22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe
Size

88KB
MD5

0b46392d12adb6ede774ea02874ac8a3
SHA1

522b770873a472cf4ea53640174a7d1e305552d6
SHA256

22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8
SHA512

aad830325a81504e71ba8d69ac17f89eb84f9a6816f9353d3099e7b87c0bda053900fa19408f5086cd42c5a2462cdd47714534fe6fbe87275eeafd4af954cb26
SSDEEP

1536:YRfvWT0PUwNWQujovZdwFL8QOVXtE1ukVd71rFZO7+90vT:YRn+IUwNXujovZ6Li9EIIJ15ZO7Vr

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maggnali.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcaofebg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckjbhmad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaclqkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccbadp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmlmkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njmhhefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naaqofgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplafeil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eokqkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fimhjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohgoaehe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agbkmijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekefmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liqihglg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Famjkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbekqdjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afinioip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiekog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhkgoiqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ophjiaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcaofebg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbnhedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbdiknlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idjlpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgbbek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cikglnkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkglja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dndgfpbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhnojl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ighhln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nefped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpochfji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqeioiam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmpiiai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacjadad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpffeaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfmcfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haoimcgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpbpbecj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefphb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbkkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgpmmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgcjfbed.exe

Executes dropped EXE 64 IoCs

pid	Process
4340	Megdccmb.exe
720	Mdhdajea.exe
4168	Mmpijp32.exe
2852	Melnob32.exe
3768	Mlefklpj.exe
2688	Mcpnhfhf.exe
5040	Nilcjp32.exe
4328	Ncdgcf32.exe
5064	Nebdoa32.exe
4376	Ndcdmikd.exe
840	Njqmepik.exe
1680	Nloiakho.exe
1160	Nfgmjqop.exe
2140	Ndhmhh32.exe
756	Odkjng32.exe
404	Qmmnjfnl.exe
4616	Qgcbgo32.exe
3032	Aqkgpedc.exe
1756	Afhohlbj.exe
744	Ambgef32.exe
4980	Anadoi32.exe
1088	Aabmqd32.exe
4304	Afoeiklb.exe
1048	Aadifclh.exe
2236	Bjmnoi32.exe
2828	Bebblb32.exe
4248	Bnkgeg32.exe
2480	Bchomn32.exe
4452	Balpgb32.exe
1156	Bfhhoi32.exe
2216	Bmbplc32.exe
4536	Bhhdil32.exe
4836	Belebq32.exe
740	Cfmajipb.exe
2508	Cabfga32.exe
2068	Chmndlge.exe
4788	Cnffqf32.exe
4184	Caebma32.exe
4352	Cfbkeh32.exe
2372	Cnicfe32.exe
4052	Cfdhkhjj.exe
4088	Cnkplejl.exe
2152	Cajlhqjp.exe
4444	Cffdpghg.exe
4208	Cmqmma32.exe
3676	Cegdnopg.exe
3696	Dopigd32.exe
4456	Dejacond.exe
2432	Dobfld32.exe
5052	Dhkjej32.exe
3972	Dhmgki32.exe
1084	Dogogcpo.exe
4120	Daekdooc.exe
3260	Dddhpjof.exe
732	Dknpmdfc.exe
2532	Edfdej32.exe
3148	Ekpmbddq.exe
5136	Edhakj32.exe
5176	Ekbihd32.exe
5216	Emaedo32.exe
5256	Eehnem32.exe
5296	Ekefmc32.exe
5336	Edmjfifl.exe
5380	Eglgbdep.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hibjli32.exe	Holfoqcm.exe
File created	C:\Windows\SysWOW64\Pjphcf32.dll	Ojnfihmo.exe
File created	C:\Windows\SysWOW64\Ojcpdg32.exe	Oblhcj32.exe
File opened for modification	C:\Windows\SysWOW64\Goljqnpd.exe	Ggeboaob.exe
File created	C:\Windows\SysWOW64\Aboiil32.dll	Iohjlmeg.exe
File created	C:\Windows\SysWOW64\Cbeapmll.exe	Ccbadp32.exe
File created	C:\Windows\SysWOW64\Cmhigf32.exe	Cimmggfl.exe
File created	C:\Windows\SysWOW64\Mkjnfkma.exe	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Anmfbl32.exe	Aknifq32.exe
File created	C:\Windows\SysWOW64\Hnqhicol.dll	Gkobjpin.exe
File opened for modification	C:\Windows\SysWOW64\Plcdiabk.exe	Pcicklnn.exe
File opened for modification	C:\Windows\SysWOW64\Oidhlb32.exe	Oampjeml.exe
File opened for modification	C:\Windows\SysWOW64\Ikpjbq32.exe	Idfaefkd.exe
File created	C:\Windows\SysWOW64\Qachgk32.exe	Qkipkani.exe
File opened for modification	C:\Windows\SysWOW64\Fgjhpcmo.exe	Figgdg32.exe
File created	C:\Windows\SysWOW64\Dahceqce.dll	Ganldgib.exe
File opened for modification	C:\Windows\SysWOW64\Laiipofp.exe	Lojmcdgl.exe
File created	C:\Windows\SysWOW64\Balpgb32.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Abponp32.exe	Aoabad32.exe
File opened for modification	C:\Windows\SysWOW64\Coiaiakf.exe	Cmjemflb.exe
File opened for modification	C:\Windows\SysWOW64\Jgfdmlcm.exe	Jfehed32.exe
File created	C:\Windows\SysWOW64\Ecjfni32.dll	Hjlkge32.exe
File created	C:\Windows\SysWOW64\Onnmdcjm.exe	Odhifjkg.exe
File created	C:\Windows\SysWOW64\Iibjhgbi.dll	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Fnadil32.dll	Ebdcld32.exe
File created	C:\Windows\SysWOW64\Pblkiipl.dll	Fahaplon.exe
File opened for modification	C:\Windows\SysWOW64\Fhgbhfbe.exe	Famjkl32.exe
File created	C:\Windows\SysWOW64\Efqidp32.dll	Fhgbhfbe.exe
File created	C:\Windows\SysWOW64\Ipgkjlmg.exe	Ihpcinld.exe
File created	C:\Windows\SysWOW64\Cibncf32.dll	Fpodlbng.exe
File opened for modification	C:\Windows\SysWOW64\Lhkgoiqe.exe	Lfjjga32.exe
File created	C:\Windows\SysWOW64\Gehcdm32.dll	Nhmofj32.exe
File created	C:\Windows\SysWOW64\Melnob32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Ogclbn32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Ghcfpl32.dll	Mfenglqf.exe
File opened for modification	C:\Windows\SysWOW64\Blhpqhlh.exe	Bhldpj32.exe
File opened for modification	C:\Windows\SysWOW64\Emanjldl.exe	Efgemb32.exe
File opened for modification	C:\Windows\SysWOW64\Mbdiknlb.exe	Lcmodajm.exe
File opened for modification	C:\Windows\SysWOW64\Dfefkkqp.exe	Cbgnemjj.exe
File created	C:\Windows\SysWOW64\Efgemb32.exe	Ekaapi32.exe
File opened for modification	C:\Windows\SysWOW64\Aajhndkb.exe	Agdcpkll.exe
File opened for modification	C:\Windows\SysWOW64\Fooclapd.exe	Eghkjdoa.exe
File created	C:\Windows\SysWOW64\Hmjbog32.dll	Jhnojl32.exe
File opened for modification	C:\Windows\SysWOW64\Melnob32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Iojfje32.dll	Keonap32.exe
File created	C:\Windows\SysWOW64\Edopabqn.exe	Eaqdegaj.exe
File created	C:\Windows\SysWOW64\Kpiqfima.exe	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Ccbadp32.exe	Cofecami.exe
File created	C:\Windows\SysWOW64\Fgbdja32.dll	Ipmbjgpi.exe
File created	C:\Windows\SysWOW64\Ekfcklij.dll	Ckeimm32.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Nlcagc32.dll	Gdafnpqh.exe
File created	C:\Windows\SysWOW64\Mbbagk32.exe	Llhikacp.exe
File created	C:\Windows\SysWOW64\Fqhajknb.dll	Amodep32.exe
File created	C:\Windows\SysWOW64\Hpdclcbj.dll	Efmmmn32.exe
File created	C:\Windows\SysWOW64\Bionkjfo.dll	Mniallpq.exe
File opened for modification	C:\Windows\SysWOW64\Qmgelf32.exe	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Lgpjggdi.dll	Gdncmghi.exe
File created	C:\Windows\SysWOW64\Nhqihllh.dll	Jbgoof32.exe
File created	C:\Windows\SysWOW64\Mleggmck.dll	Kadpdp32.exe
File created	C:\Windows\SysWOW64\Ibffdoal.dll	Ophjiaql.exe
File created	C:\Windows\SysWOW64\Cmfclm32.exe	Cikglnkj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8728	4600	WerFault.exe	913

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbnepe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbkgji32.dll"	Lhijijbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caghhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnlkgflm.dll"	Meefofek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifffn32.dll"	Haodle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liqihglg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhmeapmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efhlhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kamjda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpgodhkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiohdo32.dll"	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgpmmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnckgmik.dll"	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfejnf32.dll"	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikndgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhhdcojj.dll"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibclmgdb.dll"	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgfeip32.dll"	Cbfgkffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqopkcbn.dll"	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkkkihe.dll"	Edfdej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laahglpp.dll"	Ghkeio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaplji32.dll"	Micoed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmlddqem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohhnbhok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckgofgjn.dll"	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikikigb.dll"	Cfpffeaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjnfdhk.dll"	Glkmmefl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmonnmjm.dll"	Foghnabl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcondbo.dll"	Emnbdioi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojigdcll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpbpbecj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhbih32.dll"	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogcgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmklglpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcjmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdjfee32.dll"	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlppno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oebfih32.dll"	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikfhji32.dll"	Fllkqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pialao32.dll"	Mifcejnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccfel32.dll"	Coiaiakf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmiogmig.dll"	Fipkjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baampdgc.dll"	Finnef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbfheo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcjcnpe.dll"	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgbfhmll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbaojpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cffpglpg.dll"	Lalnmiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oampjeml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onnmdcjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpnakk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hioflcbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foqkdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgodhkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgogbi32.dll"	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oohgdhfn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4340	3716	22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe	92
PID 3716 wrote to memory of 4340	3716	22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe	92
PID 3716 wrote to memory of 4340	3716	22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe	92
PID 4340 wrote to memory of 720	4340	Megdccmb.exe	93
PID 4340 wrote to memory of 720	4340	Megdccmb.exe	93
PID 4340 wrote to memory of 720	4340	Megdccmb.exe	93
PID 720 wrote to memory of 4168	720	Mdhdajea.exe	95
PID 720 wrote to memory of 4168	720	Mdhdajea.exe	95
PID 720 wrote to memory of 4168	720	Mdhdajea.exe	95
PID 4168 wrote to memory of 2852	4168	Mmpijp32.exe	96
PID 4168 wrote to memory of 2852	4168	Mmpijp32.exe	96
PID 4168 wrote to memory of 2852	4168	Mmpijp32.exe	96
PID 2852 wrote to memory of 3768	2852	Melnob32.exe	97
PID 2852 wrote to memory of 3768	2852	Melnob32.exe	97
PID 2852 wrote to memory of 3768	2852	Melnob32.exe	97
PID 3768 wrote to memory of 2688	3768	Mlefklpj.exe	98
PID 3768 wrote to memory of 2688	3768	Mlefklpj.exe	98
PID 3768 wrote to memory of 2688	3768	Mlefklpj.exe	98
PID 2688 wrote to memory of 5040	2688	Mcpnhfhf.exe	99
PID 2688 wrote to memory of 5040	2688	Mcpnhfhf.exe	99
PID 2688 wrote to memory of 5040	2688	Mcpnhfhf.exe	99
PID 5040 wrote to memory of 4328	5040	Nilcjp32.exe	100
PID 5040 wrote to memory of 4328	5040	Nilcjp32.exe	100
PID 5040 wrote to memory of 4328	5040	Nilcjp32.exe	100
PID 4328 wrote to memory of 5064	4328	Ncdgcf32.exe	101
PID 4328 wrote to memory of 5064	4328	Ncdgcf32.exe	101
PID 4328 wrote to memory of 5064	4328	Ncdgcf32.exe	101
PID 5064 wrote to memory of 4376	5064	Nebdoa32.exe	103
PID 5064 wrote to memory of 4376	5064	Nebdoa32.exe	103
PID 5064 wrote to memory of 4376	5064	Nebdoa32.exe	103
PID 4376 wrote to memory of 840	4376	Ndcdmikd.exe	104
PID 4376 wrote to memory of 840	4376	Ndcdmikd.exe	104
PID 4376 wrote to memory of 840	4376	Ndcdmikd.exe	104
PID 840 wrote to memory of 1680	840	Njqmepik.exe	105
PID 840 wrote to memory of 1680	840	Njqmepik.exe	105
PID 840 wrote to memory of 1680	840	Njqmepik.exe	105
PID 1680 wrote to memory of 1160	1680	Nloiakho.exe	106
PID 1680 wrote to memory of 1160	1680	Nloiakho.exe	106
PID 1680 wrote to memory of 1160	1680	Nloiakho.exe	106
PID 1160 wrote to memory of 2140	1160	Nfgmjqop.exe	107
PID 1160 wrote to memory of 2140	1160	Nfgmjqop.exe	107
PID 1160 wrote to memory of 2140	1160	Nfgmjqop.exe	107
PID 2140 wrote to memory of 756	2140	Ndhmhh32.exe	108
PID 2140 wrote to memory of 756	2140	Ndhmhh32.exe	108
PID 2140 wrote to memory of 756	2140	Ndhmhh32.exe	108
PID 756 wrote to memory of 404	756	Odkjng32.exe	110
PID 756 wrote to memory of 404	756	Odkjng32.exe	110
PID 756 wrote to memory of 404	756	Odkjng32.exe	110
PID 404 wrote to memory of 4616	404	Qmmnjfnl.exe	111
PID 404 wrote to memory of 4616	404	Qmmnjfnl.exe	111
PID 404 wrote to memory of 4616	404	Qmmnjfnl.exe	111
PID 4616 wrote to memory of 3032	4616	Qgcbgo32.exe	112
PID 4616 wrote to memory of 3032	4616	Qgcbgo32.exe	112
PID 4616 wrote to memory of 3032	4616	Qgcbgo32.exe	112
PID 3032 wrote to memory of 1756	3032	Aqkgpedc.exe	113
PID 3032 wrote to memory of 1756	3032	Aqkgpedc.exe	113
PID 3032 wrote to memory of 1756	3032	Aqkgpedc.exe	113
PID 1756 wrote to memory of 744	1756	Afhohlbj.exe	114
PID 1756 wrote to memory of 744	1756	Afhohlbj.exe	114
PID 1756 wrote to memory of 744	1756	Afhohlbj.exe	114
PID 744 wrote to memory of 4980	744	Ambgef32.exe	115
PID 744 wrote to memory of 4980	744	Ambgef32.exe	115
PID 744 wrote to memory of 4980	744	Ambgef32.exe	115
PID 4980 wrote to memory of 1088	4980	Anadoi32.exe	116

C:\Users\Admin\AppData\Local\Temp\22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe
"C:\Users\Admin\AppData\Local\Temp\22e5400c6f58215ee00e243928b1c7ff8ead9fd01a6a60eb0f78f1fa72424fa8.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\Megdccmb.exe
  C:\Windows\system32\Megdccmb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\Mdhdajea.exe
    C:\Windows\system32\Mdhdajea.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\SysWOW64\Mmpijp32.exe
      C:\Windows\system32\Mmpijp32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        24⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        25⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        26⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        27⤵
        Executes dropped EXE
        
        PID:2828
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        28⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        30⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        31⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        32⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        33⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        34⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        36⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        37⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        39⤵
        Executes dropped EXE
        
        PID:4184
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        40⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        41⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        42⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        44⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        45⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        46⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        47⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        48⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        49⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        51⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        52⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        53⤵
        Executes dropped EXE
        
        PID:1084
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        54⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        55⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:732
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        58⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        59⤵
        Executes dropped EXE
        
        PID:5136
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        60⤵
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        61⤵
        Executes dropped EXE
        
        PID:5216
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        62⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5296
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        64⤵
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        65⤵
        Executes dropped EXE
        
        PID:5380
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        66⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        67⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        68⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        69⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        70⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        71⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        72⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        73⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        74⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        75⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        76⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        77⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        79⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        80⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        81⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        83⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        84⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        85⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        86⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        87⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        88⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        89⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        90⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        91⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        92⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        93⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        94⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        95⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        96⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        97⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        98⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        99⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        100⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        101⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        102⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        103⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        104⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        105⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        108⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        109⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        110⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        111⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        112⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        113⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        114⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        115⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        116⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        117⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        118⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        119⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        120⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        121⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        122⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        123⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        124⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        125⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        126⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        127⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        128⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        129⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        130⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        131⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        132⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        134⤵
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        136⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        138⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        139⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        140⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        141⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        142⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        143⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        144⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6632
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        146⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        147⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        148⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        149⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        150⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        151⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        152⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        153⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        154⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        156⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        157⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        158⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        159⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        160⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        161⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        162⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        163⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        164⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        165⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2268
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        167⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        168⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        169⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        170⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        173⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        174⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        175⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        176⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        177⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        178⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        179⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        180⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        181⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        183⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        184⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        185⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        186⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        187⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        188⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        189⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        190⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        191⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        192⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        193⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        194⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        195⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        196⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        197⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        198⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        199⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        200⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        201⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        202⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        204⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        205⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        206⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        207⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        208⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        209⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        210⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        211⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        212⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        213⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        214⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        215⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        216⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        217⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        218⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        219⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        220⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        222⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        223⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        224⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        225⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        226⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        227⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        228⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        229⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        230⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        231⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        232⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        233⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        234⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        236⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        237⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        238⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        239⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        240⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        241⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        242⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        243⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        244⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        245⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        246⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        247⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        248⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        249⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        250⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        251⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        252⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        253⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        254⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        255⤵
        Modifies registry class
        
        PID:8804
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        256⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        258⤵
        Drops file in System32 directory
        
        PID:8936
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        259⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        260⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        261⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        262⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        263⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        264⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        265⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        266⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        267⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8396
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        269⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        271⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        272⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        273⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        274⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        275⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        276⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        277⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        278⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        279⤵
        Modifies registry class
        
        PID:9064
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        280⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        281⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        282⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        283⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        284⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        285⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        286⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        287⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        288⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        289⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        290⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        291⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        292⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        293⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        294⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        295⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        297⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        298⤵
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8220
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        300⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        301⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        302⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        303⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        304⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        305⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        306⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        307⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        308⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        309⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        310⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        311⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        312⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        313⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        314⤵
        Modifies registry class
        
        PID:9432
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        315⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        316⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        317⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        318⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9644
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9684
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        321⤵
        Modifies registry class
        
        PID:9724
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        322⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        323⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        324⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        325⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        327⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        328⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        329⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        330⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        331⤵
        Modifies registry class
        
        PID:10144
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        332⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        333⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        334⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        335⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        336⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        337⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        338⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        340⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        341⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        342⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        343⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        344⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        345⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        346⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10132
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        348⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        349⤵
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        350⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        351⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        352⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        353⤵
        Drops file in System32 directory
        
        PID:9716
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        354⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        355⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        356⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        357⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        358⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        359⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        360⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        361⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        362⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        363⤵
        Modifies registry class
        
        PID:9236
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        364⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        365⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        366⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        367⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        368⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        369⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        370⤵
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10284
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        372⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        373⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        374⤵
        Drops file in System32 directory
        
        PID:10408
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        375⤵
        Modifies registry class
        
        PID:10452
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        376⤵
        Drops file in System32 directory
        
        PID:10496
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        377⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        378⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        379⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        380⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        381⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        382⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        383⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        384⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        385⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        386⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        387⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        388⤵
        Modifies registry class
        
        PID:11008
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        389⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        390⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        391⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        392⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        393⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        394⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        395⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        396⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        397⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        398⤵
        Modifies registry class
        
        PID:10492
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        399⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        400⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        401⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        402⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        403⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        404⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        405⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        406⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        407⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        409⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        410⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        411⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        412⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        413⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        414⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        415⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        416⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11056
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        418⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        419⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        420⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        421⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        422⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        423⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        424⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        425⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10388
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        426⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        427⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        428⤵
        Drops file in System32 directory
        
        PID:11220
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        429⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        430⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        431⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        432⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        433⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        434⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11324
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        436⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        437⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        438⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        439⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        440⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        441⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        442⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        443⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        444⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        445⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        446⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        447⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        448⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        449⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        450⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        451⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        452⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        453⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        454⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        455⤵
        Drops file in System32 directory
        
        PID:12224
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        456⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        457⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11352
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        459⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        460⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        461⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        462⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        463⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        464⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        465⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        466⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        467⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        468⤵
        Modifies registry class
        
        PID:12056
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        469⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12192
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        471⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        472⤵
        Drops file in System32 directory
        
        PID:11316
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        473⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        474⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        475⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:828
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2324
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        478⤵
        Modifies registry class
        
        PID:11940
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        479⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        480⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        481⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        482⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        483⤵
        Drops file in System32 directory
        
        PID:4992
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        484⤵
        Modifies registry class
        
        PID:11404
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        485⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        486⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        487⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        488⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12036
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        490⤵
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        491⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        492⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        493⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        494⤵
        Modifies registry class
        
        PID:11508
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        495⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        496⤵
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        497⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        498⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        499⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        500⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        501⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        502⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        503⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        504⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3768
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        506⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        507⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        508⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        509⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        510⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        511⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        512⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        513⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        514⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        515⤵
        Drops file in System32 directory
        
        PID:12456
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        516⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        517⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        518⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        519⤵
        Drops file in System32 directory
        
        PID:12636
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12680
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        521⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        522⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        523⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        524⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        525⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        526⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        527⤵
        Modifies registry class
        
        PID:12984
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        528⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        529⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        530⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        531⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        532⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        533⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        534⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        535⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        536⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        537⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        538⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        539⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        540⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        541⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        542⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11444
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        544⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        545⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        546⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        547⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        548⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        549⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        550⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        551⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        552⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        553⤵
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        554⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        555⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        556⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        557⤵
        Drops file in System32 directory
        
        PID:12600
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        558⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        559⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        560⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        561⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        562⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        563⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        564⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13204
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        566⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13300
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        568⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        569⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        570⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        571⤵
        Modifies registry class
        
        PID:12492
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        572⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        573⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        574⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        575⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12908
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        577⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        578⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        579⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        580⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        581⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        582⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        583⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        584⤵
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        585⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        586⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        587⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        588⤵
        Drops file in System32 directory
        
        PID:12780
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        589⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3568
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        591⤵
        Modifies registry class
        
        PID:13048
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        592⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        593⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        594⤵
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        595⤵
        Drops file in System32 directory
        
        PID:12360
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        596⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        597⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        598⤵
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        599⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        600⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        601⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        602⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:756
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        604⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        605⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        606⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        607⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        608⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        609⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        610⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        611⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        612⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        613⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        614⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        615⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        616⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        617⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        618⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        620⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        621⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        622⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        623⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        624⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        625⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        626⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        627⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        628⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        629⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        630⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        631⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        632⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        633⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        634⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        635⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        636⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        637⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        638⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        639⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        640⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        641⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        642⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        643⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        644⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        645⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        646⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        647⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        648⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        649⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        650⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        651⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        652⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        653⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        654⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        655⤵
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        656⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        657⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        658⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        659⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        660⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        661⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        662⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        663⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        664⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        665⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        666⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        667⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        668⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        669⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        670⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        671⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        672⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        673⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        674⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        675⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        676⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        677⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        678⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        679⤵
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        680⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        681⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        682⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        683⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        684⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        685⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        686⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        687⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        688⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        689⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        690⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7988
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        691⤵
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        692⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        693⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        694⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        695⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        696⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        697⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        698⤵
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        699⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        700⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        701⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        702⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        703⤵
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        704⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        705⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        706⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        707⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        708⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        709⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        710⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        711⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        712⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        713⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        714⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        715⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        716⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        717⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        718⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        719⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        720⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        721⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        722⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        723⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        724⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        725⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        726⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        727⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        728⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        729⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        730⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        731⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        732⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        733⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        734⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        735⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        736⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        737⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        738⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        739⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        740⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        741⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        742⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        743⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        744⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        745⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        746⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        747⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        748⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        749⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        750⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        751⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        752⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        753⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        754⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        755⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        756⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        757⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        758⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        759⤵
        Modifies registry class
        
        PID:8396
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        760⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        761⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        762⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        763⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        764⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        765⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        766⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        767⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        768⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        769⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        770⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        771⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        772⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        773⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        774⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        775⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        776⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        777⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        778⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        779⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        780⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        781⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        782⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        783⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        784⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        785⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        786⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        787⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        788⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        789⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        790⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        791⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        792⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        793⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        794⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        795⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        796⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        797⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        798⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        799⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        800⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        801⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        802⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        803⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        804⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        805⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        806⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        807⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        808⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        809⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        810⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        811⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 220
        812⤵
        Program crash
        
        PID:8728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:8
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4600 -ip 4600
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
88KB

MD5
5e326255722e99d6e0c70530e34ef436

SHA1
b15f03980e93f3dd4465cda3f8294aa86110b98a

SHA256
1bf6ae1f6841abd3c9740b481ecf66cf1de30a4d87c1ea64e95d8d8935c8a6ff

SHA512
5dc0dd6a056d0c5fc3ef8cfd8e8057d806da4a29de0bfac85977d91abae58f84c7ba6c5bf424385e1841fd7226079f55485d3a1fc36f9da958b2c40cc4d4a62c

Download Submit
C:\Windows\SysWOW64\Aadifclh.exe

Filesize
88KB

MD5
2affc8036f3c7c71a1ca504a0bed5453

SHA1
a4215aeabc99df1c8069493f1257895c7f2b8dcd

SHA256
f1bc9b7dc9d96d715d1c4fd80e8eeef7d7e65896ff1620ee5fcd5597f7509920

SHA512
119464d2faa28b89b245c202a734afb9dc749a60b7a2074a8673fa8b8bb34f005e360141550a13cc0e975e5140cd1d6a02822d16ae9db8c35ce96f057606f15b

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
88KB

MD5
af5b9ee18733d4edbb2e281c3d315b4f

SHA1
c88d9a2704d32a85b3f3a847276fbcbc3ec63250

SHA256
adef12d7e7e3f15d8958292030f4991527b1153c1288093a3c8a8718943ca6be

SHA512
088f965c2121219f3e9d1700ece919410e10a54a7279470a327533f5d6f95b9bd8fc6ab660845a2bc9569d9d6949372948fdea408be8f0764b7c286c43176567

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
88KB

MD5
bc4a5bdf7e274ed2e4e50c59e6dda79e

SHA1
c33d7aca0db51d7595dafb7eba4aa9b4a6a4c4c6

SHA256
48017b38873b5b204253a916d4ca1a8a7202b62e2a113b1d464c7f41ba379c55

SHA512
498e1a114822e52a225ee0919e2d12750aadd8fa1ec1053d7ce0928b5da129b6900c11259a58e0394098ff2b51b4c256f0ed74663d00680548eacc160c6c69b9

Download Submit
C:\Windows\SysWOW64\Agdcpkll.exe

Filesize
88KB

MD5
6b92bd5f36ec7b6e5afd3850f2d63590

SHA1
200b969eac846dde635e04b9fb14701360c870aa

SHA256
dd7a1b9ac05b15baf4692f91e42b1a17c271682ca718b13701bd74eabd64d222

SHA512
cb7334b5532a02967111889f1372d170030fa445a9f0bfcc57fd2b17c3f328d6ddb1638f875b4d81e77cd2a298da357b1aa3e180c43e73a8c8e805e4bc8e6c18

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
88KB

MD5
47c8cbc856459c0e0acc7f7c7170b3f1

SHA1
d6b92636174350e4471b7b49435ae3d84be26146

SHA256
7bffb0b02e95bdb1515bcf03fb74cab43a8946c94d59dc3dda32d795594d0e71

SHA512
fba5764f0aceee3ee483f3722d7c86bca8aad67a34ccaa50fb32543858dd193fad8bac8ef1994f0016e529f45ae3bbd8d446980234a018e162e15ae631290646

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
88KB

MD5
3251877d8d8c3b5cefe9142b044a1ef4

SHA1
d8f06524036e0d688d12b3642b19af1f0f0752bd

SHA256
0385b03cded9e93b1879b1402c78cf1d4649f79b7565f7711f54fa9da88cd1f8

SHA512
6a5a06fd6a2eaf96ced8c712babe3cc5e623dbbc9dbf563cef7f00c2f0e04f8d7199abc1d80af6c99561f529ccc545548d89a9c9a6f63ff39ce972950498a513

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
88KB

MD5
2d1532dbad442f3247ebf0c4a19c8624

SHA1
ead9b3905cfb6cce2f0e4857d9238167049870fb

SHA256
c07d798fa98e887fa9a341e58ce987f10b580e19a8d0c23bc701b0f618b9129a

SHA512
3866f3be1fb5c033fa67215c9a337eb54958cb904270269a2ef9335b909bb33ef026ca591c1e70231332bdc1b0bccdc4a0582f60900e5797d5bef971132f2a0b

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
88KB

MD5
fdf432a6e176c516885face75ec6bc07

SHA1
6a1a89f35ab4d67391553b293fe3532c5ed02fdf

SHA256
13d1b81b6c8e79ff21075f7ac107f9d2d9440a3825eb3cdfeeb323e12e9d2512

SHA512
56be5cde1d072fe040dc7c806195bd231debec31eecbff5a3e983ce903bd994ab0b0ff4e95e5dfe41c96a03c7dd327ca0ede430a63e6362eb3f1676667057a0c

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
88KB

MD5
7f2ddd464a1587bd119f3dea5e0fb506

SHA1
bb940969d4537513730e5bb695ce8ba5a033f0cb

SHA256
a56bfa5071b370007ec99b3568fdb8c7b456017a3c193376bd175acff897e64f

SHA512
e2ef1ca1d225984461891e956a00861d850b09f2c05c9a3c6d7f27df51a4af1dfa0fa530830898e5f315cc42aae66939de06418caebf7c3da12a7626b77fe769

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
88KB

MD5
373d6477ccdeb3708f642febe6883c77

SHA1
4c55f399e3988ce9a201f07b56cc6142634b4ad0

SHA256
cd330887217f565b88d7c22a8d14b06ad2135e79424e8412038704ea9bd5c048

SHA512
46321733c226bee1683f2fd4fecafd365007ad0d025cd5b48d9c5f56de3a5c5c25e95e1ac17b15b2dae67508ee78231ef70947973c0dff7420deb54c20c11d28

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
88KB

MD5
eea6fbdf39e195b0ab4af3c1b03f12ee

SHA1
4e36281c7fe5b47dff3aca32dc018432f98c01c8

SHA256
44c0fe73d2aeb1c40265178229b146f91548f8da7b5a433726b96bb8731a3c08

SHA512
3d9bff11a41f0aa0b1b502d0ee2c4711962bee3004a3d9c4a49a5536416cf85d767287ecce817b7105022f6ea41f4aa163eb3b524cbc7cbbc09e83c6c272fa78

Download Submit
C:\Windows\SysWOW64\Bhcjqinf.exe

Filesize
88KB

MD5
b9fad050f11b0c75311cb5d3117b93f9

SHA1
d071dc680d42f20bd6cb0a74c2af65f78aaf66ce

SHA256
69fffdbf1e6e7f831dc27bf1ed6693b536bbf64407b3c3f424cf2994d2f97211

SHA512
19f297c0326e82ccd10eef26643303dd283e1663910f9809c088118d731e605c73f362350a2e287523a9356791963caa7fa1adb4bb19dab9280eb1881318fdfc

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
88KB

MD5
0e352f6f2e6575df575d331ed88b7741

SHA1
0d5a00e93f13a70001ad78c3d5ab0abd00db625f

SHA256
7b52df218b034bc30e304f671853494f95ac5a3bd807fe7068bbd41b2b3d211b

SHA512
8b9a395f2f7e8f4bdc7df0cdaae0a4d838b53c36d602cc276fc54877ee722feb67dc657cebcad828a068e9eb58e20a01f674b7145aa7c289869ee9c4c28bfb2e

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
88KB

MD5
cbf97cafc861797526392c1759154f02

SHA1
f792caa37c0ef68a8cfa02a1d71f78c96d5fb66d

SHA256
f1d4b53f3d6819838925a3a7816cd8a683a92b26f702e7f1ddee04bb7f82842c

SHA512
b4c9961cc9397fbca3a96de29fb8d391c84d94842956fb641e72b9e891b89ed1be94662a8d524f46612542edd1b7aa91bece4540f660a0c6e674f6635ef4d6e9

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
88KB

MD5
bfcc2cced13e50048e35c5c192e5186a

SHA1
2a725021975021683177e1625c45785f02a40612

SHA256
210ed9b23b62203d64c7b4e738694e5b5b3b19c2cd7ede24652b1bc6a83f5988

SHA512
fc7fc1d9af96b847fc13a99e5085bf281c4351504f5cdcc2ce98c23e5fdbe6182504a972b5314aebd2623990eec510ed56d589e3c25215d7f31177e2494b8364

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
88KB

MD5
e8cfcb82fb47f70093f62ff7d97fec9d

SHA1
2bbb56fbb4c13b1902591ae6600a95e03d23b29a

SHA256
b5dda351d9828a79f2b170e263c8f350c39f1d21146c2260d6e5949dee5e1ff2

SHA512
2ac54d392e848b89107225fd754d52a6571daf4ced25a451584f40240f47a56991a4d40f96feacfa942ef85624f683dd9ea951b658989c6e5fe1583ea5518dfd

Download Submit
C:\Windows\SysWOW64\Ddligq32.exe

Filesize
88KB

MD5
fcd638950248f863f97a2e1fb1e9d828

SHA1
f227dfa54df6af84c1c67a700508d1ff3ccb164d

SHA256
bbd66b78d38e48652cb9566599d5c6fff01ca695ee19a914e1990011b22419a3

SHA512
083f5b541ee03d4a33efb9cc184b1ad6b5908587658bb8a564fcf4335e7ec8952c96ac716e2f8fa1ee0176a20a9850791d4074a96c41fa8842fcaf0fd2d5ae24

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
88KB

MD5
95861a9cda03e1580d63034da3d698de

SHA1
0902417fb25bb6437f41d7ae2909876897a38c92

SHA256
35f8db58e3bb675d6e8f7129b227af8ee260f0eca7ff83bb9cb37cfc5d89c863

SHA512
36f52e468b3b1ce952a707c1ea71dab2b482e9102c3492c22c8e84dbf98048b64cb39c8efab26a7355ea060b62e7b0170d6776f095cf6deb414469024852dfce

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
88KB

MD5
8beb2c89599b25116922091fa9702b9a

SHA1
138f1c317b1b56296077e4bd117762e9780e5aad

SHA256
447488192accc39e027f5a7f1269a330573b1a717f2d2da093cdf7dc7db7265e

SHA512
182f5b177d02250c19876bd6e9d9935563a506c08c4e39af8f85a963c364ceaaaf98fca7bf4f58be2a2cb45ec5ba06e893625bef5307cc4567052164f7de4b07

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
88KB

MD5
9641380468eb15d082f0ef6ec8193419

SHA1
d05bf08e29b5fdbbfd3c90a31e94baf2d20fd2f3

SHA256
c8079d3693ccd0b8ad60e80b86108af769ca64e0e903a05d5eeb21a5d877c4c5

SHA512
2c1112ebf9134c3a773d70d8d9d05fdaf78ccf05d5bd20ecee1924038ca615939d160ec70a547c118236d2751089742ce2278157769ce4f8b947a5c912a93a77

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
88KB

MD5
df092ca3d0b94675ad0e592b65398ead

SHA1
011d21c6ce48ca8e16821876fe027b78f2c3d245

SHA256
f064cad3b4e778e4fab06560d8c3c37f59b8dcc916c0d77bb6744161ce7b10f2

SHA512
0bab2f245825931ada9981401b606b7d75e89534450e88575cf3b1493e517469a48deb70346dc82f8b2c84fe28ca2484746e006b960ce4727e4b096c3938c9cd

Download Submit
C:\Windows\SysWOW64\Goljqnpd.exe

Filesize
88KB

MD5
fd77c4cfc53f183c921f62f70db270e4

SHA1
e54a5b34a715c8d153edd1df30f9fce960942423

SHA256
25161dc2ce3c989c69bb9bc01299f8eeb122cb7b7fc0f9a047d81e4434715db6

SHA512
e6ec7f373f33ed87d789f4f5e29804a7558f5904d2bde11aa108253ac70980e9142dbafa8db6a607c1f94532b5413dd5849333d88917cc3e1ef4ff44adcac50d

Download Submit
C:\Windows\SysWOW64\Haoimcgg.exe

Filesize
88KB

MD5
60a42f8adfa6f3fcd71fa3ee2bbc5408

SHA1
3311ae3a1debd165dae7d13d393f19486f1782a5

SHA256
36e414aaf88840fea5dc116f18785b40e4de5e99730ccb40899f9b842d1b75eb

SHA512
5dce68e0d990486d97c5007c83b11466950b2cbcf37119461b6ab1cc7ea09efcb0c6fa3ce44164ebc08cda6d1e2edaaf3ad18cacf48a34f9efaab1d172830466

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
88KB

MD5
f5c4225e0f53cedb3b42504ff51fcd34

SHA1
71775696f930dc322f4d78878af653616cf795be

SHA256
958f7e43aec66c255abb7515aa7485ea494353d0dc363ca4994e66b91541f332

SHA512
75539be0edc84d9856b22113c67f8a1ef965aaf9624d6e8b1756648793faaf48dc61a8b60fc7db8416e0c124fa2d4a547bfe74869759d6c96173460b0ca8cae5

Download Submit
C:\Windows\SysWOW64\Ikndgg32.exe

Filesize
88KB

MD5
9e98b16e6a39cd19891fd83c4c98b67d

SHA1
f8550d9872ccc822c2e45c5af91999d11bb2c59c

SHA256
29556f282a9eeed250b93ef48e4c26aa4555e1b37f643d8e8efc41d27ecc3168

SHA512
1290d3b4411057861f2867e4428b1194e32891deb615cd3399ac38d364a33928158ec19f02c07be8c21c70d32c33ff7500b69563d685f94dcbfe9d8fce95844a

Download Submit
C:\Windows\SysWOW64\Jbfheo32.exe

Filesize
88KB

MD5
63844d3aede19fc02a889956ac3c35f4

SHA1
4d601e77cc95cb1f4ca3331d323726b2f0acb002

SHA256
20e104a8cf70585f1a54cfde86b12a554c78bd078546ceb27c7f14ebb8638896

SHA512
9e1a2e96f02a5d8fe8de28599a7774102b53b8bcd244f385d5d2c56397cc86af3eee85bc429f19ba4373a799b8cce9c8aa3f44a3ca177fe8e718c98cb9330250

Download Submit
C:\Windows\SysWOW64\Kkfcndce.exe

Filesize
88KB

MD5
14e79f6ac89bd1b2330ef51a91dcaac2

SHA1
efe5a3055f20b0747be24eace0b9b68cd93c987d

SHA256
6d06e6daf62c794042fbb2d929908456f902d83f7ef35e06c96601c7fe60a107

SHA512
645b3b47a237b5ac45c019e37b1c80384f4b749f961b74df3cafb7e2454e4a7045f3fb7c3bff3e45fbe423b2a682d96fa78cdc7474e7f3eb7aa9b87be79d64d2

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
88KB

MD5
c1cc9c9c616a0891d152f9ce9210acfc

SHA1
f1b45160e27f5e83213c5538ac494897a3ef1afc

SHA256
d742af074aa76d72a9b6f14ec757723c617e3f36187b7ee23676ffd52b40fe86

SHA512
3db69458e5468ff6d2bd5a8f8ee7c56b9492f619c2b442c48827973398be4af2253ac1edbbe15e9906a4a4c5b29c6e1069647ea88996c6307231ee8b09250086

Download Submit
C:\Windows\SysWOW64\Mcpnhfhf.exe

Filesize
88KB

MD5
25bd147839e124982d6dceb45ca5eb72

SHA1
4af78cd9fe88bcf250368d8ad00d345055c1ee60

SHA256
cb127e9dcbfa6e9796fc6eaefc5ce6af2227489f07bc1f6ee7954635b419f89e

SHA512
9a0abe38c035008c735463ce2663f3d458b62ef209d71f2d8401afc8deffdbd020b92802faf6ee68353e756ba69e01b37bd8ff7461d255a46891739b3dcd78b7

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
88KB

MD5
8b95b398d9512cff9d48c5ead222d079

SHA1
2b9bbd9abd04b954208b8007f4f57c4a5eb00852

SHA256
806eadd149db0be7e8a71565501c4d911249f80690ab1b08c68d0e3c44b39050

SHA512
8c39232d10f9a7e2c9eba2a787ce9f348b9f81cd5e8ff03440c10c1a20c2483a902b04367a8657f96a18d102e89a03de89e7f0986b569875714b76996310a6cc

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
88KB

MD5
98b022870a34cea39f8aee724a5aef92

SHA1
f8a88d43c41aa2ea85dcb7b40d9ca8c4fdd5cbe9

SHA256
4f7955eb96f08523a352ddc6c68b2228aab408430085a9c1f0b53697c1b57db8

SHA512
53dcba9519286df137cdd71335f404eb84d2f6054f4633e1776013023aa63a17b92860c9066ee5525a009a4f5ee6810a9f68b276bd06318c2b2a7ff670c253b9

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
88KB

MD5
926b5e0df64173738272c32e66acc38f

SHA1
8b1c28aed08dc84a6887fbfe17fc9e58fa05a71c

SHA256
8923c494ae0ea0541a244f4f191b1830816d411122ee49d0cbaac483da747c94

SHA512
aa6d3f57ac50590826916bca424b8b5d256eab5469b7419c1760a5f53d7d165c1287d93529c5b946147d8937b48a88dd0cc146c6ebf298b5d9296a5129436b35

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
88KB

MD5
60472394c507cf3cc383cb238c3873c6

SHA1
e30f757e340c4724c4fe5014f9ddc6b041d4d651

SHA256
573996ff3c54eaf4dd333419ac8596ecddfeac56f387e8e602cd3850f5e1d4bb

SHA512
052e369d2608f7cdda1196a2d54f10f619605ed5196d4fab9f16cd86f08934184ac2860e54853866d77ef54389379b03e1472531d2249eb62fce56ce9d2fa922

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
88KB

MD5
39913677640f5f5b6143ab1d55ae5482

SHA1
5f10fa5d143a172a886bb31b66bad3e93d5ec3af

SHA256
4300e2f818262a19c166b6bdda6b505309652da5210b7bd85bf28f5dd2c611d3

SHA512
7c0738bc801256df954e93dee71feb3c864867a3e9c3b5f12b9284f9174afffc43d01ceee958d060cc70c67d0e615fe29dc53f76d4dcd83c87f18817aad20fb1

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
88KB

MD5
4547da89f1d2a5ee5c7799e423082bb8

SHA1
3535f34602a67b496d54c2bada83dad0b6edd676

SHA256
d820329da366b433962111bc24eb6b3222547d02c8c2e8108b2aefa0be8ca3f8

SHA512
e387670350cf2827b17f876b423fd45eed6b2814f0511722d8db60d1b44d72d6044bcef879d63db0f760e345661681976c35d222351c0f58d786064179994b17

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
88KB

MD5
c220049d2c0058f6c7c89b0996c8132b

SHA1
e9663cd40f93dc40630555628b5faa9eb7400e5f

SHA256
c4d5bd71c94f8c43b139fe2c12071fbf0e5760bb94b25a6be3e7ff17372949bd

SHA512
e138f8f18d3764c1fbc216508f76567149e7a2b3b4c43016c9a1cc7d952712c9455b0c8fa924b8840d0541dc414eaf7426fdc4332e768b43d7029f46f182ac65

Download Submit
C:\Windows\SysWOW64\Ncfmno32.exe

Filesize
88KB

MD5
2433540e550c0a63c98220e43d032ed0

SHA1
30bf64b6c49e9d2e2982ef6b8bf38a559369af3e

SHA256
31a1285a29cfb74c48bdf54b2e87b96f4a57a9d437261b03d649160a3759743b

SHA512
96e6c88cbc79565e742f4c9f79ad691dd636d9dc85004844995bd7e228a5535ffd59e55ba32847e5885ba45ecb7472ad4030760acd88a964ed241a100f61b252

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
88KB

MD5
76485d6bcd47529c5af947acedfcea57

SHA1
247e4062fec12835323e4a2f5a4df613b3795482

SHA256
fc5787d34a8e60759807480cc652c382e2d4c6f2fb44134c5e6779bf7bcfdb02

SHA512
385a1c75846591a7bc6476e8cca8abf31fddb9466c68f0521f843e934d9bd6712743e62aa64427255518353b6cee7172030d115d67b734cefb26b583bce01e43

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
88KB

MD5
96ce662832801385d82f08fc1ce29211

SHA1
eb70c5f45725d3d1983e55e5584279881cabf1ba

SHA256
f0e34759bd1ff31219f775b3a89c2035ac85491fef09885b92ba01a39b9e3bdb

SHA512
9ba0e99fc972a876d0cebb46f4512a8545f0d41233fcfd3f62b715af386697aa3cb48d4cbed0daabf4c3303bb65548d269df0280b4c27f1b953802ecbc77a6db

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
88KB

MD5
4494a93936329fa6cd94f6fd7107326f

SHA1
75e4df2097eccbc06a7248c123a0d9c6133e85d9

SHA256
7dc9f49462c87b13a0069fa09c76af6f933983203b1b58bc7c4399526436f3f3

SHA512
64bc388fc28d2c87d9c3af68a2675b9aa37b3729223247c862bf1f717f5bdf2bafdb1b71366ff2e4934748cfe473e1b451bf876376217e51771b5523d2ef4db1

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
88KB

MD5
5007eef66f0466cfe901f93a77926a6f

SHA1
cbe02483cb1870a87244d0ddf17673c7a241a4bf

SHA256
1834afb051bdb364c0ae333108c8db8ce28b69609a0e05f8b624ed647ddd88ab

SHA512
a8059b29203fe1b8f7f70221cc2d02882f41f613ab87d2ea71a160c5a4827c29e1cdc6208db806151db440c055410aecc3d83369d2019a575e90601e0eb3ec65

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
88KB

MD5
ab9f2e2147a82b47b5fc34df6c71edee

SHA1
cf2072f37a0bae27dc27cccfcb1022c33f9aecc7

SHA256
dadb8203079676bdf00f223d6c95607465b4a46a7681ab29cc32bca33ed860ed

SHA512
75925d82fb566df7cfbc320fd1edcd33933512d4d5e6bec2cf7ebe23d4682864e642ecc05aeba31cfedd82aea7782506b6fe3617932601889513817893236e12

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
88KB

MD5
1befcdc4dd0057d501554f85d0b9cf58

SHA1
de84cb123b376bc911f4efcfb25b76f8c1ba5fc0

SHA256
58e21a61fe5a812d9c9f26fca15618369ed4f408b6a45fb6757ecd594648b1d9

SHA512
17154d362a9cd8467b8b2b160afe6ae7689211686ac6c67e9dc1efd26e6f023f3f79e3b94891cb3c1cc87857b93431327cdb9f85f71f41c625a38edad6dc6608

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
88KB

MD5
461401bc83f4969e4ab3b23c664c0bf2

SHA1
9ac7d336d081f5e9d666bc5bb0bd12e598a2c610

SHA256
2298cd52da6a62f5a7415cd53ed2c1067d5a45bbc8392a3bb1693d8c4b95cecf

SHA512
b5d77f1e70c21f8cf1793e1c6a0164c5527ee1c9fbcebe8261627c32acce75287e9f259b7d08a6d7560721b62519dbee3d0d0d7a3a5d20813af3cae328518b29

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
88KB

MD5
9b76592fab5c30826dd6e82ecc7f5e62

SHA1
38e39a7c8be1d7cd7364eb136135787fc4b1ddf7

SHA256
337d21760e43d20aa4af039ff9097dfc098c3b8cfda70fbb27cc7e1cbd02594e

SHA512
1df535a01e423fd464a3f50492d36797a3c34daaf4ba418e56e6d93476ac1e61c009b3e4ff4e4ff78452d29c1bf19f14214ba751ae2ec80a4d53cb4a9ef62f82

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
88KB

MD5
33f54158a61db2bd8768efdf9b05b57a

SHA1
d36e75abc796fa0c83e687ee3afb57336585170b

SHA256
ef6ca06cebe4630ffd179f69824080a207fadfda05c668e8faa989049b57261d

SHA512
8cf142a50b34c48df55792a044d796b30e4ce2cbb7b8576cbf12a79bbdcef53d13a8713f881bb555d4b9d174f3ccdae37c13312a729e45aa88e884fb7f8bd545

Download Submit
C:\Windows\SysWOW64\Oidhlb32.exe

Filesize
88KB

MD5
4d5af02f8746078f2aa8a9fa437aac4e

SHA1
f4829becc6bbe3b6529f56ecef49fa5388efa644

SHA256
3272f0161e8d837725a54ac8ddad07c1bb40aeb50b091bef8143818046da0025

SHA512
1fc239f72b3852d978e57dbd924459215182a8e3265660a9f779a1bf1ba343000d28b8c09c48490647bf1699dec4901996b372bf654190c2debde08e9956604d

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
88KB

MD5
6e421595c248266aa70953f4f360e521

SHA1
acf336be6c3021311730bfb61b76689de9e85fb9

SHA256
fa30293b6b11a5c61ac0d324d45043beb11c91e3e5166b05bd2d1715161e0f93

SHA512
1edc5c6abe2be46bb5fc9ad43a14270095b748ec8bca23cf3f9f994794addf3463a7a9df8f5974959872dd75c86ea76dc14b7ecde7773f3b3f3646ca960235b1

Download Submit
C:\Windows\SysWOW64\Pgihfj32.exe

Filesize
88KB

MD5
b0e5685434999800d757c7ed81be2226

SHA1
71b24897a135fd1f0a1f7ed1c3ab26aa93fb7127

SHA256
134972911be2d305bf06180ad239113add8c5c858e150850716cbe62d8eaa262

SHA512
167ca9ba7ab301d52049c2ed55088715d6fc4f0c7b8718832a7177a7da8bdf4592c6b169f7035c0061cfe72dacac22e06d8c7e0bb97bd5b9d151037567fa8b10

Download Submit
C:\Windows\SysWOW64\Phigif32.exe

Filesize
88KB

MD5
81611fb02ecdca1e8657684e1735ff1e

SHA1
df1b8cee5d04abeeb6e39e2c0944266efd9f0d89

SHA256
b6b1488d882fd2c82b6e7309102ad5ca1351fb6522c226fc7caf262f4f6a8801

SHA512
936cfeb0c337be389948b3913a6de8dd2a740ee29afecfd25c4e3d2aa138368f2b261428a88bad7af195a811e95d1d1ea556f57355bdd21b479dd2c3957c3325

Download Submit
C:\Windows\SysWOW64\Pibdmp32.exe

Filesize
88KB

MD5
31f898b639044eb55cc7b8884a257efe

SHA1
935968208f33df82c39897d515fa78561a3cd5bf

SHA256
262c3ab12d776db03355549c8686b1f2919b32dcdc6baa2308d5bf2af89bcad5

SHA512
77551bc7dff244c33ed300fb2a84d830d3321440867e3cddaf4871d3a440a15877cd2d62b266f015197c5bad90c46683fb56dcf59d620c3295a6bf78471dbef0

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
88KB

MD5
05aa2893c0197867d0daa689162285a6

SHA1
ec7a1ee436602754646897dabb2186f79b96d69f

SHA256
3bd967ce9725dd0146637cc0034a581267ac1492c77a444d00023039a2e24de8

SHA512
e0d998fcfefaa97d9795f793e7d4a70e7646df2e3ce03f385c4fa3975072a0db3435ab63013658f1cc8b1cf31ad2f612fbe3a4fe996709713210af0d52307e35

Download Submit
C:\Windows\SysWOW64\Qhonib32.exe

Filesize
88KB

MD5
d567e79ab66dd580f2f88b35f2f53918

SHA1
85ebe47f41490a65d3e2f429424b7f73a2eed9f2

SHA256
eae36a365eb405164d53f87b293ef16ea3fccd9c2715c82d5f447efaf0087658

SHA512
8f491ee5e8c992e5653b2cb5bd510de4df4e4b60cdcde6d5c26ab3c9a0bfe9c34c41240f7fb28c0cd95bf77fe96f60c5c8a17bad36be90437779e11686032506

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
88KB

MD5
26e5fe726a9e0fb5584725db5f6113a8

SHA1
e56a9f0d05dc0d7ba7a34694b9ad5d657f0f0009

SHA256
1a991349fd7bc43cf8ba2eece093c8d1c6da872fda3de8b862176da46f6460a9

SHA512
7847bf498b4e79f25d6abc65eaa8cbea17dff1c0afa45f29f45d3b8dcf49571d26704d09c0bd2ce006afc456732c46dc96860cba3860d121ab001b8ae3a337c0

Download Submit
memory/404-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/720-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/732-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/740-272-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/744-164-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/756-119-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/840-91-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1048-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1156-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1160-103-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1680-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1756-156-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2068-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2152-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2216-247-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2236-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2372-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2508-274-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-404-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-207-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-148-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3148-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3260-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3676-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3716-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3768-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3972-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4052-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4088-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4120-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4168-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4184-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4208-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4248-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4304-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-68-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4340-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4352-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4376-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4444-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4452-231-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4788-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5040-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5064-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5136-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5176-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5216-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5256-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5296-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5336-447-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads