a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe
Size

285KB
MD5

47a1a76d334165d53eed9a8fb9d1e8a3
SHA1

00964e0f950c26dba95e7cec3507eddfd4de7c84
SHA256

a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b
SHA512

d9abf8bddf140a452e449f3a6f1a2e49c9ab7dd9a8d93ae170e4f39e5680d670d3b67171ebee3527e3d5b43ffd619ae938e0d377343e4f35ab74bc402ce61a43
SSDEEP

3072:6IF7FY6XE5ziY/qUWMWu0ge9KVcbMloVRr3uMg0kAqSxYiJ2QM4GKch:3JLaDTi79KQIoi7tWa

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inebjihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkohaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbbokdlk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlqqcnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bckkca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coohhlpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcapicdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kflide32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohgdhfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpdhboj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpmpnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcjjhdjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hgdejd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gijmad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oogpjbbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fooclapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Obqanjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdgfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Peieba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnibokbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qoifflkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdlqqcnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmhmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kegpifod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maggnali.exe

Executes dropped EXE 64 IoCs

pid	Process
3056	Dlncan32.exe
3264	Eaklidoi.exe
1156	Elppfmoo.exe
4372	Ecmeig32.exe
3164	Eleiam32.exe
4496	Ehljfnpn.exe
1556	Ehnglm32.exe
4400	Fafkecel.exe
2096	Fcfhof32.exe
4512	Ffgqqaip.exe
4328	Fbnafb32.exe
1676	Fhgjblfq.exe
4260	Ffkjlp32.exe
3936	Gfngap32.exe
4276	Gkkojgao.exe
1732	Gkmlofol.exe
2780	Gfbploob.exe
5108	Gokdeeec.exe
2012	Gbiaapdf.exe
996	Gomakdcp.exe
4092	Gfgjgo32.exe
2428	Hmabdibj.exe
4256	Hmcojh32.exe
3096	Hcpclbfa.exe
2008	Himldi32.exe
4888	Hcbpab32.exe
1200	Hecmijim.exe
3928	Hcdmga32.exe
4288	Iefioj32.exe
1536	Ipknlb32.exe
4340	Ibjjhn32.exe
3256	Imoneg32.exe
2804	Icifbang.exe
3664	Ilghlc32.exe
4744	Ifllil32.exe
4244	Jioaqfcc.exe
4876	Jcefno32.exe
3888	Jmmjgejj.exe
5112	Jidklf32.exe
1636	Jpnchp32.exe
1620	Jeklag32.exe
1288	Jlednamo.exe
4308	Kboljk32.exe
1072	Kmdqgd32.exe
3292	Kepelfam.exe
1140	Klimip32.exe
2064	Kbceejpf.exe
1000	Kmijbcpl.exe
4668	Kbfbkj32.exe
1840	Kipkhdeq.exe
3468	Kdeoemeg.exe
2920	Klqcioba.exe
316	Lbjlfi32.exe
780	Liddbc32.exe
3640	Llcpoo32.exe
1592	Lfhdlh32.exe
4304	Ligqhc32.exe
2504	Lmbmibhb.exe
404	Lfkaag32.exe
1240	Llgjjnlj.exe
4172	Lbabgh32.exe
396	Lmgfda32.exe
532	Lingibiq.exe
764	Mipcob32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cmmdfp32.dll	Dkekjdck.exe
File opened for modification	C:\Windows\SysWOW64\Ebfign32.exe	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Knnele32.dll	Kiikpnmj.exe
File created	C:\Windows\SysWOW64\Fnebjidl.dll	Lohqnd32.exe
File created	C:\Windows\SysWOW64\Fpnkah32.dll	Nfnamjhk.exe
File created	C:\Windows\SysWOW64\Aiffheej.dll	Bkobmnka.exe
File opened for modification	C:\Windows\SysWOW64\Dbnmke32.exe	Dooaoj32.exe
File created	C:\Windows\SysWOW64\Bfcjjj32.dll	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Foapaa32.exe	Fbmohmoh.exe
File created	C:\Windows\SysWOW64\Aadafn32.dll	Nofefp32.exe
File created	C:\Windows\SysWOW64\Cldcmlpl.dll	Ekbihd32.exe
File created	C:\Windows\SysWOW64\Madccamk.dll	Hnfamjqg.exe
File created	C:\Windows\SysWOW64\Dmpfbk32.exe	Cffmfadl.exe
File created	C:\Windows\SysWOW64\Lkhpjc32.dll	Cocacl32.exe
File created	C:\Windows\SysWOW64\Nmdgikhi.exe	Nnafno32.exe
File created	C:\Windows\SysWOW64\Dhbbhk32.dll	Klimip32.exe
File created	C:\Windows\SysWOW64\Keonap32.exe	Kbpbed32.exe
File created	C:\Windows\SysWOW64\Kcdgbkil.dll	Lfkaag32.exe
File opened for modification	C:\Windows\SysWOW64\Pcobaedj.exe	Peieba32.exe
File created	C:\Windows\SysWOW64\Fhgcme32.dll	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Aogbfi32.exe	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Aokkahlo.exe	Ahaceo32.exe
File opened for modification	C:\Windows\SysWOW64\Lcfidb32.exe	Lpgmhg32.exe
File created	C:\Windows\SysWOW64\Hcbpab32.exe	Himldi32.exe
File opened for modification	C:\Windows\SysWOW64\Jeklag32.exe	Jpnchp32.exe
File created	C:\Windows\SysWOW64\Jngjch32.exe	Jkhngl32.exe
File opened for modification	C:\Windows\SysWOW64\Khmknk32.exe	Keonap32.exe
File opened for modification	C:\Windows\SysWOW64\Maggnali.exe	Mkjnfkma.exe
File created	C:\Windows\SysWOW64\Aogbfi32.exe	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Gbpedjnb.exe	Ggkqgaol.exe
File opened for modification	C:\Windows\SysWOW64\Ibegfglj.exe	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Klimip32.exe	Kepelfam.exe
File created	C:\Windows\SysWOW64\Jjhijoaa.dll	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Naagioah.dll	Nckkfp32.exe
File created	C:\Windows\SysWOW64\Ckkpjkai.dll	Nmipdk32.exe
File opened for modification	C:\Windows\SysWOW64\Nciopppp.exe	Mlofcf32.exe
File created	C:\Windows\SysWOW64\Qoifflkg.exe	Qljjjqlc.exe
File created	C:\Windows\SysWOW64\Nhfjcpfb.dll	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Elgaeolp.exe	Efjimhnh.exe
File created	C:\Windows\SysWOW64\Dejncidp.dll	Dmennnni.exe
File opened for modification	C:\Windows\SysWOW64\Ekkkoj32.exe	Eiloco32.exe
File opened for modification	C:\Windows\SysWOW64\Ogjdmbil.exe	Onocomdo.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jihbip32.exe
File created	C:\Windows\SysWOW64\Hcdmga32.exe	Hecmijim.exe
File created	C:\Windows\SysWOW64\Oipoad32.dll	Biadeoce.exe
File created	C:\Windows\SysWOW64\Djjebh32.exe	Dpdaepai.exe
File created	C:\Windows\SysWOW64\Ikfhji32.dll	Fpggamqc.exe
File opened for modification	C:\Windows\SysWOW64\Iibccgep.exe	Iefgbh32.exe
File opened for modification	C:\Windows\SysWOW64\Jiiicf32.exe	Jcoaglhk.exe
File created	C:\Windows\SysWOW64\Okehmlqi.dll	Mmpmnl32.exe
File opened for modification	C:\Windows\SysWOW64\Amqhbe32.exe	Adhdjpjf.exe
File opened for modification	C:\Windows\SysWOW64\Gahjgj32.exe	Gojnko32.exe
File created	C:\Windows\SysWOW64\Idmdhm32.dll	Lbjelc32.exe
File created	C:\Windows\SysWOW64\Llnnmhfe.exe	Laiipofp.exe
File created	C:\Windows\SysWOW64\Gdaociml.exe	Gikkfqmf.exe
File opened for modification	C:\Windows\SysWOW64\Gpgind32.exe	Gmimai32.exe
File opened for modification	C:\Windows\SysWOW64\Iialhaad.exe	Iajdgcab.exe
File created	C:\Windows\SysWOW64\Jeqbpb32.exe	Jngjch32.exe
File opened for modification	C:\Windows\SysWOW64\Cpbbch32.exe	Bjfjka32.exe
File opened for modification	C:\Windows\SysWOW64\Glhimp32.exe	Gijmad32.exe
File created	C:\Windows\SysWOW64\Gbqcnc32.dll	Gncchb32.exe
File opened for modification	C:\Windows\SysWOW64\Gikdkj32.exe	Gflhoo32.exe
File created	C:\Windows\SysWOW64\Bepmoh32.exe	Akglloai.exe
File created	C:\Windows\SysWOW64\Abdkep32.dll	Ebgpad32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7484	7752	WerFault.exe	929

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hpioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ilnlom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iamfph32.dll"	Cmipblaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neogjl32.dll"	Jgkdbacp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njljch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofcmimpk.dll"	Elgaeolp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fpggamqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cglgjeci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Peieba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdbplg32.dll"	Fbjena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhccdhqf.dll"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmabofh.dll"	Knalji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ffceip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kcbfcigf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fqbliicp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcjhi32.dll"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnicid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hilpobpd.dll"	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Edbiniff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jldbpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khkaedic.dll"	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljfhqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ilnlom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmhkafda.dll"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjaonjaj.dll"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fijkdmhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ccchof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbgkei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ienekbld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Glipgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbbokdlk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjfjka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmpdfl32.dll"	Cglgjeci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhjmpfcl.dll"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcllpfj.dll"	Jgonlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jiokfpph.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobmce32.dll"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkgppbgc.dll"	Lljdai32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3056	5036	a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe	87
PID 5036 wrote to memory of 3056	5036	a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe	87
PID 5036 wrote to memory of 3056	5036	a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe	87
PID 3056 wrote to memory of 3264	3056	Dlncan32.exe	88
PID 3056 wrote to memory of 3264	3056	Dlncan32.exe	88
PID 3056 wrote to memory of 3264	3056	Dlncan32.exe	88
PID 3264 wrote to memory of 1156	3264	Eaklidoi.exe	89
PID 3264 wrote to memory of 1156	3264	Eaklidoi.exe	89
PID 3264 wrote to memory of 1156	3264	Eaklidoi.exe	89
PID 1156 wrote to memory of 4372	1156	Elppfmoo.exe	90
PID 1156 wrote to memory of 4372	1156	Elppfmoo.exe	90
PID 1156 wrote to memory of 4372	1156	Elppfmoo.exe	90
PID 4372 wrote to memory of 3164	4372	Ecmeig32.exe	91
PID 4372 wrote to memory of 3164	4372	Ecmeig32.exe	91
PID 4372 wrote to memory of 3164	4372	Ecmeig32.exe	91
PID 3164 wrote to memory of 4496	3164	Eleiam32.exe	92
PID 3164 wrote to memory of 4496	3164	Eleiam32.exe	92
PID 3164 wrote to memory of 4496	3164	Eleiam32.exe	92
PID 4496 wrote to memory of 1556	4496	Ehljfnpn.exe	94
PID 4496 wrote to memory of 1556	4496	Ehljfnpn.exe	94
PID 4496 wrote to memory of 1556	4496	Ehljfnpn.exe	94
PID 1556 wrote to memory of 4400	1556	Ehnglm32.exe	95
PID 1556 wrote to memory of 4400	1556	Ehnglm32.exe	95
PID 1556 wrote to memory of 4400	1556	Ehnglm32.exe	95
PID 4400 wrote to memory of 2096	4400	Fafkecel.exe	96
PID 4400 wrote to memory of 2096	4400	Fafkecel.exe	96
PID 4400 wrote to memory of 2096	4400	Fafkecel.exe	96
PID 2096 wrote to memory of 4512	2096	Fcfhof32.exe	97
PID 2096 wrote to memory of 4512	2096	Fcfhof32.exe	97
PID 2096 wrote to memory of 4512	2096	Fcfhof32.exe	97
PID 4512 wrote to memory of 4328	4512	Ffgqqaip.exe	98
PID 4512 wrote to memory of 4328	4512	Ffgqqaip.exe	98
PID 4512 wrote to memory of 4328	4512	Ffgqqaip.exe	98
PID 4328 wrote to memory of 1676	4328	Fbnafb32.exe	99
PID 4328 wrote to memory of 1676	4328	Fbnafb32.exe	99
PID 4328 wrote to memory of 1676	4328	Fbnafb32.exe	99
PID 1676 wrote to memory of 4260	1676	Fhgjblfq.exe	100
PID 1676 wrote to memory of 4260	1676	Fhgjblfq.exe	100
PID 1676 wrote to memory of 4260	1676	Fhgjblfq.exe	100
PID 4260 wrote to memory of 3936	4260	Ffkjlp32.exe	101
PID 4260 wrote to memory of 3936	4260	Ffkjlp32.exe	101
PID 4260 wrote to memory of 3936	4260	Ffkjlp32.exe	101
PID 3936 wrote to memory of 4276	3936	Gfngap32.exe	102
PID 3936 wrote to memory of 4276	3936	Gfngap32.exe	102
PID 3936 wrote to memory of 4276	3936	Gfngap32.exe	102
PID 4276 wrote to memory of 1732	4276	Gkkojgao.exe	103
PID 4276 wrote to memory of 1732	4276	Gkkojgao.exe	103
PID 4276 wrote to memory of 1732	4276	Gkkojgao.exe	103
PID 1732 wrote to memory of 2780	1732	Gkmlofol.exe	104
PID 1732 wrote to memory of 2780	1732	Gkmlofol.exe	104
PID 1732 wrote to memory of 2780	1732	Gkmlofol.exe	104
PID 2780 wrote to memory of 5108	2780	Gfbploob.exe	105
PID 2780 wrote to memory of 5108	2780	Gfbploob.exe	105
PID 2780 wrote to memory of 5108	2780	Gfbploob.exe	105
PID 5108 wrote to memory of 2012	5108	Gokdeeec.exe	106
PID 5108 wrote to memory of 2012	5108	Gokdeeec.exe	106
PID 5108 wrote to memory of 2012	5108	Gokdeeec.exe	106
PID 2012 wrote to memory of 996	2012	Gbiaapdf.exe	107
PID 2012 wrote to memory of 996	2012	Gbiaapdf.exe	107
PID 2012 wrote to memory of 996	2012	Gbiaapdf.exe	107
PID 996 wrote to memory of 4092	996	Gomakdcp.exe	108
PID 996 wrote to memory of 4092	996	Gomakdcp.exe	108
PID 996 wrote to memory of 4092	996	Gomakdcp.exe	108
PID 4092 wrote to memory of 2428	4092	Gfgjgo32.exe	109

C:\Users\Admin\AppData\Local\Temp\a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe
"C:\Users\Admin\AppData\Local\Temp\a07b0c1ea996e4317d83e303892b4e83a71c968a89f857646319b7270e681b3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\Dlncan32.exe
  C:\Windows\system32\Dlncan32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\Eaklidoi.exe
    C:\Windows\system32\Eaklidoi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\SysWOW64\Elppfmoo.exe
      C:\Windows\system32\Elppfmoo.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4372
      - C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        23⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        24⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        25⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2008
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        27⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1200
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        29⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        30⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        31⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        32⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        33⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        34⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        35⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        36⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        37⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        38⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        39⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        40⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        42⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        43⤵
        Executes dropped EXE
        
        PID:1288
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        44⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        45⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3292
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        48⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        49⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        52⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        53⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        54⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        55⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        56⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        57⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        59⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        61⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        63⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        64⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        65⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        66⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3672
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        68⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        69⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        70⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        71⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        72⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        73⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4584
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        75⤵
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3992
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        77⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        78⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        79⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        80⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        81⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        83⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        84⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        85⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        86⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        87⤵
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        88⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        90⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5328
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        92⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        93⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        95⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        96⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        97⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        98⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        99⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        100⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        101⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        102⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        103⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        104⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        105⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        106⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        107⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        108⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        110⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        111⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        112⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        113⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        114⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        115⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        116⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        117⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        118⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        119⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        121⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        123⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        124⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        125⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        126⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        127⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        128⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        129⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        130⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        131⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        132⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        133⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        134⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        135⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        136⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        137⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        140⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        141⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        142⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        143⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        144⤵
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        145⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        146⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        147⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        148⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        149⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        150⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        151⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        154⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        155⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        157⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        158⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        159⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        160⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        161⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        162⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        163⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        165⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        166⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        167⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        168⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        169⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        170⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        171⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        172⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        173⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        174⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        175⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        176⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        177⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        178⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        179⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        180⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        181⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        182⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        183⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        184⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        185⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        186⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        187⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        188⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        189⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4748
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        191⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        192⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        193⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        194⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        195⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        196⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        197⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        198⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        199⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        200⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        201⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        202⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        203⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3220
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        206⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        207⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        208⤵
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        209⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        210⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        211⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        212⤵
        Modifies registry class
        
        PID:2768
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        213⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        214⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        215⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        216⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        217⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        218⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        219⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        220⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        221⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        222⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        223⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        224⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        225⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        226⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        227⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        229⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        230⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        231⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        232⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        233⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        234⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        235⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        236⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        237⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        238⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        239⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        240⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        241⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        242⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        243⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        244⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        246⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        247⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        249⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        250⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        251⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        252⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        253⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        254⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        255⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        256⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        258⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        259⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        261⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        262⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        263⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        264⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        265⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        266⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        267⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        268⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        269⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        270⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        271⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        272⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        273⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        274⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        275⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        276⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        277⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        278⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        279⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        280⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        281⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        282⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        283⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        284⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        285⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        286⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        287⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        288⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        289⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        290⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        292⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        293⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        294⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        295⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        296⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        297⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        298⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        299⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8544
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        301⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        302⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        303⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        304⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        305⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        306⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        307⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        308⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        309⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        310⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        311⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        312⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        313⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        314⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        315⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        316⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        317⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        318⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        319⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        321⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        322⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        323⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        324⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        325⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        326⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        327⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        328⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        329⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        330⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        331⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        332⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        333⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        334⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        335⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        336⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        337⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        338⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        339⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        340⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        341⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        342⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        343⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        344⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        345⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        346⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        347⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        348⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        349⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        350⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        351⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        352⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        353⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        354⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1836
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        356⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        357⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4448
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        360⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        361⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        362⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        363⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        364⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        365⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        366⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        367⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        368⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        369⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        370⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        371⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        372⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        373⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        374⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        375⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        376⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        377⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        378⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        379⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        380⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        381⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        382⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        383⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        384⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1624
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        387⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        388⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        389⤵
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        390⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        391⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        392⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        393⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        394⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        395⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        396⤵
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        397⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        398⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        399⤵
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        400⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        401⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        402⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        403⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        404⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        405⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        406⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1792
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        408⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        410⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        411⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        412⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        413⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        414⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        415⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:936
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        417⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        418⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        419⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        420⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        421⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        422⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        423⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        424⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        425⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        426⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        427⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        428⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        429⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        430⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        431⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        432⤵
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        433⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        434⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        435⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        436⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        437⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        438⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        439⤵
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        440⤵
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        441⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        442⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        443⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        445⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        446⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        447⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        448⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        449⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        450⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        451⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        452⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        453⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        454⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        455⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9712
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        457⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        458⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        459⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        460⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        461⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        462⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        463⤵
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        464⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        465⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        466⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        467⤵
        Modifies registry class
        
        PID:10236
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        468⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        469⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        470⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        471⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        472⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        473⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        474⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        475⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        476⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        477⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        478⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        479⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        480⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        481⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9980
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        483⤵
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        484⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        485⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        486⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        487⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        488⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        489⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        490⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        491⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        492⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        493⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        494⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        495⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        496⤵
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        497⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        498⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        499⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        500⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        501⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        502⤵
        Drops file in System32 directory
        
        PID:9404
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        503⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        504⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        505⤵
        Modifies registry class
        
        PID:9600
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        506⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        507⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        508⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        509⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        510⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        511⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        512⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        513⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        514⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        515⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9488
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        517⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        518⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        519⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        520⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        521⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        523⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5880
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        525⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        527⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        528⤵
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        529⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        530⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        531⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        532⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        533⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        534⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        535⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        536⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        537⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        538⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        540⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        541⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        542⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        543⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        544⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        545⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        546⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        547⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        548⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        549⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        550⤵
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        551⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        552⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        553⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        554⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9324
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        556⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        557⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        558⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        559⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        560⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        561⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        562⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        563⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        564⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        565⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        566⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        567⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        568⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        569⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        570⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        571⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        573⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        574⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        575⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        576⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        577⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        578⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        579⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        580⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        581⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        582⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        583⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        584⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        585⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        586⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        587⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        588⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        589⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        590⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        591⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10532
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        593⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        594⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        595⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        596⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        597⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10808
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        599⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        600⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        601⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10976
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        602⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        603⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        604⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        605⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        606⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11212
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        607⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        608⤵
        Drops file in System32 directory
        
        PID:10284
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        609⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        610⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        611⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        612⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        613⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        614⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        615⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        616⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        617⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        618⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        619⤵
        Modifies registry class
        
        PID:10972
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        620⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        621⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        622⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11152
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        623⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        624⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        625⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        626⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        627⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        628⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        629⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        630⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        631⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        632⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        633⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        634⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        635⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        636⤵
        Modifies registry class
        
        PID:10832
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        637⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        638⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        639⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        640⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        641⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        642⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        643⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10324
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        644⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        645⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        646⤵
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        647⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        648⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        649⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        650⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        651⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        652⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        653⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        654⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        655⤵
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        656⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        657⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        658⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        659⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        660⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        661⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        662⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        663⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        664⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        665⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        666⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        667⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        668⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        669⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        670⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        671⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        672⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4080
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        673⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        674⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        675⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        676⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        677⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        678⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        679⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        680⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        681⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        682⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        683⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        684⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        685⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        686⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        687⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        688⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10468
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        689⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        690⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        691⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        692⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        693⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        694⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        695⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        696⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        697⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        698⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        699⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11312
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        701⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11352
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        702⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        703⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        704⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        705⤵
        Modifies registry class
        
        PID:11544
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        706⤵
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        707⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        708⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        709⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        710⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        711⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        712⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        713⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        714⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        715⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        716⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        717⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        718⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        719⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12220
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        720⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        721⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        722⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        723⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        724⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        725⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        726⤵
        Drops file in System32 directory
        
        PID:11528
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        727⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        728⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        729⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        730⤵
        Modifies registry class
        
        PID:11792
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        731⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        732⤵
        Drops file in System32 directory
        
        PID:11920
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        733⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        734⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        735⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        736⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        737⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        738⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        739⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        740⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        741⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        742⤵
        Modifies registry class
        
        PID:11572
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        743⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        744⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        745⤵
        Drops file in System32 directory
        
        PID:11892
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        746⤵
        Modifies registry class
        
        PID:11964
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        747⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        748⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        749⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        750⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        751⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11388
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        752⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        753⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        754⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        755⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        756⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        757⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        758⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        759⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        760⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        761⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        762⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        763⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        764⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11772
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        765⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        766⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        767⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        768⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7816
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        769⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        770⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        771⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        772⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        773⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        774⤵
        Modifies registry class
        
        PID:12296
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        775⤵
        Drops file in System32 directory
        
        PID:12344
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        776⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        777⤵
        Drops file in System32 directory
        
        PID:12428
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        778⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        779⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        780⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        781⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        782⤵
        Modifies registry class
        
        PID:12836
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        783⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        784⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        785⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        786⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        787⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        788⤵
        Drops file in System32 directory
        
        PID:13104
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        789⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        790⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        791⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        792⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        793⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        794⤵
        Drops file in System32 directory
        
        PID:12328
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        795⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        796⤵
        Modifies registry class
        
        PID:12468
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        797⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        798⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        799⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        800⤵
        Drops file in System32 directory
        
        PID:12672
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        801⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        802⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        803⤵
        Drops file in System32 directory
        
        PID:12792
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        804⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        805⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        806⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        807⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        808⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        809⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        810⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        811⤵
        Modifies registry class
        
        PID:13292
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        812⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        813⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        814⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        815⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        816⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        817⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        818⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12776
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        819⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        820⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12896
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        821⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13000
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        822⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        823⤵
        Modifies registry class
        
        PID:13216
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        824⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        825⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        826⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        827⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        828⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        829⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        830⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        831⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        832⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        833⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12316
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        834⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        835⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 424
        836⤵
        Program crash
        
        PID:7484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7752 -ip 7752
1⤵
PID:12732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bcahmb32.exe

Filesize
285KB

MD5
93af41cee087a2a4285eaa818950ed12

SHA1
d6ee233a6185bc8dee8f64326d8e4eccbc5e1468

SHA256
eefa17ade68e0c1430ba3e36e977b5d7a220c6e23951320a9675c4a0f3b2fdef

SHA512
18427622ebb4e645938557e53f8ac0b254daba335646510329ebddcbf05e0481e9eeeee4b4efb98eae944df0e5a2f5f49450c7fd5625c8171c2cb7b9cc49eca8

Download Submit
C:\Windows\SysWOW64\Bjfjka32.exe

Filesize
285KB

MD5
0a5e2f63ed095145364729982b7a7498

SHA1
e5849b610e38e3ee8a2d1a83314a3cf934f5905a

SHA256
f087ca438e3eebddcb30a65bb7f091850e1b5e2c5a9a4b362f0a221e5124f563

SHA512
50ebaee7d3bf008e04ab14cf0b72df53e01443211bf7ecfc2d607099f0ec92d77a8646deede5d7991f653cc7082206aa445195bc052ad0ff64869145f31c55c8

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
285KB

MD5
9905382e0bcb864dd3fac1621dfa662e

SHA1
593b558e38f122a67af573467cd45414f66e5e06

SHA256
812de41e3b84afb48a73f55ab8bf6a06910d0b03ef20f5776a152cde12e3832e

SHA512
f37c33174f7662bdb473ff7700e3887b37191a09a6e3b7a8735b27cd25bb1554d2ca2840bdc763dfa7283f1c6a6a5b6cecaa3e6b4d0afe11cf7550e7d62c6b40

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
285KB

MD5
95098a9d4a0acfd51cbf69b818229c95

SHA1
ee70a48d1c6a3b4cb7d44447e8948582a1cc5548

SHA256
e2b50a73cc2fee7d8cfd32320bb9f44a356c1c1e7037ffbd7d2542287711bfc4

SHA512
eaa9f0f2265991702449958121685939f885e761f69a15f46bc4824cbb18f7ecd73a6e860b904a5764181284999a8980d603945d0652f1d9b07ed90954a68558

Download Submit
C:\Windows\SysWOW64\Dlncan32.exe

Filesize
285KB

MD5
b1eb7f3ff0fe2c03c4a72bf2da64f916

SHA1
4aafb35896307c7b51c5542bb1ba6ffc452e1f4e

SHA256
98003b1b8abf03f0948df4311d5ddc0882b4b046aabf9793df7f054b7c6f013f

SHA512
4efe46e4d961442c499ce72f7c8bfc1d9b452db2b96d8df278284fa7db8e2f8700611bba08d3db2ca86835ad9fffbd0d922f225f784df23b39aaae568872c2b4

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
285KB

MD5
0d0ef1824a4e3ffba1f35913884b0a54

SHA1
2304d1db2996572c5cac151e3bbac3304c2045f5

SHA256
9cace6cc397b8de90ad35b6d295d94a5da0d320db7b1a49e14133d79a45e8116

SHA512
2a8bfe20c1e6e456b36cd82fd523bc63084f9ba7d47d7c2b44ffb5f4ba27efc7b5ec535206de63a9e388aeb3187bd30a90172e1577ae86041e472d601d03485c

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
285KB

MD5
dc93883e26c81a1723d7ba61b365603d

SHA1
6922e8d35de6d339321d5f69f75b5f2c8424ab04

SHA256
45bdf085fdb9aff63bba7ad7f250c3ed2360bd87326c8a23d12f342245362384

SHA512
841dcbe7153d7a8f1e4561453cdca59fe3f63b3d6cb08d50081bc98ea9ca93339e179ae2dacecd15c368a9af417fbb491fd6648d54ffc73cc31b80460431a497

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
285KB

MD5
69770c409b9ba6a7fd040f78730f63af

SHA1
682fd962c5a76f694e5a750b607616e97940b965

SHA256
3494e6e9891c26a7ed9259e206931da2ee1711a203145d5e184a66e66f32c837

SHA512
a4d92adae82e481809d4ece954c4cce4b887c70433588671517aa24152aa3ba6892a97acdaaa664b85656a088adfa0904136b48d375a8b63968f2f4044b91fce

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
285KB

MD5
e189c5d5fbdfa4bdda4355de18c4295d

SHA1
987fdf28f6a21df4259aa277d8ad2f3badcf067b

SHA256
7b0a1ae8e7d3101a5eb0bbd203a0d138843114ff7ed804facfdf287a880041e2

SHA512
5409dda5eec57e3e5ddf5c969eb670619539012574ab89c08a32e84c224c9ba0c1bbbf6a2c57474b54b4d26c50d260e2e9a208faad00466a225b5a1fc9d31f06

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
285KB

MD5
83d6b0f1ed503eb5c375b1c1a353d6a3

SHA1
f176fe71d25626c03dbfe5d7ccaed57bbd66e076

SHA256
7a0bd04600266dbdf54acf3f5efc0d7877de0335f5d0cba530601d47658697ef

SHA512
41a58773d09146983fe125eef269afff94e5aacbc73ef196f5b8dcfabf8165f96676c31d754a9ee3836e62e8a9e1d8b3b58dbb65be4e2c61f33d5ae42fe0b443

Download Submit
C:\Windows\SysWOW64\Elppfmoo.exe

Filesize
285KB

MD5
aa82d5b3b4b54d6e63d2b0eb9f6a54de

SHA1
8fb165fb2ce53122510d95b93cbc3e632e0a9ce6

SHA256
0c0070ef53ad294e63ee326f4c376be3b763421891448a01c7fc2376cfb6d310

SHA512
73e8a87e5156aedd2a97a96dcf460ac23d6f19d72ce1b190a3b962090ccabbf3e7e466fec63eb7950cff385a3e8d60f61887071544be77aa17d873634d571720

Download Submit
C:\Windows\SysWOW64\Embkoi32.exe

Filesize
285KB

MD5
b52bd7076a397a2cafa8e15b9fa5ca56

SHA1
da4434ba2f709622042ccce4354d2d81208103c7

SHA256
b19c5ac86b10834b225dc420f2d1dcdd2dd393718e2c3c8520ac1cc7cb350192

SHA512
556961bb48191b1cecf8a379e4f89ced39be8069f2e03b22f4290f882608c534ba6fa2c03d7e7325e10bff4e68ce8de2a6c001e3bb0f836a4bbe9042a1221c52

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
285KB

MD5
5937622c2145967ba3dbeb9315b356a7

SHA1
77d6db34a08b54407026f04d92eaec384043e32f

SHA256
2e0c86f9e7b5c92c19c94b90ee0b34cb98eb22978844c4c534703452ac8777d0

SHA512
9d913914096b350800519950bcf7f858c81305a4b9084d51ca712d6660ea1b085a2338e2f490513954a8e059cf8bbc37c8982578e1845ce55946550ef0ffa805

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
285KB

MD5
3857b3f9816c9a4f3f2b10e92fbac1a5

SHA1
322b9fbfb4404b6db5d72ef1a6438acafec04641

SHA256
4f58a7249c7832c50d3a298c0fb84b8eb44aaebedcc57bdb25ce6e0eb7e216ae

SHA512
c073912e688df19c0c7757ea4db73ac81841f4b37d12b24ff4a60c5ba0c0e8a7bdd8c9fadf22946d9c7322717105f9a6c899fffda98ee78802ffbeb343906841

Download Submit
C:\Windows\SysWOW64\Fcfhof32.exe

Filesize
285KB

MD5
d744ae3eef296ea096c5228615d4056d

SHA1
88db9f4902fef3de3a275cb898ee0ddda8f938f0

SHA256
67fd610f1e2ceca83b3455c94f4eaff1bda4c7bf7aad15f4fff102fdbcef4bdf

SHA512
7f7100697ded75d51fddd462eb8437be620b39c4513c21bf04e03eff55d55b36bf4c6246c04ef5e3818fa40a7b3a9e97d1f789c4a1fa3f4c86a88efa668f69bd

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
285KB

MD5
e261bec3e6328502e420fa5dd26d12b0

SHA1
e764d3cbaae8bbe12e9dc34a3c6933d4e7054c2a

SHA256
2f5fb2c82e2c98bf087c53384a06fe75eeb8728c28821fc4e77430e5e79a26f9

SHA512
acbf0e02256a13e17923dbe8364044a0a6bc725b478b54caa3de7b27ee985e9df5cfdf225f1b9ae5ada20fe46c1a5ad74fb9e764207a024ed62cc96988c802f8

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
285KB

MD5
78d5d71d9b88c78d2aca15aab7453857

SHA1
020c78894bbcc5774d78535878ceb3e2bcf84222

SHA256
21507f698a246d5a536d5da8119ba5f1863b4919b266bbfa479575207a2187ab

SHA512
0e2ec552855fdb71b2033e1b6c08e6ec5b6a59c4587a6532826a7a6bf17a69b3c4dd166651cebed33b49c9d609763b96edbcf236bc92a2cbfdf852a09081f796

Download Submit
C:\Windows\SysWOW64\Fgppmd32.exe

Filesize
285KB

MD5
d0e08148a7ed82cca806a6427a932baf

SHA1
e6efca9d87687961f141931f583d981e5da98aca

SHA256
34fcd49d88501dc82e9572b848403114e5528a28a6bb0f5ca9f0ef7eb5f5e7b2

SHA512
73d589be18e81dec02b8094cb0a7f4e3cb0dc4db1a233d65d768c4f8a150b787116e576a546d4624c44c864c23ab6208f2eda7ac54bab5ec5982fbea605e7d32

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
285KB

MD5
d68c4af7c43b904d2113ca8008a1166b

SHA1
5ad5100056ce8fdd2313659f99408683846de49a

SHA256
bc0dae6b7509db3f6e279dacd22568bd43b681c1bb5b04851dd38f9687b78ad3

SHA512
55d1aa72c82bba355a668334e33ff29212c03d64073ca71844055c54edd3c73aab129813a4b5adf90818b22f36da4c031ea53c315355282b83872c058481325b

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
285KB

MD5
58b291757962a634e2596c17a9daaf5c

SHA1
ad44d4348160b2430cd2135a2bfda67d3ae441d6

SHA256
996878f2b21d264a1fd06e594930b56b443a26a14ea8af6ae1baab14cda0518f

SHA512
7ecabd890b5bca33df0bcbdcdc07a4e89b993a42d082b4bb02657980b76766d5b55ea50eab7a886a5f468e6da9a704805a07cd0978b2834a33f36f5d7d024e1e

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
285KB

MD5
86b32ad92fb4f5cd55dd0ebd6ad38857

SHA1
7e013db7be8c8e750fb305c3eb1559a7be475f95

SHA256
27f4e4212eacf906a3c65b7b8d9dc04a62332629cdce0836460a48dd6b597b57

SHA512
cd7d2a0b105af848c624fbbf74be561e35a75346d56edd2443dd19e7364af6eaf28aac5d1c6155691b90d3b57275c979b80cb2c1bf4ca13e685edac5bbe4eef4

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
285KB

MD5
69499d87d99dfcd47fb18c183bab39f2

SHA1
d6eb4ddfcd7fc1563b24ca0cd24c040ed6635ddf

SHA256
032c9553b0998e657bf514dca63cac2f7deae2459126245c17595ccad0991f2a

SHA512
bc95b6e841b9237c59dbebfe0fa8a475d093d25456de919c1fbcb0882bef67dca534b755f9d1a8ffdbe384d18915d284fde47a92c121c3b9c3c3d42b5b52b13f

Download Submit
C:\Windows\SysWOW64\Gfngap32.exe

Filesize
285KB

MD5
136c7b1ca2ef2b56cacba6df6161e0b9

SHA1
7afde989cb0e116e870b8c7d009ecaf0e50f659d

SHA256
97bb544cb9de3cb61d4111752b72ac4fb781686460972092891a6ce1771a0e4f

SHA512
c23560e5741a963f504769af42b282ad2ba44aa8b03c83c1535318f0523b8b66423e95926e3a4f4d41ba9f091bf89380964b887f4254c1ae3e7389e4dfef46e6

Download Submit
C:\Windows\SysWOW64\Gijekg32.exe

Filesize
128KB

MD5
fab0486746ea7ce476a210f57b6b6b91

SHA1
770330cb627b6c69a62419b20cf64daa933d0190

SHA256
35b7604ec16e181aa2283b412106c938c210a3ba0adae8b38c02f18ea2f43845

SHA512
dbf3332cb5be22446714a9fb54a20be7ae23e377c280fbe72b9a904c14d044a209380724d6b2a1782b35d31a024c52ff59644164366f7ace077c2bc46c07a52a

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
285KB

MD5
fcf642a21afc2ae1a689046b281f0faf

SHA1
4e2a59d73de007e18e5981425d6a0f5c188da9f3

SHA256
32a60bf503343065782dfb6e31f7dd596371b7374a877302ab8606d3bc1cdf7a

SHA512
158a80e030cae5ad978bbbfd932243042eb26a9795a69376080386996f9c0ff23043d65e5fe3f526fa7b723baeae27eb90fc07b190b030a6653f21f276ca9263

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
285KB

MD5
bb89df5e3ab9b55b51327daa53940636

SHA1
123844bcfd4ef002bdd6fff679a272cf2ea7f45b

SHA256
afef0b84b20f106cd4a208a18373466d283fc8b2a6b1c1119cb7dd077d6f7a15

SHA512
b50c324644c2b6d8cc3e338fafce6595832cb239b87a97e3cfa609ae1e65cb6463381c705aed0cd84c6731d6d164034d4d35936b04cf7b4d21e66a8ccf212741

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
285KB

MD5
c6b2de8264c01c9c98eaf87040c22d3d

SHA1
91ba22d4349f68dbb5f099917c39d50f4ef941e2

SHA256
3d56a60973347756fd0035c2e4413247bf95677f42a7cd861070f67a4feaeed5

SHA512
6c03698e092db84e1900f0e55d638a0f22c76e58db939c29e14ac70eb768621601a2e478fce79b71593f2ead210d21b494dcf3b2b56dab8fbe3f39dc3e1e525b

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
285KB

MD5
c793bba20836954d6349d701f23ae0fa

SHA1
5b9d9adaefcee49d2bec836c5bb1ee870ae9ab46

SHA256
ef636b10adb671a27dd64a639ad6db9b99fd9decc822f4e3b50191bb1c27d708

SHA512
1201c496cae56e6977936e2bca93e0cc52f573371be3d9f91a6e5790731311e0e81d77dde53e5d71325cac55224f945c7980bd3a6682a869365fd0b4389d969c

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
285KB

MD5
201e010fe9c1eaeccb564ade82ef1bec

SHA1
8cf064f238609ca0610bdbab4c29e0cce22ffcd0

SHA256
ceb911f12ad7292d73cccaee455fb2506ae359b2dc609adc1b8336b54ae076bb

SHA512
4d531cfa0398062fd418cfff3a02f7720fa8ff206d68974748aabaede505c94175d2966a2c1bbad7f2c27e3047e9b9cca58e629e3be41c1c2d0f5d20c0755191

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
285KB

MD5
af4d68fd45cfbb6ab87592537d106c7e

SHA1
44c4132d96d10ab75e5f6ec1e6ea6f915324d09a

SHA256
3b15afc24abbb29683ad6c5920806b50d02f2c0591da01a2e463ecd1df0fdf98

SHA512
ff0b417d4badd52c3f1193ea607ebd7d896f075771042b5eb1efa12ac2448ece5a6ef84abfeaeba0eba36e24553df9063aa227dbb6d45c844043dd02fa882778

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
285KB

MD5
e1f41a467ae5d30e3213a16dd7abae67

SHA1
4f6fbe87b2faf0241b3dd805d7616ac27f1cf017

SHA256
cc933c781a00b85a1a90345be8e85aa65986c1f5da5adde10eb14a650ffb94d7

SHA512
3f0a91ad4303a475f935a688e618d980fd3637a68f9e1f34dd501b80677280e2aa72f9b9ddd781916908951a8dead2593616acfa4bd0b2e23b2a3ad1de24a05c

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
285KB

MD5
823c68e5e066bb8d379627b12de80e7b

SHA1
11c55262413c1225018f4a1b6ba450c4a2e646f7

SHA256
f1e65c3f88eccfa77a37d5cb411f0ba3c2906b5fcedf822597cb55559c78ef58

SHA512
3fe46692e1ce30e689e192371895d76621d1142158f5793974af0acdef1615d54179abad690722a1d2e69b95f0f70d3fb74f77a18815ecaaa07fc6e132697159

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
285KB

MD5
cf890839cb745efca6bbfc56bf8950ce

SHA1
868437b641778473675a3f3e594244e8e8f1bc19

SHA256
33d5c07fef46c7fd994c14af6fdefbc988f7ec05776bbc592f7f7171bf549e42

SHA512
062e9dfde2ec81b9c04a0bafd2f7be7867b56c640b5fee6ff0074ebf72f5834cec56b84dbfd0cd23a1c8d5b935be4c819aac77fa8632fa0468f52517ba875ada

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
285KB

MD5
9ff2e5053975e7ae4dfa3bcd2df2366d

SHA1
56b0b027634e94dcfdd0dbba3df6681e5b9ec6d8

SHA256
b56dfab5f829e04df996381f406a7e8eaa1cbc974e515c387e7b3f50122a1a44

SHA512
1269c025f3326feb1177a26814cbbaeeed50a93f8e8ae8c61068d3b6caf25b31ba3e6eeaa937bce02972d8d8bc3ba571cba7dc8b8bb432a14814b73b2b1898a6

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
285KB

MD5
7cff185252481ed6fd6d54f2d35ae41d

SHA1
4e878611064604d1cc43c5249ae05d113a3019e8

SHA256
480bea8b7e00e94b421d7fbfbc514fc88937ed53c2ce2f49cac7fc9e19e3868d

SHA512
de4a3434c2a1d62bc15b09578235b6e51ce03d66fecd7d344672ea58876e4fc5ee77c96fd40820048d7f3e8abc9d88a187d4f6082768b9a87b7d6aafa9d6bf85

Download Submit
C:\Windows\SysWOW64\Hnfamjqg.exe

Filesize
285KB

MD5
b41b66584b0f6368204c9f62f72cfa0b

SHA1
3f86140ea8c7d2f4f97e7dd6dc4f97304266f0f5

SHA256
d39863a933a699375bc68d98ac31ecbcfffc897a900d947ee62602622c0cd84d

SHA512
6c1bd35153458deb07f61ae38aa58d5225babd4cab29f9d583e8e8b333ec45b7bdc7c36eda0fab101476995488b1b93c67d357968f30a0373de77b6b9968f15d

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
285KB

MD5
c0871df319176e3078ea554effffde06

SHA1
aa19168b29e09ff7a6944a240716bd7594bfcb61

SHA256
acd0e649092178a7c24c728123b6b35cb41ac5229040f42196ae3369707c30a6

SHA512
4938b1e09631029b3eda79493e3c2abef09abb55ac9b200d0db96b0c69baf0d0da21d2887afc3063c809d0263daa123b9719c9e71f138b53a08756820c7d7fab

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
285KB

MD5
04cd7999139b856539f649baa311d0f8

SHA1
acd48eddd699d9cf1516904e738ebb1d32779f9f

SHA256
60b23bc34a2b8121699dfd43499c3d61d98a43e63955c1fc54f2a3f6aec67556

SHA512
5b0f333dad290c64ba84c1fc43c90436079c618c3ff3a6a9aa9df33efad2358668657991c76d233c372787f68ced3ae74afe69fc8c1793f1f97d879a83ef9525

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
285KB

MD5
2cd4d7b1c3e6049c0b3d78a4f5c3b322

SHA1
fd748ef4e2c4f499cddbc8f5ffe9f94c2ffd9b6c

SHA256
76821710e9196aa974c710338002491413cda4aac46cc647aa119d021f52c28e

SHA512
73acb57a91892056c87ed661b66e8e2c710439bbe33b2ba4ec1d5356679578aee2c7ed0168c144c24d036b5dc6d28b251d8976f30ad79a8bc9a864749feb6009

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
285KB

MD5
d89b570785dfac4b282818203c995677

SHA1
01de895c86427dd17ab2704a14b112fd2b02dace

SHA256
5aa11c6fcab799971345d31f742d54e858aa5196abc08ed5013aeb6eede644b9

SHA512
6c14221be5206436ec9fd8d4f346f80d0d4e33f192eff123e67d261ac667c547b06e0688f5fb346e439a677ff61beea86508a8b94598313ec1caba3f613b569f

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
285KB

MD5
ac801f7217ddf6e4039709903195d192

SHA1
4eae7798b2807d9cb1a1e9aed7b48f20e0df8d1a

SHA256
5b914d18d4250120987681531a602ecfc12f09eaf969ef993866defaa83a84df

SHA512
dea51bd50dc7a9a179fb131317dfa39011be06406145767bf836d28aa32f81180e2a2ac967e734805b16ae49e68c79d938bd1a4ec1f78fdb3a69105de069e2d7

Download Submit
C:\Windows\SysWOW64\Kkcfid32.exe

Filesize
285KB

MD5
a31d7768ffe8c4e38bc73aff13171614

SHA1
4c3c2b7cfe61accf350c3c2e6dc67235e2f8f35b

SHA256
b62baa22c3f33530aa01329a2638ac7024732ee835b40322a7fd7995e046f979

SHA512
f15943eeb943dfbe347f4647a52fa793b871a0eef4888c8f26cabe0df0c14a67e24a1390ca405a40cd435e06be7329335a035eb44e2f13745940ca340483e3fc

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
285KB

MD5
cf210b63888ce1affc804fe6a421bdb4

SHA1
a00f1584bc278d1800cd2aa11d2af5fa0cc4ccdd

SHA256
a35753dd3b996d180426658e4825c1d80c8eaf62aa3d546224ad4824b794800b

SHA512
0bed3b8c1f7ee1d4b03f0e2a3c15836f115bfcfe96fefc071f24ae7a645da27dc51802c96965d621a37055f1fff18213ddddfaf1940ab3bee47f37feb72af8ed

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
285KB

MD5
316d31873ae071a0114e6d2111dc45ca

SHA1
862c80ee2ce1fd2726f0c73308e5bdc8e17fe1b6

SHA256
a11dce04790f22bb14c0da26e940e9ebdd33a2fa494c93f67548cd5d00c47ca7

SHA512
a60a75dc9f40045676806766e9a9e32b85ef4213ec76700334c4205c272ea018ce0724871149d3ad5de88595ace5cae01d4d6519c45e2f01f8d02dff1736c14b

Download Submit
C:\Windows\SysWOW64\Nbqmiinl.exe

Filesize
285KB

MD5
7bcf862e803c27dd8b01aca96ef65e92

SHA1
7623187588c6d8305afa27dab4aed37b8f4b4c59

SHA256
73f33740b5f9e2af8264d7984f8f33527561535da30c9cea75efe84ddd323c7b

SHA512
7f0377134c00699beddd3f902f68bcea6bc4ec9e8ae2571383201d84c6c37509e51f7bae2d9ae805d1c26d6735a07551b8e40f15381c4fc6f26c3ef0b4d15d2d

Download Submit
C:\Windows\SysWOW64\Nlmbpgdl.dll

Filesize
7KB

MD5
612d12edfed5b11098cb5f62710acbd5

SHA1
5671cba15b76b71bda2a878f6d63122045df59f6

SHA256
668fef4f3839dd694f87f19bfae940c21fe5e9905f1e67da04ccb7f285317dd6

SHA512
81e3296c0724d924d96bc3558fba1ea18d502f5562eb453f892ba1f654d282faa07b58c063d5610b326a1ad7fde49ad1897ffb89cc592f6d2a020058a2af16c5

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
285KB

MD5
e24694d4bc912fb39623fa961dff9ee2

SHA1
d098db6f711c0a407130599d47c0b2eca0d810b5

SHA256
120b8ef912533b3943513f4a73510d99e787996dfb6570c6487de8c60d95eb2d

SHA512
b3955795f2cd4b8cf07103f668bc523ab270596932f85c46592d7dc0ba914faf51caca1abad912f787107b0912b1605cc42993cd4835d95ac54adf7fb21e5082

Download Submit
C:\Windows\SysWOW64\Oohgdhfn.exe

Filesize
285KB

MD5
cfdb56f1a8e2a8771f9e49aceef32d2d

SHA1
51d9810a70da3273bd1b5e1ddda179c81ec726be

SHA256
cbdc72273f899cb97441ee109b19a42c1d10fd6ac243c0c483067203a49fa747

SHA512
82a5e26dd79c2348ad8f1ba81fd430a02f21ec4a466f6cafd18570f4d90a0d93bad8767a701a9795ed45d75835e656402559c7b0ffee15e4e2979812f4fdb19e

Download Submit
C:\Windows\SysWOW64\Opogbbig.exe

Filesize
285KB

MD5
2ab7b2b4bb4e77a7706784988ea63c0a

SHA1
896da4fd164da8e57e13a43c49a8a742a4f4d428

SHA256
4d95445598a9c42a48529d94ce3d0824966f75f814c046209722644265da46bb

SHA512
6a04eb6a8f27c3e455f8da50bf9724728a1869159d4a1516b16f13de5fad6d9d5d219d50c2187af1e8b4c40f927a6f7355c294781e4ca0042b9d1f86d7da20e5

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
285KB

MD5
fdd003afe40a32e0f05a9e16c228a623

SHA1
bc2b160ea2be95dd416982ceff28b876624d37ce

SHA256
d03f060ce42bc581e48bc912f0cdf63ff9361fbb5b96eef47260fdf4175a3529

SHA512
d0b728201b65e168b345ce536bbe7c838b4b9ab885bba12939f5fa196291e4a65e1fae1056d6df6283dd5e9a1ea255529c32b3c710e629e3e6ab29a4705ec445

Download Submit
C:\Windows\SysWOW64\Qoifflkg.exe

Filesize
285KB

MD5
44a87e3424ac3e40fbbe38326f412cf5

SHA1
1cdc3ea37dd321984bb128db2b40ff7cc060192d

SHA256
fceb3f9fc32758f9f1993c8def8fff93895a8b4466a14d1f0f0fce2a66bbfc69

SHA512
9a590a7117943bdff9b0998022a928c0792200b4199d784aa4a89f2d46d4ec306babbffe874abebd9de50e3cabc293d98e32de3e9a804447f2945d28e57897b5

Download Submit
memory/316-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/532-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/780-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1072-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1240-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1288-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2012-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2780-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2804-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2920-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3056-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3256-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3292-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3928-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4092-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4260-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4276-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4876-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-211-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5036-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads