C:\Windows\system32\Nfhfbedd.exe
        599⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Oeffip32.exe
        
        C:\Windows\system32\Oeffip32.exe
        600⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Oookbega.exe
        
        C:\Windows\system32\Oookbega.exe
        601⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Ohgokknb.exe
        
        C:\Windows\system32\Ohgokknb.exe
        602⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ocmchdmh.exe
        
        C:\Windows\system32\Ocmchdmh.exe
        603⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ohjlqklp.exe
        
        C:\Windows\system32\Ohjlqklp.exe
        604⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Oiihkncb.exe
        
        C:\Windows\system32\Oiihkncb.exe
        605⤵
        Drops file in System32 directory
        
        PID:4024
        
        C:\Windows\SysWOW64\Ocamcc32.exe
        
        C:\Windows\system32\Ocamcc32.exe
        606⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Oepipo32.exe
        
        C:\Windows\system32\Oepipo32.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Pljalipc.exe
        
        C:\Windows\system32\Pljalipc.exe
        608⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pcdjic32.exe
        
        C:\Windows\system32\Pcdjic32.exe
        609⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Pebfen32.exe
        
        C:\Windows\system32\Pebfen32.exe
        610⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Pllnbh32.exe
        
        C:\Windows\system32\Pllnbh32.exe
        611⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Pokjnd32.exe
        
        C:\Windows\system32\Pokjnd32.exe
        612⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Pfdbknda.exe
        
        C:\Windows\system32\Pfdbknda.exe
        613⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Phcogice.exe
        
        C:\Windows\system32\Phcogice.exe
        614⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Pgdodq32.exe
        
        C:\Windows\system32\Pgdodq32.exe
        615⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Phekliab.exe
        
        C:\Windows\system32\Phekliab.exe
        616⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Pplcnf32.exe
        
        C:\Windows\system32\Pplcnf32.exe
        617⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Ajcdhj32.exe
        
        C:\Windows\system32\Ajcdhj32.exe
        618⤵
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        619⤵
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Afjemkbi.exe
        
        C:\Windows\system32\Afjemkbi.exe
        620⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Bjlgnh32.exe
        
        C:\Windows\system32\Bjlgnh32.exe
        621⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Bmkcjd32.exe
        
        C:\Windows\system32\Bmkcjd32.exe
        622⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        623⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Bciebm32.exe
        
        C:\Windows\system32\Bciebm32.exe
        624⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ccnnmmbp.exe
        
        C:\Windows\system32\Ccnnmmbp.exe
        625⤵
        Drops file in System32 directory
        
        PID:1092
        
        C:\Windows\SysWOW64\Cmfcfb32.exe
        
        C:\Windows\system32\Cmfcfb32.exe
        626⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cglgck32.exe
        
        C:\Windows\system32\Cglgck32.exe
        627⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        628⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Dffmogji.exe
        
        C:\Windows\system32\Dffmogji.exe
        629⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Dmpfla32.exe
        
        C:\Windows\system32\Dmpfla32.exe
        630⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Dcjnikhc.exe
        
        C:\Windows\system32\Dcjnikhc.exe
        631⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Djcfee32.exe
        
        C:\Windows\system32\Djcfee32.exe
        632⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Dpqonl32.exe
        
        C:\Windows\system32\Dpqonl32.exe
        633⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Dfjgjf32.exe
        
        C:\Windows\system32\Dfjgjf32.exe
        634⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Dmglmpkn.exe
        
        C:\Windows\system32\Dmglmpkn.exe
        635⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Ejklfd32.exe
        
        C:\Windows\system32\Ejklfd32.exe
        636⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Epgenk32.exe
        
        C:\Windows\system32\Epgenk32.exe
        637⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ekdolcbm.exe
        
        C:\Windows\system32\Ekdolcbm.exe
        638⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Eangimij.exe
        
        C:\Windows\system32\Eangimij.exe
        639⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Fhhpfg32.exe
        
        C:\Windows\system32\Fhhpfg32.exe
        640⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ggilbb32.exe
        
        C:\Windows\system32\Ggilbb32.exe
        641⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        642⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        643⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Gkgeipah.exe
        
        C:\Windows\system32\Gkgeipah.exe
        644⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Gpcmagpo.exe
        
        C:\Windows\system32\Gpcmagpo.exe
        645⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        646⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Ghmbhd32.exe
        
        C:\Windows\system32\Ghmbhd32.exe
        647⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Hahcfi32.exe
        
        C:\Windows\system32\Hahcfi32.exe
        648⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Hhfenc32.exe
        
        C:\Windows\system32\Hhfenc32.exe
        649⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Hncmfj32.exe
        
        C:\Windows\system32\Hncmfj32.exe
        650⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        651⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Inejlibi.exe
        
        C:\Windows\system32\Inejlibi.exe
        652⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6556
        
        C:\Windows\SysWOW64\Ignndo32.exe
        
        C:\Windows\system32\Ignndo32.exe
        653⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        654⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        655⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        656⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        657⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ijadljdg.exe
        
        C:\Windows\system32\Ijadljdg.exe
        658⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Iqklhd32.exe
        
        C:\Windows\system32\Iqklhd32.exe
        659⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Inombh32.exe
        
        C:\Windows\system32\Inombh32.exe
        660⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Idieob32.exe
        
        C:\Windows\system32\Idieob32.exe
        661⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ikcmklih.exe
        
        C:\Windows\system32\Ikcmklih.exe
        662⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jgqdal32.exe
        
        C:\Windows\system32\Jgqdal32.exe
        663⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        664⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Kbiede32.exe
        
        C:\Windows\system32\Kbiede32.exe
        665⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Kjdjhgdb.exe
        
        C:\Windows\system32\Kjdjhgdb.exe
        666⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Kiejfo32.exe
        
        C:\Windows\system32\Kiejfo32.exe
        667⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        668⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Kabkpqgj.exe
        
        C:\Windows\system32\Kabkpqgj.exe
        669⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Kilpgnfi.exe
        
        C:\Windows\system32\Kilpgnfi.exe
        670⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Lnihod32.exe
        
        C:\Windows\system32\Lnihod32.exe
        671⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        672⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        673⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        674⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Llabchoe.exe
        
        C:\Windows\system32\Llabchoe.exe
        675⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Lbkkpb32.exe
        
        C:\Windows\system32\Lbkkpb32.exe
        676⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Liecmlno.exe
        
        C:\Windows\system32\Liecmlno.exe
        677⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ljfodd32.exe
        
        C:\Windows\system32\Ljfodd32.exe
        678⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Laqhao32.exe
        
        C:\Windows\system32\Laqhao32.exe
        679⤵
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        680⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        681⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Mijlhl32.exe
        
        C:\Windows\system32\Mijlhl32.exe
        682⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        683⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        684⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Niconj32.exe
        
        C:\Windows\system32\Niconj32.exe
        685⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Njdlfbgm.exe
        
        C:\Windows\system32\Njdlfbgm.exe
        686⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        687⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Neafdjak.exe
        
        C:\Windows\system32\Neafdjak.exe
        688⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Ohboeenl.exe
        
        C:\Windows\system32\Ohboeenl.exe
        689⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        690⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        691⤵
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Objphn32.exe
        
        C:\Windows\system32\Objphn32.exe
        692⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Olbdacbp.exe
        
        C:\Windows\system32\Olbdacbp.exe
        693⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        694⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Okjnhpee.exe
        
        C:\Windows\system32\Okjnhpee.exe
        695⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        696⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pcccol32.exe
        
        C:\Windows\system32\Pcccol32.exe
        697⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        698⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Phbhlcpi.exe
        
        C:\Windows\system32\Phbhlcpi.exe
        699⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Pchljlpo.exe
        
        C:\Windows\system32\Pchljlpo.exe
        700⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Pibdff32.exe
        
        C:\Windows\system32\Pibdff32.exe
        701⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Pkcannmj.exe
        
        C:\Windows\system32\Pkcannmj.exe
        702⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Pcjioknl.exe
        
        C:\Windows\system32\Pcjioknl.exe
        703⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Pidaleei.exe
        
        C:\Windows\system32\Pidaleei.exe
        704⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Pkencn32.exe
        
        C:\Windows\system32\Pkencn32.exe
        705⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Qaofphbd.exe
        
        C:\Windows\system32\Qaofphbd.exe
        706⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        707⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        708⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Qkjgomgb.exe
        
        C:\Windows\system32\Qkjgomgb.exe
        709⤵
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\Aepklffh.exe
        
        C:\Windows\system32\Aepklffh.exe
        710⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Cjecjahd.exe
        
        C:\Windows\system32\Cjecjahd.exe
        711⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4756
        
        C:\Windows\SysWOW64\Cobkbhgk.exe
        
        C:\Windows\system32\Cobkbhgk.exe
        712⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Cmflkl32.exe
        
        C:\Windows\system32\Cmflkl32.exe
        713⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ccpdhfmb.exe
        
        C:\Windows\system32\Ccpdhfmb.exe
        714⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Cmhial32.exe
        
        C:\Windows\system32\Cmhial32.exe
        715⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Cjlijp32.exe
        
        C:\Windows\system32\Cjlijp32.exe
        716⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Dfcjoa32.exe
        
        C:\Windows\system32\Dfcjoa32.exe
        717⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        718⤵
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        719⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Djcoko32.exe
        
        C:\Windows\system32\Djcoko32.exe
        720⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        721⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        722⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        723⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        724⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4092
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        725⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        726⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Eiobmjkd.exe
        
        C:\Windows\system32\Eiobmjkd.exe
        727⤵
        
        PID:732
        
        C:\Windows\SysWOW64\Ecefjckj.exe
        
        C:\Windows\system32\Ecefjckj.exe
        728⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Eiaobjia.exe
        
        C:\Windows\system32\Eiaobjia.exe
        729⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        730⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        731⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        732⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        733⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        734⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        735⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Fihecici.exe
        
        C:\Windows\system32\Fihecici.exe
        736⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Fmfnig32.exe
        
        C:\Windows\system32\Fmfnig32.exe
        737⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Gplpfb32.exe
        
        C:\Windows\system32\Gplpfb32.exe
        738⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        739⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Gdobgp32.exe
        
        C:\Windows\system32\Gdobgp32.exe
        740⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Gkhkdjli.exe
        
        C:\Windows\system32\Gkhkdjli.exe
        741⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Gbcohl32.exe
        
        C:\Windows\system32\Gbcohl32.exe
        742⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Hingefqa.exe
        
        C:\Windows\system32\Hingefqa.exe
        743⤵
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        744⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        745⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Ikfgeh32.exe
        
        C:\Windows\system32\Ikfgeh32.exe
        746⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        747⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1564
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        748⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Igdnkhoe.exe
        
        C:\Windows\system32\Igdnkhoe.exe
        749⤵
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Ipmbcm32.exe
        
        C:\Windows\system32\Ipmbcm32.exe
        750⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Jjjpgb32.exe
        
        C:\Windows\system32\Jjjpgb32.exe
        751⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Jcdafg32.exe
        
        C:\Windows\system32\Jcdafg32.exe
        752⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        753⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Knlbipjb.exe
        
        C:\Windows\system32\Knlbipjb.exe
        754⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Kkpbbdil.exe
        
        C:\Windows\system32\Kkpbbdil.exe
        755⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Kmdlolmg.exe
        
        C:\Windows\system32\Kmdlolmg.exe
        756⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Kkgicccd.exe
        
        C:\Windows\system32\Kkgicccd.exe
        757⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Kmhejk32.exe
        
        C:\Windows\system32\Kmhejk32.exe
        758⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lcbngeqo.exe
        
        C:\Windows\system32\Lcbngeqo.exe
        759⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Ldbjah32.exe
        
        C:\Windows\system32\Ldbjah32.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:748
        
        C:\Windows\SysWOW64\Lklbnb32.exe
        
        C:\Windows\system32\Lklbnb32.exe
        761⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Lqikfi32.exe
        
        C:\Windows\system32\Lqikfi32.exe
        762⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lnadkmhj.exe
        
        C:\Windows\system32\Lnadkmhj.exe
        763⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Mcnmccfa.exe
        
        C:\Windows\system32\Mcnmccfa.exe
        764⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Mndapl32.exe
        
        C:\Windows\system32\Mndapl32.exe
        765⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Menimfnd.exe
        
        C:\Windows\system32\Menimfnd.exe
        766⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Mglfibmh.exe
        
        C:\Windows\system32\Mglfibmh.exe
        767⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        768⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        769⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        770⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Mklkepal.exe
        
        C:\Windows\system32\Mklkepal.exe
        771⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Maicmgoc.exe
        
        C:\Windows\system32\Maicmgoc.exe
        772⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        773⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        774⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Nladpo32.exe
        
        C:\Windows\system32\Nladpo32.exe
        775⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Nmbaggce.exe
        
        C:\Windows\system32\Nmbaggce.exe
        776⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        777⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Nndjgjhe.exe
        
        C:\Windows\system32\Nndjgjhe.exe
        778⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Nenbdd32.exe
        
        C:\Windows\system32\Nenbdd32.exe
        779⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Nlhkqngo.exe
        
        C:\Windows\system32\Nlhkqngo.exe
        780⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        781⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Nhokeolc.exe
        
        C:\Windows\system32\Nhokeolc.exe
        782⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        783⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        784⤵
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Ohahkojp.exe
        
        C:\Windows\system32\Ohahkojp.exe
        785⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        786⤵
        Modifies registry class
        
        PID:7964
        
        C:\Windows\SysWOW64\Ohhnln32.exe
        
        C:\Windows\system32\Ohhnln32.exe
        787⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Oeloebcb.exe
        
        C:\Windows\system32\Oeloebcb.exe
        788⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Olfgbl32.exe
        
        C:\Windows\system32\Olfgbl32.exe
        789⤵
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        790⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Phaabm32.exe
        
        C:\Windows\system32\Phaabm32.exe
        791⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Pkpmnh32.exe
        
        C:\Windows\system32\Pkpmnh32.exe
        792⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        793⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        794⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Adbdml32.exe
        
        C:\Windows\system32\Adbdml32.exe
        795⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Aeaagoaj.exe
        
        C:\Windows\system32\Aeaagoaj.exe
        796⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Alkidi32.exe
        
        C:\Windows\system32\Alkidi32.exe
        797⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Aahblp32.exe
        
        C:\Windows\system32\Aahblp32.exe
        798⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Anaofa32.exe
        
        C:\Windows\system32\Anaofa32.exe
        799⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        800⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        801⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        802⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        803⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Blieeglf.exe
        
        C:\Windows\system32\Blieeglf.exe
        804⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Bafnmnjn.exe
        
        C:\Windows\system32\Bafnmnjn.exe
        805⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        806⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Chbcphph.exe
        
        C:\Windows\system32\Chbcphph.exe
        807⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        808⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Coohbbeb.exe
        
        C:\Windows\system32\Coohbbeb.exe
        809⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        810⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Hbjonepq.exe
        
        C:\Windows\system32\Hbjonepq.exe
        811⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        812⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Iiipfnch.exe
        
        C:\Windows\system32\Iiipfnch.exe
        813⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ioeineap.exe
        
        C:\Windows\system32\Ioeineap.exe
        814⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Igmqpbab.exe
        
        C:\Windows\system32\Igmqpbab.exe
        815⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        816⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Ibcadcgf.exe
        
        C:\Windows\system32\Ibcadcgf.exe
        817⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Imieblgl.exe
        
        C:\Windows\system32\Imieblgl.exe
        818⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Iedjfodg.exe
        
        C:\Windows\system32\Iedjfodg.exe
        819⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Imkbglei.exe
        
        C:\Windows\system32\Imkbglei.exe
        820⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Iomood32.exe
        
        C:\Windows\system32\Iomood32.exe
        821⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Jmplbk32.exe
        
        C:\Windows\system32\Jmplbk32.exe
        822⤵
        Modifies registry class
        
        PID:9172
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        823⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Jekqgnno.exe
        
        C:\Windows\system32\Jekqgnno.exe
        824⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3856
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        825⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Knioij32.exe
        
        C:\Windows\system32\Knioij32.exe
        826⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Kjblcj32.exe
        
        C:\Windows\system32\Kjblcj32.exe
        827⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Kpoaed32.exe
        
        C:\Windows\system32\Kpoaed32.exe
        828⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Kgkfhngo.exe
        
        C:\Windows\system32\Kgkfhngo.exe
        829⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        830⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Lfbpnjjd.exe
        
        C:\Windows\system32\Lfbpnjjd.exe
        831⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Lqhdlc32.exe
        
        C:\Windows\system32\Lqhdlc32.exe
        832⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        833⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Mfchehla.exe
        
        C:\Windows\system32\Mfchehla.exe
        834⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Ngbeok32.exe
        
        C:\Windows\system32\Ngbeok32.exe
        835⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Npnjcm32.exe
        
        C:\Windows\system32\Npnjcm32.exe
        836⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Nppfimnm.exe
        
        C:\Windows\system32\Nppfimnm.exe
        837⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        838⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Nflkkf32.exe
        
        C:\Windows\system32\Nflkkf32.exe
        839⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Nabpiocm.exe
        
        C:\Windows\system32\Nabpiocm.exe
        840⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        841⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        842⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        843⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        844⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Onkimc32.exe
        
        C:\Windows\system32\Onkimc32.exe
        845⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Oplfekdp.exe
        
        C:\Windows\system32\Oplfekdp.exe
        846⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Offnae32.exe
        
        C:\Windows\system32\Offnae32.exe
        847⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Onmfcb32.exe
        
        C:\Windows\system32\Onmfcb32.exe
        848⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Opnbjk32.exe
        
        C:\Windows\system32\Opnbjk32.exe
        849⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        850⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Oclkqihc.exe
        
        C:\Windows\system32\Oclkqihc.exe
        851⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        852⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Pcnhfi32.exe
        
        C:\Windows\system32\Pcnhfi32.exe
        853⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        854⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        855⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Pjkmhblk.exe
        
        C:\Windows\system32\Pjkmhblk.exe
        856⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Pdcaahbk.exe
        
        C:\Windows\system32\Pdcaahbk.exe
        857⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Pploli32.exe
        
        C:\Windows\system32\Pploli32.exe
        858⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Pnmojp32.exe
        
        C:\Windows\system32\Pnmojp32.exe
        859⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Qjfmda32.exe
        
        C:\Windows\system32\Qjfmda32.exe
        860⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        861⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Amgefl32.exe
        
        C:\Windows\system32\Amgefl32.exe
        862⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        863⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Amibklml.exe
        
        C:\Windows\system32\Amibklml.exe
        864⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        865⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Agbgda32.exe
        
        C:\Windows\system32\Agbgda32.exe
        866⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        867⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        868⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ahdpdd32.exe
        
        C:\Windows\system32\Ahdpdd32.exe
        869⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Bkibqnah.exe
        
        C:\Windows\system32\Bkibqnah.exe
        870⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bacjmh32.exe
        
        C:\Windows\system32\Bacjmh32.exe
        871⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Bhmbjb32.exe
        
        C:\Windows\system32\Bhmbjb32.exe
        872⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Bogkgmho.exe
        
        C:\Windows\system32\Bogkgmho.exe
        873⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Bhpopb32.exe
        
        C:\Windows\system32\Bhpopb32.exe
        874⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Cpkddd32.exe
        
        C:\Windows\system32\Cpkddd32.exe
        875⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Ckphamkp.exe
        
        C:\Windows\system32\Ckphamkp.exe
        876⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Conagl32.exe
        
        C:\Windows\system32\Conagl32.exe
        877⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Calmcg32.exe
        
        C:\Windows\system32\Calmcg32.exe
        878⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ckealm32.exe
        
        C:\Windows\system32\Ckealm32.exe
        879⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        880⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Dkndbkop.exe
        
        C:\Windows\system32\Dkndbkop.exe
        881⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Dahmoefm.exe
        
        C:\Windows\system32\Dahmoefm.exe
        882⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        883⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Eqgmgq32.exe
        
        C:\Windows\system32\Eqgmgq32.exe
        884⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Fqnbgpmb.exe
        
        C:\Windows\system32\Fqnbgpmb.exe
        885⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Fagenneg.exe
        
        C:\Windows\system32\Fagenneg.exe
        886⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Gbgbgalj.exe
        
        C:\Windows\system32\Gbgbgalj.exe
        887⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Giqjdk32.exe
        
        C:\Windows\system32\Giqjdk32.exe
        888⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Gpkbaekd.exe
        
        C:\Windows\system32\Gpkbaekd.exe
        889⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Gicgjk32.exe
        
        C:\Windows\system32\Gicgjk32.exe
        890⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Gnppbapl.exe
        
        C:\Windows\system32\Gnppbapl.exe
        891⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Gejhol32.exe
        
        C:\Windows\system32\Gejhol32.exe
        892⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Gldpkfoe.exe
        
        C:\Windows\system32\Gldpkfoe.exe
        893⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gbnhhp32.exe
        
        C:\Windows\system32\Gbnhhp32.exe
        894⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gihpejmo.exe
        
        C:\Windows\system32\Gihpejmo.exe
        895⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Glfmaemc.exe
        
        C:\Windows\system32\Glfmaemc.exe
        896⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Gbpenpdp.exe
        
        C:\Windows\system32\Gbpenpdp.exe
        897⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Hlhife32.exe
        
        C:\Windows\system32\Hlhife32.exe
        898⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Hiljpi32.exe
        
        C:\Windows\system32\Hiljpi32.exe
        899⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Hbldinjb.exe
        
        C:\Windows\system32\Hbldinjb.exe
        900⤵
        
        PID:900
        
        C:\Windows\SysWOW64\Iejqeiif.exe
        
        C:\Windows\system32\Iejqeiif.exe
        901⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Iihilhol.exe
        
        C:\Windows\system32\Iihilhol.exe
        902⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ibqndm32.exe
        
        C:\Windows\system32\Ibqndm32.exe
        903⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Iogoinka.exe
        
        C:\Windows\system32\Iogoinka.exe
        904⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ioikon32.exe
        
        C:\Windows\system32\Ioikon32.exe
        905⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Ihbphcpo.exe
        
        C:\Windows\system32\Ihbphcpo.exe
        906⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Joqapmcf.exe
        
        C:\Windows\system32\Joqapmcf.exe
        907⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jhifib32.exe
        
        C:\Windows\system32\Jhifib32.exe
        908⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Jemfbgiq.exe
        
        C:\Windows\system32\Jemfbgiq.exe
        909⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jpbjophf.exe
        
        C:\Windows\system32\Jpbjophf.exe
        910⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jbagkkgj.exe
        
        C:\Windows\system32\Jbagkkgj.exe
        911⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Jpegeo32.exe
        
        C:\Windows\system32\Jpegeo32.exe
        912⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Keapmf32.exe
        
        C:\Windows\system32\Keapmf32.exe
        913⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Khplia32.exe
        
        C:\Windows\system32\Khplia32.exe
        914⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Kojdflkl.exe
        
        C:\Windows\system32\Kojdflkl.exe
        915⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Kchmljab.exe
        
        C:\Windows\system32\Kchmljab.exe
        916⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Kibeid32.exe
        
        C:\Windows\system32\Kibeid32.exe
        917⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Klpaep32.exe
        
        C:\Windows\system32\Klpaep32.exe
        918⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Kekbce32.exe
        
        C:\Windows\system32\Kekbce32.exe
        919⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Khiopp32.exe
        
        C:\Windows\system32\Khiopp32.exe
        920⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Locgljca.exe
        
        C:\Windows\system32\Locgljca.exe
        921⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Liikiccg.exe
        
        C:\Windows\system32\Liikiccg.exe
        922⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Llggeobk.exe
        
        C:\Windows\system32\Llggeobk.exe
        923⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Leplndhk.exe
        
        C:\Windows\system32\Leplndhk.exe
        924⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Lhnhkpgo.exe
        
        C:\Windows\system32\Lhnhkpgo.exe
        925⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Lohqgj32.exe
        
        C:\Windows\system32\Lohqgj32.exe
        926⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ljnddb32.exe
        
        C:\Windows\system32\Ljnddb32.exe
        927⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Lllaqn32.exe
        
        C:\Windows\system32\Lllaqn32.exe
        928⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Lcfimheb.exe
        
        C:\Windows\system32\Lcfimheb.exe
        929⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ledeicdf.exe
        
        C:\Windows\system32\Ledeicdf.exe
        930⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Lomjbikf.exe
        
        C:\Windows\system32\Lomjbikf.exe
        931⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Lhenko32.exe
        
        C:\Windows\system32\Lhenko32.exe
        932⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Mplfll32.exe
        
        C:\Windows\system32\Mplfll32.exe
        933⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mpocblpf.exe
        
        C:\Windows\system32\Mpocblpf.exe
        934⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Mpapgknd.exe
        
        C:\Windows\system32\Mpapgknd.exe
        935⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Mljmblae.exe
        
        C:\Windows\system32\Mljmblae.exe
        936⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Mhqngm32.exe
        
        C:\Windows\system32\Mhqngm32.exe
        937⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Ncfbdfgp.exe
        
        C:\Windows\system32\Ncfbdfgp.exe
        938⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Nhckmmeg.exe
        
        C:\Windows\system32\Nhckmmeg.exe
        939⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Nomcig32.exe
        
        C:\Windows\system32\Nomcig32.exe
        940⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Njgqaohd.exe
        
        C:\Windows\system32\Njgqaohd.exe
        941⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Ocihqc32.exe
        
        C:\Windows\system32\Ocihqc32.exe
        942⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Ofgdmo32.exe
        
        C:\Windows\system32\Ofgdmo32.exe
        943⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Obnebp32.exe
        
        C:\Windows\system32\Obnebp32.exe
        944⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Pihmojco.exe
        
        C:\Windows\system32\Pihmojco.exe
        945⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Pflmhnbi.exe
        
        C:\Windows\system32\Pflmhnbi.exe
        946⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Paaaeg32.exe
        
        C:\Windows\system32\Paaaeg32.exe
        947⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Pfojmn32.exe
        
        C:\Windows\system32\Pfojmn32.exe
        948⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Pmhbjhgc.exe
        
        C:\Windows\system32\Pmhbjhgc.exe
        949⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Abajnm32.exe
        
        C:\Windows\system32\Abajnm32.exe
        950⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Aikbkgcj.exe
        
        C:\Windows\system32\Aikbkgcj.exe
        951⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Apekha32.exe
        
        C:\Windows\system32\Apekha32.exe
        952⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Ajjoej32.exe
        
        C:\Windows\system32\Ajjoej32.exe
        953⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Adccnpqm.exe
        
        C:\Windows\system32\Adccnpqm.exe
        954⤵
        
        PID:6988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajhndkb.exe

Filesize
45KB

MD5
22e3f98b561bb3cef19c8a70a3fa8dd2

SHA1
3ec76763438fe65129db61e71231c7d9d7cd18f1

SHA256
26d6bc00a72976b302f2ebd75bb0ec79334f5aa0d477d3293c12bcb76bba944e

SHA512
0dfedfae4bbc0c073069500907a01310c392eaaf738e35ddad46f875ce4cf2df20fc0c45881394f00a0332b45f023e60780ba7ca15a4f3a874ad15648efaec97

Download Submit
C:\Windows\SysWOW64\Adcjop32.exe

Filesize
45KB

MD5
e862a4fc4b3418f5f234e3c187889225

SHA1
5ff9362f3051a29b00552f12a17f3c9489e31d9a

SHA256
91b127ae21ae6e32fe8cb90d5b771f9004b51be94a4982ac4f1146b18b916ed4

SHA512
15c23fbcba61986912127d837e2da1a802cc1dddf0429b0a4acfdf1244f409a4a76d5e2c925afc184c741137a695b00b12ea0bf41036777c810d49e4a36ae849

Download Submit
C:\Windows\SysWOW64\Ahmjjoig.exe

Filesize
45KB

MD5
4496e39f6ca61795bf1e8e1d2baa874b

SHA1
33a7c355b76944f25aa67dcfb7268f1a2adfc5f0

SHA256
7f50ffd52d97b1e31071831e6af397dc1f9b190b42fb5770296776a36fed99d5

SHA512
6504afdef8b39f8e3f4fdc858ccb6453545d757384d132d1007c4cac3c25b349a387a0a6e9a53a8b98f9faacf9a003aaa715c6aacb2b5988923085837f071b73

Download Submit
C:\Windows\SysWOW64\Alkidi32.exe

Filesize
45KB

MD5
67ad7056012b946adbf372ea85965281

SHA1
d7a0dd53720a48c7eccf8edde52f367e438f0460

SHA256
7e2fefad6c0de46220fbdc3dcfac4de2727775d923f2eba93ae5f5be999b354a

SHA512
7523aab6ddbfd5aaf025dc319c87cb53da464d832240cf1a8752763a79b67857384486dfcd4fa4c3371dfd833875a6cc6f6093ef1057385b69bff52e3a1400f0

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
45KB

MD5
6c404b533203634df7d1323052e012fc

SHA1
62dcda626dae359b2a72c64b7d516f18090482f8

SHA256
a975fa473cd8b91dc4b9ca080d78571bb3316bf58f610bf4223f0509a66d9585

SHA512
3703fd61497047c74dd60fef2819e8704be10f41657cbd1c906e39cf9c8901a55ba82ac887044105ac361567ffead9612cb1e1d07d3d0decf2959f259e75465c

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
45KB

MD5
6feaabd1f37d9dfae14598c6b332002f

SHA1
0faca4ed2f4fd06ea0fb7b0d2e5f31ed5cd9b1b3

SHA256
318260fd547cc5d47f2d89196758bfaf135842bd157078e48ee7f2d05775d4c1

SHA512
5dc00deb6bb7c462d01e3cb1eccc2fe1f3f8d64e31b5e15c184c3630d05e56112845c7af50a0ab8d6f0028009f84d1b4325e6d5c14edfab4fe1fe2200f9ed1c0

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
45KB

MD5
0b1eb916e056ded32cb878183af0fd51

SHA1
81c88cc0a7f6ccb2c4ffccc16ab3dfc2997154f7

SHA256
521e5523a38709c51cbaff65538e7cfd114f4ca08007879cd0c77fd2f7cfac5b

SHA512
1e92cf10f360a3651c8027d1c6e66cd0095b25eaca768c49d7e4bb869b1f535d318884d9442a34247298dcc5055444ae18a56f7c4f8c8bbc714089a2bd966164

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
45KB

MD5
09ae9ca16580a835fbce236cf91bafa6

SHA1
a1522f11b2b2c22e630879ad4329b3c957f40c40

SHA256
0b427d6ee09eb57c978c5c97b15da1ee0b8f81797b84d960926bcbc095a8087b

SHA512
1cc6d6fa003f90dd1e51f7bccfc7f28d8908f8ea7d65dae77288b29661a994ff2d897098d3112474be46b11f57f659022e5f769b4f1e23872501da483e7169de

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
45KB

MD5
265081eef92c2ff2cdbf7224f62cff10

SHA1
9c422021629f55273650bc5b54f4a53bd98f923b

SHA256
52656168cb98739fc148d08feea784932a6b92a71416fd57d830977adcf9e6a8

SHA512
15f9865a3064e6b2f2f1fc5e0cfd5c889a5abe775deac617a677d24dea25f204dd7e0ac78cab53fc99b2c9c28bdd5f0c1f043b4de6f1b04f21f5770c459b8a67

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
45KB

MD5
8beaf125fe1037d83d2da32cfe33637b

SHA1
67eca1310e79f61f889a55767cee7929cb9add0e

SHA256
1562eb3931d2a54d3332c0577ccbb46bc6286ba60b17eee3a1ade4f798f43738

SHA512
739682694151dcc893983017ecab08eb729d5c0c09a070bfeaca7bff542dfc777c289001561e663a4112271ff050b4f9fb3f5b2ac2105527255ff499a315712a

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
45KB

MD5
126eb4864756d69eafb3623a086b65f6

SHA1
b570684578e937e3470dee3859491cb02ff52843

SHA256
ba25be2e85d856b4c0ae3579bb3ff3742335c080af953e5ab7f0e784cc75a9ad

SHA512
588b0844a9094ee204757a77388cfe101621e0dabf8261a82551a92cd0658fce41402caa9069f1ecb190c57a796b48707048898b199d1b6db014b89d69905140

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
45KB

MD5
9b6bc6c1d8549c774c80b0cc25fd9fbe

SHA1
257140718fe8d9dc4475365edac9d204fcb40023

SHA256
2a535e78daa0c6e9f9749d9898a0206b60afebbbe956137a5bdcb0e7dfc92dc2

SHA512
8c873ce998802ca7be60e6ceccdffea4e2f8297eebf2249b96d24b6e31edb46f03a2633fa06244b346b245dacda98b8eeba568b993e0fe9c61235f0d4c21f55a

Download Submit
C:\Windows\SysWOW64\Dcgcaq32.exe

Filesize
45KB

MD5
a0aeb608f26af4b31389b66abe57439d

SHA1
e029a82f45ce1bb30cfafd758662730204be6c52

SHA256
eba63eec75860543e0e2ee52b6270b0b07bfe068623461559e611df5a28c7248

SHA512
ebf81874c5494011e52dfa78e442a57f23e7bdc94c948a576744897ea5d781d80a0c59c29573fa3936db21e88d190cdff7626ab9b97c8b3d45e747d5126abed2

Download Submit
C:\Windows\SysWOW64\Dhgonidg.exe

Filesize
45KB

MD5
62238e55ea33630a06baabe2c63f271f

SHA1
3060248273acccc2da0c88f9b76792be94995968

SHA256
34b72ebb5349e85ce97ec0ac3fb61a8a9626ceb94270a025521d7df887e5f43a

SHA512
b25a9e3b2f4be965e359641f310f1b6928f3dcf955e6be531fc9bffa4fba5aaa090e0ac18f15e457fbfa5e65532767350f0fe2895e454cc7eb124c7cd2298178

Download Submit
C:\Windows\SysWOW64\Dnonkq32.exe

Filesize
45KB

MD5
6a87812c8afc67cf081b2d09205896d7

SHA1
8727b1b9e79820a5c38e2103f43dd80b3318ea99

SHA256
15216895a5c17e30ebf760c46cc0aa5babb2b59d36e8ae16a90fa43615e6782b

SHA512
ca3a73281a69a123f3efaae11fea2230a809e6401f73747601741640e928c3fddf60cdc4599eee272c56134c4480291b7893dc7d3366c935041a4c77997ec429

Download Submit
C:\Windows\SysWOW64\Egaejeej.exe

Filesize
45KB

MD5
cc8cea59ff991a93ca6389c0e688f7f4

SHA1
55b418262ffcfbdb157f5955e3c493f977fd0afc

SHA256
4743493c1e50af7b755612a56f8a79b73eadeba4ea21729d7fe751ad4f43db84

SHA512
d3e5347723b5bdc15e1b936dc2b62c45d7ad1303a75948485ed021fdf78e2974396318e111311421feff1d978d31a084e46982bcabb9aad8e02ee68e6486d289

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
45KB

MD5
39fcb44f1e7ead31e231e46a555e2f49

SHA1
0114ae7254be73abc2ef77be5027ccae5b32dbee

SHA256
ac394b7c40468f1d8a7c952812afc2f378bb6af9213c83b1a3a876f44e6d3277

SHA512
1f48bb227185f05870513d31a2b566a82f81d58a67cfebd52036887ecef23eea0c99a339ff7bceb0b54413edc1df4b60e1c48d69a8b199d6b8023023da20e15d

Download Submit
C:\Windows\SysWOW64\Eomffaag.exe

Filesize
45KB

MD5
7ff418ce3303e8779a33f43b64bb4648

SHA1
0902970a364d4fe2d36ced5d3c6bfa053f80b7d9

SHA256
78ded8095a09608e56688264045217d2eb213dfd8d16913bc73457c18e375653

SHA512
500f5d70d06b67d510aad41008fa7e100befbf3034279a7f5ea5c50d9b16d19116f92b25152e9d235167a1c1f7168d08179940a5ef8edbeed77a100f2afb58a1

Download Submit
C:\Windows\SysWOW64\Fbplml32.exe

Filesize
45KB

MD5
be4e092c50c38fa07b9556c0d6fbfa4c

SHA1
31ce809ed0bbb675fcbc23e8f788af9c2fedc012

SHA256
ea300ae3b4557892a7b8ac5ffe59ba7653d6b9ba6113fcfdf687c352d344006f

SHA512
ba5e3ec596d660b5e6ccbe605460c535fd9a995bba5224189e7f72b4c7d94bb86d8b5d2282570c217ef6a6bded2506d613a5deef99c64b1828af6304cf72ec2c

Download Submit
C:\Windows\SysWOW64\Finnef32.exe

Filesize
45KB

MD5
136b26b6b85d33c4d8c4c3f440bc37ff

SHA1
397e4d85971fc295787c75e6411a06c2a6cfd2db

SHA256
4601441c9d18c055a9f055eb7d306ee7e85d57b786b1d5d40c090a50b9e15e91

SHA512
99a72953cb10af46c3d6655321962c41ca25389a6faed88f4c8ea8a860b51fa6d35f74f654de3b9fb69ad9ac666132f03b2bd74dd174e006d2d5db9188ed3224

Download Submit
C:\Windows\SysWOW64\Fooclapd.exe

Filesize
45KB

MD5
9e7f6dd823a21a47482572dc7aa6a2bc

SHA1
341890d821c04710b1d96921b9176fd70c5c8b97

SHA256
488ad4f6c3775ce477b8a5f6bb7c4e510d3b168e4ccc991bdeb78efddf1609e7

SHA512
7215d38642966ba623ff410e91dcfd343b216c87699b9dda9a606ddac23d7d5aae89d842a81695a1de7614aef20950bedf9df1e043747c99b596f7f2a4a4a397

Download Submit
C:\Windows\SysWOW64\Hiacacpg.exe

Filesize
45KB

MD5
59debbb7f13fe43893d871dbbe0727c6

SHA1
8bc34101774f75ef47d073f183d0f79f2070858c

SHA256
4ba8583fd535185433c705df888df43cc05eca3025a8f01a3ff5e32e9b578dfc

SHA512
7e26c26c4044efecbde74410692cd40d53833407c497edf24ef41a9df7ffd1ab5ff623abb319a161bf2df6e354dcb7c08819e6ca895f3fe1b0cde1a239499279

Download Submit
C:\Windows\SysWOW64\Inejlibi.exe

Filesize
45KB

MD5
c459b398dc8265e9c6625bdcee981088

SHA1
ab89e1fb43e7dc586bcc74f6a4ac6bded15c5868

SHA256
0f74423a3d9de953e9a9c68ba7e3f678603909768658f2d5450432ee5955698c

SHA512
ed2d5ef8c818b379da48d158832d7c204529b4cbd04dc1043ce1aeafc195eb21c88bc4a52d13a132c4840455d796eda1a86c337cbf438048c3e4f8dbb67ffb63

Download Submit
C:\Windows\SysWOW64\Jbepme32.exe

Filesize
45KB

MD5
0f6c1641b4a9ad1593995a93f368d1dd

SHA1
f1af5ded033be3445457794dbe613c2661151c01

SHA256
b832923595e5a3c77a5ebff4f40a37ed0ac3ff7dc5e66fe056c44bdda8b03035

SHA512
65e66296dee0aec9c6642d7a32ed5ee52be798fce02b15985f59b7dcc697187da59a13b8ab45c7ac1da149d00bc33647300a02007ad5a2fa37acc874787fa467

Download Submit
C:\Windows\SysWOW64\Jcknee32.exe

Filesize
45KB

MD5
079ea9b6788529d7fe661cca1f7cabc9

SHA1
cc7a6beb7dcb49775bd501b911b72fdfa7a6e0a4

SHA256
89d7c419dca99e7417ea606dd3d054192dc345d1f69dec2020a681c9d6e17932

SHA512
1c3934477db5653deef2cf940d08a8091793501e97338bd8ff33b1c86fe683e05bfa41b7065a22feff4d0775b9e3f99fd92493c6d78e6ac2df9b46e18728a65e

Download Submit
C:\Windows\SysWOW64\Jfbkijdo.exe

Filesize
45KB

MD5
8521755d9e15303699de14b64b12961d

SHA1
eefdb9bc031c9acb01c7f064933bc1a72386bc10

SHA256
2d9344ac250c60e74a7a6423bff31eb2f5966e40b900de34b9a720622007e009

SHA512
a3d2a98128a27da2dcdfbe837f1177c8c41fc7c6eaad776c484e83c4defed99f535213257ecbee2ab5f125888c16552215419ef5723af63a5979af8eccf89538

Download Submit
C:\Windows\SysWOW64\Jjihfbno.exe

Filesize
45KB

MD5
68d0f834424c5bad2371beaba7843736

SHA1
8a52dc4e4b0da9ba7da4169e8dc04a0df608421c

SHA256
260157888347e7e1412e380ca9e5fbc87c9a746d7c73cc974a842d75e351982f

SHA512
77e7c2b0179f03f8f14353b1954a3c0ca60ca77d2987f18af2682c218552ee8262247851e581e631417f4a3798fd7fd796c2ba1b610100444e20bba5218ba49f

Download Submit
C:\Windows\SysWOW64\Kbneij32.exe

Filesize
45KB

MD5
20ada745cf2de365cd3ac46fbb33f12c

SHA1
a85e0b6416e027d743c046f2b2276b9270bf6785

SHA256
bed978f7b11e2c3aa297ab99db7bf18a60324fba086d1e5fa5595e46b30d6c97

SHA512
ab682fdafcf1f60ed3f999a553c0505e29d38d33996d930fd4313bda288f2b22fe4aa86c4e16b8efc8d54224d9b5413f608b1ce06dc691b7b9ce65aa5464f060

Download Submit
C:\Windows\SysWOW64\Kpbfbo32.exe

Filesize
45KB

MD5
58a1f178ada3314d2670ca9e28a9334c

SHA1
75fd404047b9192e0399b5afb50e894288fffd6e

SHA256
f15d4b713f94ea9b6ea26ec697851aa742da605a60aaec1adb94b097a98005c1

SHA512
8a93a9dc4a1824a2b86420034d55ba8195ea33adf2c4095cacfb905f275d83452a28c6e5e921926e266f18d6c73f248638de637eee081ae16e0e6960f6b822d4

Download Submit
C:\Windows\SysWOW64\Ljbnfleo.exe

Filesize
45KB

MD5
05857a4b24f6f298051f358b1d94073a

SHA1
d873ef0b3f7b2573271ba29c1c4fc2bea07bf8e2

SHA256
23fad2d5dd2f57a372b639a10a5033a923f9bdd7516afa4219282b9e8026a4bc

SHA512
5e2c8915cdacb085d741879b3aa07d2b5d7b9abb0922b8f91982bbfef50c6c72287d424a7603e625e2f53e6c6ff7c8e8558f1559e9dd9211e41f1fe4a5b5ee01

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
45KB

MD5
47c27f81cf69e75c699ad6bec60c1750

SHA1
a9e96d378c0aaa50dd2b5d7b8456e4acaf7c7cbd

SHA256
4ccb6f9c431743993bbc79732555b970834748c1b8eb9b165f487eba0a036daa

SHA512
c79ea0196b4473db1ff4229d115639fb6008401500fd433e05b3095a16790f4be64e2a0ee24fc385da41a7e549d700dc98643ee468d86c081c87a8aaf01c1dc1

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
45KB

MD5
49f17dab471ce05d32df61975cb8bd23

SHA1
a82a9c93b8116a56215d07f188d049d25c49f32e

SHA256
4ef7c65552592ed95df98a8c8ebd3d9f50f034a2fd86e70ee149f5685b15c648

SHA512
15851d90c834f5026f7b030c82e2548863f9c7d282e456c4db6a6ba4225cb7eb011f0c2e2beef1eb943e09a5ff81c9de30535528db19145eea5e40a115b80a2b

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
45KB

MD5
04e9cadb2cac7d96e31457638c59f522

SHA1
e2cfbfddf593554b50f3800627c31a5fd93bee80

SHA256
0b3dd37450ee08ea3a2e8660606469e242f48148015d3b9ee96fac988b8aca48

SHA512
6fe74be0bc25e1a2296080f084c978ddb4cba1f232dd043c0ccb07ab8ea9bfba8cae62e82bb3f1521252805ea4069956830840268dda1f3d6c182a8ccfe450fc

Download Submit
C:\Windows\SysWOW64\Nolekd32.exe

Filesize
45KB

MD5
8d0bd67f2a7a7d5dbb8089b20afacfa4

SHA1
711b90f74ab56f1095be993034cc2fcd1939b7ee

SHA256
60ea429db8b7be7e2bb0ae21898b018f8b26a1dc3b0175d3a3210bfe52243c92

SHA512
8f1d09678379579798a7f1da6addf45b8c1dbf5cc96889850fcfaef86e7011d62cf2287fff795eaf8943267fc95ab1959d828aad204e2975d3cc921e0bedcc79

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
45KB

MD5
5f795921006b1a126875acc88b35479e

SHA1
054037668a890e2a7dc7e522b966dfe98c048603

SHA256
129c87bb17310bfce071c83dbe56f96937df7939e270f6486cb4f19c1ee7586e

SHA512
b43fc2a4a0e5cb48df9e590b298449d0c3d4b52676d0f41f24a49182c6b5ee656ac6fe0cc411690aa7eed2838183f888837328605319fe369b918670eea1b301

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
45KB

MD5
d86f160fa0eceba766348588bd61b6f0

SHA1
fcbd81eba8ecd245c5e8d1313096496e682462ab

SHA256
a5bac7437a970f6eed43a15554f751e74c0725db566b3dbcef987482dfbffe40

SHA512
463f71b30f194c18db8516f84bdcfb46c015d961a7095fe7f97e17e34530e5745fbca0721e186670ac6f0db67d3190afedbd811982da009130bae295ec8b36d3

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
45KB

MD5
54e1588dec993337a20911242a595b69

SHA1
35752945bccb26d97c0d9d4ccc5590c4039a316d

SHA256
846be6bae301336e02061b342f05fce157064a32187b0eadb14aa1bccda69719

SHA512
8687e21126acc2896ac3f525bf4e50bd0ef2bc11cd241a93925c1b44f39ca97bbcd3fd474fbe14f0c08fd960b18cdfeec8485ba714997b549055857c36ad05b7

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
45KB

MD5
64abb7a3628d5762ebeeac9a7cf12b39

SHA1
acb9bf5b0bc22cf74bbd64df17d6e9f14e25b448

SHA256
4adbd79693ab581412bef8a07976d5a34ef041012971d8c65cfeb245f1304c0a

SHA512
276769f4392881c110322286a2026e4dd46b9c195cc706b857413cdd3e288b20365fefb17a725964b92b28e0522e62ff4f9583de9980ae7e3677bc5daabd2328

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
45KB

MD5
6309b6154d29ae49bcac07463ccd4f91

SHA1
67b611c025b9de365212a30e7c068c1e012d5dfe

SHA256
adab69b52eb345ea6ac71ae1dabdb9d8129133675f46ded422fdca8c79b2f37a

SHA512
771b18ddbb23ce85a11a4f5e2687283be0e98c4ba4aee59611ffccd15de57aa4f24f80d35ecfb990fde361a2440a107c44275b1b09b97c99fa24c7c3800ed0b0

Download Submit
C:\Windows\SysWOW64\Pcfmneaa.exe

Filesize
45KB

MD5
f4e77479bd681f0fbf269881d2f8d710

SHA1
ddb2bd4dda30f3ac01089e7109bbd0b2d6f8306d

SHA256
8d349ae84ca3ba87edc494380c83de9b4f36f1a49755e8ce6a4daa2c4664e2e6

SHA512
9f50bf928975f5ef9e75028fa5eff904bab5bae41ce10af1aa43cedfcd347b6ff98fbdea771c7b8583d4cf7b20ad4c4f4b1f235712cfeab5e67fbe3bd6ae53dc

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
45KB

MD5
d05701f016b6dd357aed43d3670db3d1

SHA1
748c581d745b256c6f48535a81d04e109fb2864b

SHA256
b1181c823ca0d84118ea964d24b67ab9ee29ddcce6a0faae6bf30b9adcd9b62d

SHA512
78e74c9f9cf25566b749d33655e2fb855a178507fb7da0355ed5ff5b2121f781a9e3a702bd8db0b6107462b164f9c57331e8eadee71c13ecc55b41a92cdbc544

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
45KB

MD5
ef1a25f5324007fb165b23aa485ede0a

SHA1
f841c49984951df00cef880ab2621dbb07b664d6

SHA256
ea4c0737ad6c5d38b30089be989b6033ebab9a32f5d50bf2be1331324aa48474

SHA512
4c66babb363486c24a321e8dab413856e699fb17fef9776feea71472afe21e61a89903de67f8b449166f27d764f3919c74c4ebcbee044d0dd6170d6f85fda1aa

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
45KB

MD5
f2866c41222ba2140aaf2a8a726e5ace

SHA1
6e32de6f7e20452456bd07acc9f90b9800fdeec6

SHA256
fa56efa7f5d29bbf1b2fc9540bf57df1e902b1d3b73783042b83038b6e11df79

SHA512
73553f69613b0a905177c6fbb6d9eff047f3f38e64532d56fe64b5211a533ed77176eb4ae11008fcde80a4a749b69f194e7bce127a3d75061e977a7393b7fda9

Download Submit
C:\Windows\SysWOW64\Qfkqjmdg.exe

Filesize
45KB

MD5
0b110d0036eb84400ca3b1447164ed97

SHA1
a3785ba6a71e5828b95697154e502db842092f91

SHA256
79a5f410373c18b43d1fb9dc8a98748df666e0742cf801c4dcaaa3cfc0fc61ee

SHA512
c3cf134d1d4dd584494d18c0cfafefadb27f84622a12142208c54ac1d5b320358ce7ffabe58c978b5ed7d2529ddf75888854f6b19a21d99e6eddad74620e7a1d

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
45KB

MD5
88072ea0487dd92ce5f6468ae0c03854

SHA1
fd1c07cf3def813eddde2ebd990cb36226d551a9

SHA256
6656829e33429b1ec0d4bb97494e952e28dfb72801495f5c8daff06865190cbc

SHA512
f1878ce3ad90fb80fc4b3c7c90042d33788476c93dace31fd893b0d44d05eaeabe62c99521d3dcd9222095d5a0be839aaf32178ee2989d61417b4fd27a67bc55

Download Submit
memory/560-125-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-369-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/976-397-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1004-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1004-431-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1008-359-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1008-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-257-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1120-441-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1204-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1204-405-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1232-407-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1232-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1444-469-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1444-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1516-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1516-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1564-474-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-129-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-423-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-434-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1648-371-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1648-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-383-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1724-287-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1752-415-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1752-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1760-486-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1760-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1804-341-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-399-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1836-408-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1924-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1924-395-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1944-471-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2004-425-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2004-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2024-463-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2024-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2304-355-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-362-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-461-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2388-305-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2592-317-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2620-347-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2620-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2840-201-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2840-460-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2928-281-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-293-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2992-443-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3224-323-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3264-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3264-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-335-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3300-263-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3316-385-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3360-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3360-368-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3508-378-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3508-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3652-440-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3652-185-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3656-396-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3656-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-439-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3844-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3844-473-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3996-269-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-233-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-470-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-432-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4104-455-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4104-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4220-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4316-311-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4516-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4608-217-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4608-468-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4708-449-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4780-353-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4856-329-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4960-421-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4988-299-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5048-367-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5048-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads