66b95e0920cb1c61b0a1b639052b6aa65b533823a28ca58a5c2e5d37fcb85fb1

Analysis

max time kernel
115s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe
Size

440KB
MD5

e8591b4ed169dba1cc7f52e6178cfa96
SHA1

f93376f7064ab2eca8759a2c1b007481c55d7175
SHA256

66b95e0920cb1c61b0a1b639052b6aa65b533823a28ca58a5c2e5d37fcb85fb1
SHA512

0f7e3286255d8685ae08c012e85b4b65b8fefe22715a4436e7e837cc3b18f2c02ea0e4510b325d5cbfa712b9acffdf6854fded1559833bb268e99f5820038fc5
SSDEEP

6144:Yo1bHtsqyRn1oPQFShqyRn1zqOTYFqyRn1oPQFShqyRn1:Yo1b4jOTk

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccbadp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gklnjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbefdijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neoieenp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djegekil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpmpnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inomhbeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pedlgbkh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olehhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbiniff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nomncpcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adikdfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgqfdnah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkdpbpih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bafndi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odjeljhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojigdcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckdkhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqoiqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnpofnhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gglpibgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmbbhkjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mekgdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghppm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglfplgk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgcfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpqldc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdcjlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpmpnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehiffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiioonj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilpmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaompd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poomegpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboffejp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnngpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbgoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehfcfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anobgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkmmaeap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phdnngdn.exe

Executes dropped EXE 64 IoCs

pid	Process
3216	Kmijbcpl.exe
1080	Kipkhdeq.exe
4324	Kdeoemeg.exe
4448	Kmncnb32.exe
4500	Leihbeib.exe
1368	Lmbmibhb.exe
988	Lboeaifi.exe
936	Lmdina32.exe
4532	Ldanqkki.exe
2552	Mgagbf32.exe
4068	Ogifjcdp.exe
2856	Olfobjbg.exe
4948	Odocigqg.exe
4396	Onhhamgg.exe
3660	Olmeci32.exe
1704	Pqknig32.exe
2424	Pjcbbmif.exe
1424	Pggbkagp.exe
4492	Pmdkch32.exe
4136	Pmfhig32.exe
5000	Pgllfp32.exe
3128	Pqdqof32.exe
4100	Qdbiedpa.exe
1752	Qjoankoi.exe
1916	Qffbbldm.exe
1204	Ajfhnjhq.exe
540	Aqppkd32.exe
2340	Agjhgngj.exe
992	Bfabnjjp.exe
3940	Bagflcje.exe
4252	Bjokdipf.exe
228	Bgcknmop.exe
1908	Balpgb32.exe
4884	Bgehcmmm.exe
4924	Bmemac32.exe
4652	Bcoenmao.exe
2292	Cndikf32.exe
2956	Chmndlge.exe
2088	Cjkjpgfi.exe
1132	Caebma32.exe
3484	Chokikeb.exe
1864	Cmlcbbcj.exe
1804	Cfdhkhjj.exe
3056	Cnkplejl.exe
1560	Cffdpghg.exe
3124	Cegdnopg.exe
4792	Dejacond.exe
436	Dfknkg32.exe
3564	Delnin32.exe
4140	Dmgbnq32.exe
2640	Dfpgffpm.exe
1256	Daekdooc.exe
4484	Dgbdlf32.exe
784	Dahhio32.exe
3920	Eolhbc32.exe
3092	Ehdmlhcj.exe
4344	Eehnem32.exe
872	Ehiffh32.exe
3656	Emeoooml.exe
1712	Edpgli32.exe
3300	Feocelll.exe
5132	Fafdkmap.exe
5180	Fgbmccpg.exe
5232	Fojedapj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kpiljh32.exe	Kfqgab32.exe
File created	C:\Windows\SysWOW64\Ollnhb32.exe	Oepifi32.exe
File opened for modification	C:\Windows\SysWOW64\Hpchib32.exe	Hbohpn32.exe
File opened for modification	C:\Windows\SysWOW64\Egegjn32.exe	Ekngemhd.exe
File created	C:\Windows\SysWOW64\Hfpecg32.exe	Hninbj32.exe
File created	C:\Windows\SysWOW64\Oidofh32.exe	Ogfcjm32.exe
File opened for modification	C:\Windows\SysWOW64\Adfgdpmi.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Ajjokd32.exe	Abcgjg32.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Chdialdl.exe
File created	C:\Windows\SysWOW64\Policp32.dll	Ngaionfl.exe
File created	C:\Windows\SysWOW64\Lankbigo.exe	Lnpofnhk.exe
File opened for modification	C:\Windows\SysWOW64\Fbhpch32.exe	Fmkgkapm.exe
File opened for modification	C:\Windows\SysWOW64\Odmbaj32.exe	Oanfen32.exe
File created	C:\Windows\SysWOW64\Pbegml32.dll	Hfhgkmpj.exe
File created	C:\Windows\SysWOW64\Hankellh.dll	Ilafiihp.exe
File created	C:\Windows\SysWOW64\Mmjmhg32.dll	Blqllqqa.exe
File created	C:\Windows\SysWOW64\Jgamhc32.dll	Dbocfo32.exe
File opened for modification	C:\Windows\SysWOW64\Ldanqkki.exe	Lmdina32.exe
File opened for modification	C:\Windows\SysWOW64\Pgllfp32.exe	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Lbjeaofg.dll	Bgpgng32.exe
File created	C:\Windows\SysWOW64\Dapkni32.exe	Djfcaohp.exe
File created	C:\Windows\SysWOW64\Ecmomj32.dll	Kilpmh32.exe
File created	C:\Windows\SysWOW64\Mbighjdd.exe	Mjbogmdb.exe
File opened for modification	C:\Windows\SysWOW64\Kkjeomld.exe	Kdpmbc32.exe
File opened for modification	C:\Windows\SysWOW64\Ofkgcobj.exe	Ofhknodl.exe
File opened for modification	C:\Windows\SysWOW64\Gbnhoj32.exe	Gkdpbpih.exe
File opened for modification	C:\Windows\SysWOW64\Hkeaqi32.exe	Hammhcij.exe
File opened for modification	C:\Windows\SysWOW64\Cijpahho.exe	Ccmgiaig.exe
File opened for modification	C:\Windows\SysWOW64\Hkfglb32.exe	Hkdjfb32.exe
File opened for modification	C:\Windows\SysWOW64\Mofmobmo.exe	Mledmg32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Lonege32.dll	Nbcqiope.exe
File created	C:\Windows\SysWOW64\Gilapgqb.exe	Ghkeio32.exe
File created	C:\Windows\SysWOW64\Qohpkf32.exe	Qljcoj32.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Ockdmmoj.exe
File created	C:\Windows\SysWOW64\Kbjpeo32.dll	Nqmfdj32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Mbibfm32.exe	Mqhfoebo.exe
File created	C:\Windows\SysWOW64\Mpghkf32.exe	Llipehgk.exe
File created	C:\Windows\SysWOW64\Dpehof32.exe	Djhpgofm.exe
File created	C:\Windows\SysWOW64\Gbbgpbmj.dll	Fdcjlb32.exe
File opened for modification	C:\Windows\SysWOW64\Eiieicml.exe	Ebommi32.exe
File created	C:\Windows\SysWOW64\Iankcfdg.dll	Gbabigfj.exe
File created	C:\Windows\SysWOW64\Pfigmnlg.dll	Nmfmde32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Hpkknmgd.exe
File created	C:\Windows\SysWOW64\Nodeaima.dll	Bphqji32.exe
File opened for modification	C:\Windows\SysWOW64\Pgdokkfg.exe	Pomgjn32.exe
File created	C:\Windows\SysWOW64\Efkphnbd.exe	Epagkd32.exe
File created	C:\Windows\SysWOW64\Fkngke32.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Jokkgl32.exe	Jinboekc.exe
File opened for modification	C:\Windows\SysWOW64\Ieagmcmq.exe	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Njmqnobn.exe	Ngndaccj.exe
File created	C:\Windows\SysWOW64\Dhdbhifj.exe	Dqnjgl32.exe
File created	C:\Windows\SysWOW64\Olckbd32.exe	Oidofh32.exe
File created	C:\Windows\SysWOW64\Bhoqeibl.exe	Bcahmb32.exe
File created	C:\Windows\SysWOW64\Lqikmc32.exe	Ljobpiql.exe
File opened for modification	C:\Windows\SysWOW64\Eicedn32.exe	Emmdom32.exe
File opened for modification	C:\Windows\SysWOW64\Ifomll32.exe	Iikmbh32.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Kcpjnjii.exe	Kncaec32.exe
File created	C:\Windows\SysWOW64\Ddcebe32.exe	Dinael32.exe
File created	C:\Windows\SysWOW64\Jdblhj32.dll	Fpgpgfmh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9772	8788	WerFault.exe	965

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdffhl32.dll"	Bihjfnmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gejhef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjgebf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbgbe32.dll"	Jgenbfoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qohpkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aednci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahkpm32.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhgloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghkeio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kijchhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knknhqjn.dll"	Dmfeidbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lancko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mekgdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgdbei32.dll"	Jngjch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lemkcnaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oidofh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpehof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Haafcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paihbi32.dll"	Ibobdqid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmeddp32.dll"	Bochmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbpchb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojncj32.dll"	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehjlaaig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egbcih32.dll"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fidafj32.dll"	Edpgli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpcodihc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fddanicf.dll"	Gnfhfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oheihn32.dll"	Ejdocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkhpdcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkmmaeap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fclhpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bggnof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnmnfkia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgeaifia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Empoiimf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqikmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkdgfllg.dll"	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfbobf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfkohq32.dll"	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdpiacg.dll"	Bddjpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdecgbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hedafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dickplko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gglpibgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjbogmdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahchda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpiijfll.dll"	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clddmhpl.dll"	Lqikmc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3216	1380	e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe	93
PID 1380 wrote to memory of 3216	1380	e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe	93
PID 1380 wrote to memory of 3216	1380	e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe	93
PID 3216 wrote to memory of 1080	3216	Kmijbcpl.exe	94
PID 3216 wrote to memory of 1080	3216	Kmijbcpl.exe	94
PID 3216 wrote to memory of 1080	3216	Kmijbcpl.exe	94
PID 1080 wrote to memory of 4324	1080	Kipkhdeq.exe	95
PID 1080 wrote to memory of 4324	1080	Kipkhdeq.exe	95
PID 1080 wrote to memory of 4324	1080	Kipkhdeq.exe	95
PID 4324 wrote to memory of 4448	4324	Kdeoemeg.exe	96
PID 4324 wrote to memory of 4448	4324	Kdeoemeg.exe	96
PID 4324 wrote to memory of 4448	4324	Kdeoemeg.exe	96
PID 4448 wrote to memory of 4500	4448	Kmncnb32.exe	97
PID 4448 wrote to memory of 4500	4448	Kmncnb32.exe	97
PID 4448 wrote to memory of 4500	4448	Kmncnb32.exe	97
PID 4500 wrote to memory of 1368	4500	Leihbeib.exe	99
PID 4500 wrote to memory of 1368	4500	Leihbeib.exe	99
PID 4500 wrote to memory of 1368	4500	Leihbeib.exe	99
PID 1368 wrote to memory of 988	1368	Lmbmibhb.exe	100
PID 1368 wrote to memory of 988	1368	Lmbmibhb.exe	100
PID 1368 wrote to memory of 988	1368	Lmbmibhb.exe	100
PID 988 wrote to memory of 936	988	Lboeaifi.exe	101
PID 988 wrote to memory of 936	988	Lboeaifi.exe	101
PID 988 wrote to memory of 936	988	Lboeaifi.exe	101
PID 936 wrote to memory of 4532	936	Lmdina32.exe	102
PID 936 wrote to memory of 4532	936	Lmdina32.exe	102
PID 936 wrote to memory of 4532	936	Lmdina32.exe	102
PID 4532 wrote to memory of 2552	4532	Ldanqkki.exe	103
PID 4532 wrote to memory of 2552	4532	Ldanqkki.exe	103
PID 4532 wrote to memory of 2552	4532	Ldanqkki.exe	103
PID 2552 wrote to memory of 4068	2552	Mgagbf32.exe	104
PID 2552 wrote to memory of 4068	2552	Mgagbf32.exe	104
PID 2552 wrote to memory of 4068	2552	Mgagbf32.exe	104
PID 4068 wrote to memory of 2856	4068	Ogifjcdp.exe	105
PID 4068 wrote to memory of 2856	4068	Ogifjcdp.exe	105
PID 4068 wrote to memory of 2856	4068	Ogifjcdp.exe	105
PID 2856 wrote to memory of 4948	2856	Olfobjbg.exe	106
PID 2856 wrote to memory of 4948	2856	Olfobjbg.exe	106
PID 2856 wrote to memory of 4948	2856	Olfobjbg.exe	106
PID 4948 wrote to memory of 4396	4948	Odocigqg.exe	107
PID 4948 wrote to memory of 4396	4948	Odocigqg.exe	107
PID 4948 wrote to memory of 4396	4948	Odocigqg.exe	107
PID 4396 wrote to memory of 3660	4396	Onhhamgg.exe	108
PID 4396 wrote to memory of 3660	4396	Onhhamgg.exe	108
PID 4396 wrote to memory of 3660	4396	Onhhamgg.exe	108
PID 3660 wrote to memory of 1704	3660	Olmeci32.exe	109
PID 3660 wrote to memory of 1704	3660	Olmeci32.exe	109
PID 3660 wrote to memory of 1704	3660	Olmeci32.exe	109
PID 1704 wrote to memory of 2424	1704	Pqknig32.exe	110
PID 1704 wrote to memory of 2424	1704	Pqknig32.exe	110
PID 1704 wrote to memory of 2424	1704	Pqknig32.exe	110
PID 2424 wrote to memory of 1424	2424	Pjcbbmif.exe	111
PID 2424 wrote to memory of 1424	2424	Pjcbbmif.exe	111
PID 2424 wrote to memory of 1424	2424	Pjcbbmif.exe	111
PID 1424 wrote to memory of 4492	1424	Pggbkagp.exe	112
PID 1424 wrote to memory of 4492	1424	Pggbkagp.exe	112
PID 1424 wrote to memory of 4492	1424	Pggbkagp.exe	112
PID 4492 wrote to memory of 4136	4492	Pmdkch32.exe	113
PID 4492 wrote to memory of 4136	4492	Pmdkch32.exe	113
PID 4492 wrote to memory of 4136	4492	Pmdkch32.exe	113
PID 4136 wrote to memory of 5000	4136	Pmfhig32.exe	114
PID 4136 wrote to memory of 5000	4136	Pmfhig32.exe	114
PID 4136 wrote to memory of 5000	4136	Pmfhig32.exe	114
PID 5000 wrote to memory of 3128	5000	Pgllfp32.exe	115

C:\Users\Admin\AppData\Local\Temp\e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8591b4ed169dba1cc7f52e6178cfa96_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\Kmijbcpl.exe
  C:\Windows\system32\Kmijbcpl.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\Kipkhdeq.exe
    C:\Windows\system32\Kipkhdeq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\SysWOW64\Kdeoemeg.exe
      C:\Windows\system32\Kdeoemeg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        23⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        24⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        25⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        26⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        27⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        28⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        30⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        31⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        32⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        33⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1908
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        36⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        37⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        38⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        40⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        41⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        42⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        44⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        45⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        46⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        49⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        50⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        51⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        52⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        53⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        54⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        55⤵
        Executes dropped EXE
        
        PID:784
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        56⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        57⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        58⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        60⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        62⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        63⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        64⤵
        Executes dropped EXE
        
        PID:5180
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        65⤵
        Executes dropped EXE
        
        PID:5232
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        66⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        67⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        68⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        69⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        70⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        71⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        72⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        73⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        75⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        76⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        77⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        78⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        79⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        80⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        81⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        82⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        83⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        84⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        86⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        87⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        88⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        89⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        90⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        91⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        92⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        93⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        94⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        96⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        97⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        98⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        99⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        100⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        101⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        102⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        103⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        104⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        105⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        106⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        107⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        108⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        109⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        110⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        111⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        112⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        113⤵
        Drops file in System32 directory
        
        PID:4164
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        114⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        115⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        116⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        117⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        119⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        120⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        121⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        122⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        123⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        124⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        126⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        127⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        128⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        129⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        131⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        133⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        135⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        136⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        137⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        138⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        139⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        140⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        141⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        142⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        144⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        145⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        146⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        147⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        148⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        149⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        150⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        151⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        152⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        153⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        154⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        155⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        156⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        157⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        158⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        159⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        160⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        161⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        162⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        163⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        164⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        165⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        166⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        168⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        169⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        170⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        171⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        172⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        173⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        174⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        175⤵
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        176⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        177⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        178⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        179⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        180⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        181⤵
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        182⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        183⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        184⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        185⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        186⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        187⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        188⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        189⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        190⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        191⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        192⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        193⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        195⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        196⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        197⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        198⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        199⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        200⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        201⤵
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        202⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        203⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        204⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        205⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        206⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        207⤵
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        208⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        210⤵
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        211⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        213⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        214⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        215⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        216⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        217⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        218⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        220⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        221⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        222⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        223⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        224⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        225⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        226⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        227⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        228⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        230⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        231⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7944
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        233⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        234⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        235⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        236⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        237⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        238⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        239⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3700
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        241⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        242⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        243⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        244⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        245⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        246⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        247⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        248⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        249⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        250⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        251⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        252⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        253⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8596
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        255⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        256⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        257⤵
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        258⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        259⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        260⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        261⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        262⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        263⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        264⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        265⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        266⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        267⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        268⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        269⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        270⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        271⤵
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        272⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        273⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        274⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        276⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        277⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        278⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        279⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        280⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        282⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        283⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        284⤵
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        285⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        286⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        287⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        288⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        289⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        290⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        291⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        292⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        293⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        294⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        296⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        297⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        298⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        299⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        300⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        301⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        303⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        304⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        305⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8972
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        307⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        308⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        309⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        310⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        311⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        312⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        313⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        314⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        316⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        317⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        318⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        319⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        320⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        321⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        322⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        323⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9880
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        325⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        326⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        327⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        328⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        329⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        331⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        332⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        333⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        334⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        335⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        336⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        337⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        339⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        340⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        341⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        342⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        343⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        344⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        345⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        346⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        347⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        348⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        349⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        351⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        352⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        353⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        354⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        355⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        356⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        357⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        358⤵
        Drops file in System32 directory
        
        PID:9408
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        359⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        360⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        361⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        362⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        364⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        365⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        366⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        367⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        368⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        369⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        370⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        371⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        372⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        373⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        374⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        375⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        376⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        377⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        378⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10520
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        380⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        381⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        382⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        383⤵
        Drops file in System32 directory
        
        PID:10696
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        384⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        385⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        386⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        387⤵
        Drops file in System32 directory
        
        PID:10872
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10908
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        389⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        390⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        391⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        392⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        393⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        394⤵
        Drops file in System32 directory
        
        PID:11168
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        395⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        396⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        397⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        398⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        400⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        402⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        403⤵
        Modifies registry class
        
        PID:10680
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        404⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        405⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        406⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        407⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        408⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        409⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        410⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        411⤵
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        412⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        413⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        414⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        415⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        416⤵
        Modifies registry class
        
        PID:10896
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        417⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        418⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        419⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        420⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        421⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        422⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        423⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        424⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        425⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        426⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        427⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        428⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        429⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        430⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        431⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        432⤵
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        433⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        434⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11336
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        436⤵
        Drops file in System32 directory
        
        PID:11380
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        437⤵
        Modifies registry class
        
        PID:11424
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        438⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        439⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        440⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        441⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        442⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        443⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        444⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        445⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11852
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        447⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        448⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        449⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        450⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        451⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        452⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        453⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12220
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        455⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        456⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        457⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        458⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        459⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        460⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        461⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        462⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        463⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        464⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        465⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        466⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        467⤵
        Modifies registry class
        
        PID:11880
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        468⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        469⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        470⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        471⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        473⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        474⤵
        Drops file in System32 directory
        
        PID:12188
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        475⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        476⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11376
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        478⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        479⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        480⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        481⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        482⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        483⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11968
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        485⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        486⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        487⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        488⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        489⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        490⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        491⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        492⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        493⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        494⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        495⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        496⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        497⤵
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        498⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11152
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1360
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        501⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        502⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        503⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        504⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        505⤵
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        506⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        507⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        508⤵
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        509⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1380
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        511⤵
        Modifies registry class
        
        PID:11848
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        512⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        513⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        514⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        515⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        516⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        517⤵
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        518⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        519⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        520⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        521⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        522⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        523⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        524⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        525⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        526⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        527⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        528⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        529⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        530⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        531⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        532⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        533⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        535⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        536⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        537⤵
        Drops file in System32 directory
        
        PID:836
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        538⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        539⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        540⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        541⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        542⤵
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        543⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        544⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        545⤵
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        546⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        547⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        548⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        549⤵
        Drops file in System32 directory
        
        PID:4700
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        550⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        551⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        552⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        553⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        554⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        555⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        556⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        557⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        558⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        559⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        560⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        561⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        562⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        563⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        564⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        565⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        566⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        567⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        568⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        569⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        570⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        571⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        573⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        574⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        575⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        576⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        577⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        578⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        579⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        580⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        581⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        582⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        583⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        584⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        585⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2080
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        587⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        588⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        589⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        590⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        591⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        593⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        594⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12328
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        596⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        597⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        598⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        599⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        600⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        601⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        602⤵
        Drops file in System32 directory
        
        PID:12672
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        603⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        604⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        605⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        606⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        607⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        608⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        609⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        610⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        611⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        612⤵
        Modifies registry class
        
        PID:13132
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        613⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        614⤵
        Modifies registry class
        
        PID:13232
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        615⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        616⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        617⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        618⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        619⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        620⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        621⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        622⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12696
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        623⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        624⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        625⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        626⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        627⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        628⤵
        Drops file in System32 directory
        
        PID:13044
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        629⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        630⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        631⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        632⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        633⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13280
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        634⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        635⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        636⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12428
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        637⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        638⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        639⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        640⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        641⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        642⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        643⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        644⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        645⤵
        Drops file in System32 directory
        
        PID:12880
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        646⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        647⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        648⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        649⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        650⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        651⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        652⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        653⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12404
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        654⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        655⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        656⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        657⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12588
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        659⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12772
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        660⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        661⤵
        Modifies registry class
        
        PID:12848
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        662⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        663⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        664⤵
        Drops file in System32 directory
        
        PID:13052
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        665⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        666⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        667⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        668⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        669⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        670⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        671⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        672⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        673⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        674⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        675⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        676⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        677⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        678⤵
        Drops file in System32 directory
        
        PID:12744
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        679⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        680⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        681⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        682⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        683⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        684⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        685⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        686⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        687⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        688⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        689⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        690⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        691⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        692⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        693⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        694⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        695⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        696⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        697⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        698⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        699⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        700⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        701⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        702⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        703⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        704⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        705⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        706⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        707⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        708⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        709⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        710⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        711⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        712⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        713⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        714⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        715⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        716⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        717⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        718⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        719⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        720⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        721⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        722⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        723⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        724⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        725⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        726⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        727⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        728⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        729⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        730⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        731⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        732⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        733⤵
        Modifies registry class
        
        PID:13276
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        734⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        735⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        736⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        737⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        738⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        739⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        740⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        741⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        742⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        743⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        744⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        745⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        746⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        747⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        748⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        749⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        750⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        751⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        752⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        753⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        754⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        755⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        756⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        757⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        758⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        759⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        760⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        761⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        762⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        763⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        764⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        765⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        766⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        767⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        768⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        769⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        770⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        771⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        772⤵
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        773⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        774⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        775⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        776⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        777⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        778⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        779⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        780⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        781⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        782⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        783⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        784⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        785⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        786⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        787⤵
        Drops file in System32 directory
        
        PID:8224
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        788⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        789⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        790⤵
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        791⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        792⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        793⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        794⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        795⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        796⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        797⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        798⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        799⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        800⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        801⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        802⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        803⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        804⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        805⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        806⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        807⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        808⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        809⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        810⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        811⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1716
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        812⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        813⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        814⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        815⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        816⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        817⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        818⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        819⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        820⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        821⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        822⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        823⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        824⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        825⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        826⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        827⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        828⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        829⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        830⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        831⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        832⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        833⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        834⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10008
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        835⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        836⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        837⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        838⤵
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        839⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10040
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        840⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        841⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        842⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        843⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        844⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        845⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        846⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        847⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        848⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        849⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        850⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        851⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        852⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        853⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        854⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        855⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        856⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        857⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        858⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        859⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        860⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        861⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        862⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        863⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        864⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8788 -s 404
        865⤵
        Program crash
        
        PID:9772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8788 -ip 8788
1⤵
PID:9564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
440KB

MD5
7969d1fbc056f57116212db6c354a462

SHA1
cd146167df19a56cfcf3a2c6333c9f33eba41834

SHA256
2c0062aae19480f13935201b1eb8bb793716507190fc0072e39fa79ac6a786af

SHA512
d6a80e0593090bdd0a9523ea6fcf0fe9b3e410d56be518ad6df1aef0cbeb85822c3540faa608e8152d85e166ab9c16f9f8269d92a7bf2403cf9e89468ce1c308

Download Submit
C:\Windows\SysWOW64\Aijnep32.exe

Filesize
440KB

MD5
72a144870056b46c17a8e56651f930b0

SHA1
996719cc12ca5aa60f77a60870b7dbce7f7e84af

SHA256
d561f8aa462161b62bebbbd47c8d349398b7ca914f11d14462a4168a1411c2aa

SHA512
2cb27ebcb76f2998a6c1495901005c5f50943dd2d3d6e1ebcb4cad667226a2a8b71c8dd65c72d80119370307371db64031bb81fac26e57d076ef3977ef4b449b

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
440KB

MD5
b1b2ba8325e0732fdb86b41da399d4b6

SHA1
00a95997f87b4d6bbd92fd9b9dde20d71b200227

SHA256
e3a817d2a7ff818f04cbde1c1ce64ff5422ec1d16788e16f656827370f851d06

SHA512
a275b496ef166799e28d9b822bcaf1a1b8d17afe52a75663abebce44a7d9c5650d1f181297b05e53937fbdd2852a8de7fa627dd927fe18d76df349f8d3b4c02b

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
440KB

MD5
10b162b23ba7053652b36ca9ae20d9cd

SHA1
628b8bd0cdd7065758a0331324dd25ff1ee65e07

SHA256
a015971b0149a6c11235b0b490e9351f5949086c0db5a8e8e768ca0ce643358b

SHA512
b89f97c7c779405570c32165f9a9f7fbe4146540fe1b77fbf266b8a77b47625d301e9e88b6b9efe68ce4ce206d758dc26843de15a7d8537db4763d86ecd61abf

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
440KB

MD5
cc135f12528b831d6a04db6d0b779ddb

SHA1
92dfb4644ff4731aa638100fa48989ebef0f4cac

SHA256
1116e731888c527f091967e110ec554a7b404cc55a2d80e9a5612ed1f5adc861

SHA512
8f00a1044b0a053c9c7377cb934dda7646bed264336ad380ccec7e6df6a9c1989297a897463a9ceb63e6b55aae4a337b8091016cb890511e435804069bcfb508

Download Submit
C:\Windows\SysWOW64\Bcghch32.exe

Filesize
440KB

MD5
84c284f36cfe0ac47202f15e3e6bb31d

SHA1
dbb508c37d53f1f19787aead674305cc808ad895

SHA256
0193e17fba923cdf92bf66cc5ce87cab44385f23c71039e2b2256f2838caab6f

SHA512
f0e80c336ecca41de9ca4b643f5764575a2c55604ff8581b2139500bcc88fab3f59d7060151e237f97904ed6c4a2078aadc5eff11bbc329245fb392f5aa2fcc3

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
440KB

MD5
309a62094a2cc1c9884166e88dcf80c7

SHA1
16050db016d005c502563f138fb1135537e78566

SHA256
7afa2d622ff45e7eddb65c455fb7029c183d251bedd8ba2ff23ccfa4bd8a386e

SHA512
9d2087275c9de2e7235b2ed6f263be89de47442954b037f05085e724ef56577c8fb15e120a2c6f2c46cd5ac8750617c0bf7f36bbf3876d01add9704ec41f93f5

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
440KB

MD5
ab1235e523fe4439cab02195a22ee449

SHA1
ac75c3f7b15f797e2960ef301f52918cdd650557

SHA256
474c53d437e4dff42e33b0817da2bac137ed4f8ebb9e186cd8c23f39b2b17f1a

SHA512
e7da71bbb0e84374e40d84517ff369865261965e1870d9d618ea10d988a1747bf01e8094a180d8a984bb3de367016381676b8f3b5d4b592b8d26a7e60623e9a6

Download Submit
C:\Windows\SysWOW64\Bihjfnmm.exe

Filesize
440KB

MD5
ce970af26d12b48f0b063c6ed74e7f0f

SHA1
d7f95c25d5c4fdfd08641746263339025350f0b4

SHA256
2bc36857b34d8c2e81ecfb5aa8aaa38a35dc9fd842ace5945af4c696b4cacadc

SHA512
3021cd0c130c27267400f96e4661ed6b300e569f42f20bc9cc05229df2b9c9ae46cdc0e3df6a6d52349fcb0a37943fd13dd09a9c8b9d09e5860fa3024c18b20b

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
440KB

MD5
5b0746c64f98d08a0891bb039ce3295a

SHA1
38e7f9d4e1e460d6d3386864794cc4841b672426

SHA256
b6b753afd687ffbab21b2d4d472ea89276c0239ad56593e94da8cc7ec1987ca7

SHA512
1f1e0b62b9d267975a5eba4cf6e77e98e66a4009a8b5a3133fcd109674f64993aef347cd28e2936b140464c6551a75eeda45d2fd71be04acbb108a8148bb6bf2

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
440KB

MD5
531e6e698025297d406d004419855309

SHA1
b54b48fc7047c7969f79d708f59ba8d9c9ad946a

SHA256
39bfecbd6f02bf0ae5fa85a9de57cb7b03ca04866df269eb384ca6d11c216897

SHA512
3793aab0240b6cb9c7b4b128228f06f665577e77711d06918643b895b34ee0913d39e2e5778e7875d68fcefdf5675c588537ddf7e05875d80aad48e93710395b

Download Submit
C:\Windows\SysWOW64\Dihlbf32.exe

Filesize
256KB

MD5
2d58def5dae673cccfd903b7f583f46f

SHA1
f1bb0efedddfda8ae9513b7af0ededd5b5d88d81

SHA256
94b285fb994a7dc0c61760aa6093dd6617f9ca7aea7f2f2424a605832bde2943

SHA512
e6bc0de5bb499d13da2b70c1bba25cf0df5afbbb93f0f1f4a051a014ba522d711b44fc2eefef8408f16cab5a5f5ae0c4115caa556d9cfb0bd60c63b878a13fb6

Download Submit
C:\Windows\SysWOW64\Djmibn32.exe

Filesize
440KB

MD5
8fd59c21dc99e4fe23e22ae286d2b2da

SHA1
777e93dc2183c9b0e9cff88ba5ddcec4ce413fcf

SHA256
35fe4064f8947d9200f1c3073ecbf01062bcfbaa6d0ca74b7439aecaeca46254

SHA512
8373384d4076ad1c591883ad5657320ba405c951227896d8de07061dfe398d298797bb09e5bcee8155316a07c7d2a6515009a7dea0266e5c9b390846a6d0b35a

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
64KB

MD5
5369b7aa534dbd56447cc2e30daf3103

SHA1
2a879da306595b01a0b5dc88fa810370b4971b20

SHA256
8898dd714705af25d189fa78ebb0a0137cd5d53874f1e726357dd99bab298801

SHA512
e3939b7c94eaa30cb43aab57150891e905028a08d39cee59aba75d8965300725fda2629542ea45503f718b7e32e89d61c436376cb401e60ebf4057de0b27ab4f

Download Submit
C:\Windows\SysWOW64\Emeoooml.exe

Filesize
440KB

MD5
886b02d26414c4eee41ff9231b8d94e0

SHA1
fe904e321f6d6b1ebd8961fe92ae69b863118f0d

SHA256
916de6fa520d3d80c95fba9eac241aa054f90c7ea8488ffef7b95b05c35dc992

SHA512
6f55e6c897a045a0aea264fb65ca8c1df6ac0cb792fb5eaa6340ac29766dc8fea0759f2e15cf6a7fd00d20255eeac544425740edea5761b1b07741ea1977b2b4

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
440KB

MD5
f75c774786b6a33fc3112213e4cbda95

SHA1
368dc01804a7946952f7568063194f6762eac5ab

SHA256
aa2631e7fb76fc0fa05f1c3162fb6837a491cd44460441b14cc131f542a19272

SHA512
2342cfe28fdf6f8fc0865355765e6f73f8104808704c187b55b26f6317b3ae53e39ff20d3b2c77d9562f5d1f45789635a262b5d0d12655d32ef97b5574f00fbd

Download Submit
C:\Windows\SysWOW64\Feocelll.exe

Filesize
440KB

MD5
783fc793bab4f6939245b5ac3feb4a2c

SHA1
3571ad9c7a488b65d4d34191e1563461450e4a05

SHA256
f69f50fcc94ceb616435c254186ccbcc9aea5de29e97776c08ae4b2cf363eaf4

SHA512
d4e0fffa310cf737375e3568f6718314573ede5fafa3876e962147793c5b599f60e5f253b9fcd96fcfb5313a55531ff2adfee96d902bb0d5b3736e576bd5c8ff

Download Submit
C:\Windows\SysWOW64\Fielph32.exe

Filesize
440KB

MD5
bad9c630ec97fa58f27298dc05d07fc0

SHA1
934874c76aa894c58c97ad869fb3bffe4ba43330

SHA256
2d2b8d6674de3f131b44fdfd3f2850165f5365edcea2b14cf2206fe7e3e932d5

SHA512
46c0b9cccc1bba20443cdf0d024c30d2f875648e973c5cff9be92484584ba3cae0203e69943092ece221845f4b7fed370e993581af2102e132f4c8b9d09df452

Download Submit
C:\Windows\SysWOW64\Fkihnmhj.exe

Filesize
440KB

MD5
273ebff7ad231821b3ac009089884881

SHA1
3a2b8fd000f89f5964ad051869700739563fa76b

SHA256
71916d56bf4da06344c43f70e2af92f6d01f6699e22374088897bf28653a1426

SHA512
476903562736f99b5cf9d1c3160d780c0e58bb3c7061b687052df03e61fb687ca727ec3dda6baf59eaedcab0977555285363daafa00909b1827347ac7df607d3

Download Submit
C:\Windows\SysWOW64\Gkkgpc32.exe

Filesize
440KB

MD5
23309a58cd620312c4b0b096d9547dc2

SHA1
f94f67907b81a763adfdb3b28facbb3746bf94d0

SHA256
495a56fd6d4f6e9c13bfda065128d12b7666b5981e58cf123a386caad4279d7c

SHA512
b9449dbafad313f25d205587185ed3072412f527108cd4605471d47f02d3ade7037e2b6c07bf6bc9d1d95b1dabb492908fda50c715b512063af917215f4bbd6c

Download Submit
C:\Windows\SysWOW64\Gpnmbl32.exe

Filesize
440KB

MD5
d4a55917d2d7242b2414180a6956e05e

SHA1
edf7191ce66dfa5d37893e24e6ef54f190388892

SHA256
bb28918d8b47371c7554f4cdded2cc66dd03d7466d16b55e36469c50f60a8aae

SHA512
11deca33df77812cebde36a5a07321f722209ab547b44108f51871a63298d0a8fd72d9413789e76e37f5b827e530717432797abb9ba0092b2340ec59e77fc468

Download Submit
C:\Windows\SysWOW64\Hfpecg32.exe

Filesize
440KB

MD5
caf60fecbb2b644aeb7329d69a904d15

SHA1
3f55a322ffe8eb979c64794eead1c22826a5490f

SHA256
ca0c06777a44ff67f9080cb7ee41c35da9a7e00c03cec6e0dde3a2ee168660f2

SHA512
4dc4e84430aa8ef8be77ae802f56de082ddc5b0dc7a2d67839b7ad1611f20e1ac0277f225c2d498d9dd60b638b93997af69506e6663f5d6c932564f34b88fc3a

Download Submit
C:\Windows\SysWOW64\Hhgloc32.exe

Filesize
440KB

MD5
5f5955c0ab864103c1b2ec544422eb48

SHA1
5917cf5c7d28b91dcb7c38d8f9cf1e165da3827f

SHA256
722bda29b22f543f20ab91705e809864df27ca479bb5dc82f54bf07481a14580

SHA512
29b76c8fb75efc394bad83d554ebc9b82c2a2081017cbdea3753ef3bdaa9b444356ea4b8875ed80bbab55909f5721964a91fee932308e23976b5dc8c3e7ffd1d

Download Submit
C:\Windows\SysWOW64\Hlambk32.exe

Filesize
440KB

MD5
7bda74935d8e7963de964c819254edb8

SHA1
26b4d0759ded84dfda6d8be58f2cc4b49e1b37e9

SHA256
eba3868764c696052e0cc8fd2890836641f82a9c39cb6fded0e1e783ec922efd

SHA512
86d72d8b226003ba03d9b5fc81d4a0ab31e21fff3dde02e5ab0ba82969e68d8edd2b595839fe50836bad30d04aa04ca2af1f51d61447ffd935177735ebaa39fc

Download Submit
C:\Windows\SysWOW64\Ikcdlmgf.exe

Filesize
440KB

MD5
c3620dc526d6294103e2a9c9fad28b80

SHA1
ea340e0f06e7534e13b21bbe2f01dbb069d45247

SHA256
6563871f8c443ae1a92b23bfefc4982b82bc0b5d6f6ac5e1e57fd00f8524f14f

SHA512
3147fde9c9c6f180dc9c18d2bc390ce1ed6cd20be8c7abf59b58a773bce836b7214e0f9ab4db058ea4890091461b32919a83feca5db0e058612afc674842ec40

Download Submit
C:\Windows\SysWOW64\Iqmidndd.exe

Filesize
440KB

MD5
431d76340a12a94e0f2445175638af96

SHA1
a1d507043836cd34028f6c160aa269bee3c94b83

SHA256
94f523b79d85c03296a2ecfdbda7af0a4415a4df6a5d8447d945f54eea88f666

SHA512
c25986e86cd2833b5ca5fcb294d534d15481084651ebfb4b353c4f4f30d459d532fc1f2ea36ad0c34e7c1a8025fabbcfe7e7e7ff60f27197142dddc5f8933865

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
440KB

MD5
bddc8edecaa0b178c00b0162e333026e

SHA1
a603751aaca9f9df07a29e60591f67c6b1b2b81c

SHA256
61eb86d22ce1a34bb53ec51b9771c7d41a4f78b8f35e95871711804bfbbe43d6

SHA512
ddd9892321c4958d5c0572db211b2700e5018b3b52d06ad4524e8d1da7d140088ba77417a4b7f282f146187baedfe28aec9307b9d1e80eceafe44b29045ad047

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
440KB

MD5
0a34584a97e909a118feeafa0043b964

SHA1
4da4ead62262f1f054570b991e0c2d01ba4f077d

SHA256
d0d9bc9b421189a64f0986ab4582cad2fa4308531bc0a9d2e8d8796cf743dc29

SHA512
b359e5ca6c311d56ace03c049af76c0c6e3f225121bc28515745551cf2b55f5613cb0582597ee7500bceb9a17bb918092d66fceed743653f05315baf7d54fc00

Download Submit
C:\Windows\SysWOW64\Kecabifp.exe

Filesize
440KB

MD5
5def0dd5516d65bea575a2d54baa77bd

SHA1
224757f7d7b4f18e2f9b98c3c992b0e094739401

SHA256
e892ca0beb8898eddeae98071698866c727f0807e6f6abd52ba7a53dab3e3a25

SHA512
bec9363c8a26aa7bcd7891ffe1f7aede8e8f2e9c43471b4d5580fcb8173b11ccdd0592670a206c6a79cf892dcddaff7ebb1aa080573f4287165cae184973d6ab

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
440KB

MD5
4faad37fbdaf382b3bf4db4ab52976eb

SHA1
943136b6e35d31146ed49152bbe192cb36e8828a

SHA256
cf1135559eb4129c68782e4f74e844a17d33fda96a26e047edddacafb341aa96

SHA512
0acf5c7456cd4d4790748a26fdca05a163535d96908f30a2cc64273aed37f9804f18bd9e4a242e44b6e1b91fc4c17b0adddc1485f214fcd48b1323e50ff60ad7

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
440KB

MD5
844fb28387859440c8f7366598bd3532

SHA1
5981288aab318400835bfdcb007311f3847596a1

SHA256
b9d76f3a276d4013da4cc7104bee0a234819c9cdfe7ba9d9f15f961d7c97ec3a

SHA512
55f283b2f03b8d87914f3d6bd81be0bf552e93f1f0df33b085663369d2e5e7a73623e49b29ec2d7075edccad5f58567ed77ffc4adf558b5173b3dfe842ee9c76

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
440KB

MD5
465b1e812ca41d7ceed2d6728f1546d7

SHA1
0b62ec074927bb5953dcf859a1c03504aa550132

SHA256
f71cd0076f7def300105d7188dd916a6a9c877f5560a50a25119a50c349ca070

SHA512
ef18b3c86796b9922e006bd0780e4b85f277299c3e710f9c312cd6d4d32fdbdfbc5de92c33d246af164d4d54690efede01c2fdd72b5f0c4fdd31b6ec5e327648

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
440KB

MD5
c7d5f02cfd912b4ae8ace82b524eba0e

SHA1
a6d76a76cb9dc788d94dffeb464929bf566c6dc9

SHA256
b48d4a136a00d709cc0fad7a356a226cfc8a4496d37d4bd348a1433de0de3918

SHA512
8554f816e19d6130b81ffb63901d14d6744626283af52e8d34350e14801704320b8c083b7d5bfd2ff2c95f33838c90ba98dd23a52fc9afd1f00f8205bf06ea04

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
440KB

MD5
ac21f316dcdd1cf4045a6dfcc4624510

SHA1
1310d557f6b372dd8160ef97b9748ac143def4bb

SHA256
3e5a92beda276279fb951a1c4bec4431e5b82e7bedd8602cc6e36eb0fd72d787

SHA512
ac28a4d06a441e446ae3bf955ddc5594d380ae42daf98d797c30c500c9a5136f70f1e79d28039f44b7f1523e33bd0b85c620a148521096d2fc98347bbc10d1df

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
440KB

MD5
b4079230dd02a338ef3a235bfd4f6534

SHA1
64ed06c4d2ea66e0c3a1455ef336d472f941234e

SHA256
1461cf6002714160a97dad4356a217e5c793b05fb0e8427067e60a8e4bbae656

SHA512
5a2c1431a28bdbaf1ee16c75c49528cc04d5995d910d8112861d785d9c0b43c5731c89fd7ed3b4dad405e06682986e4352e49686ee5b37c1d5fd381b5c26679d

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
440KB

MD5
0831d34f286968d52e9a08e6dcaa531a

SHA1
a109ea65afe7506fa6185050ec7bb0810e62c163

SHA256
b9ece51eaa3ecea1976b8113d6ae0a1688900ff245d7f0b8ed9d1c1a78e2935b

SHA512
df1a2a5c4f027f8e77433fb6c3995ab5810c0767630781763be68f7bb3c325a85362f8f25ed4f6c702ad6ee43d145066697b2e5fde04712812b94371d0dd65f6

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
440KB

MD5
0df0a1b75c62f6489e93eb087a708e3d

SHA1
f1a2880d1d4b3b2b8a01ca427ebb5d551dde61da

SHA256
f554e6ea31b4b8766d7fa7132c8cdb298104d1e34330baa06951ea983f678a9a

SHA512
22c3e92f74171529e36c326300d44efec745a7b4d17d3e819e13e27007266e6764ba372ba20eeb0e5f1b45bd7c426787cc38648565627ca365f91e08d1ada3ab

Download Submit
C:\Windows\SysWOW64\Mbgjbkfg.exe

Filesize
440KB

MD5
605fe8a33ad5a17e96fb0259a7d169e0

SHA1
2f28be40b28d401b6cb219a53268140484973fe8

SHA256
12389ff272227fa1c27da922801972617b0fe9b0e91c55ff5158e4d80446a8de

SHA512
08fe5feb66bcea46026cfb22e7183ace78d0b47370b17eee4d912f511fda617ee204be8e6ecb9fffa784cd18ab5d0327ad5a7525aca2389bf10bb3e15a34369f

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
440KB

MD5
e61a1b0a62a49276a3734c46f1a821a6

SHA1
4a0dfdcb8e4b0075b27d0dde0e773e3fd991b262

SHA256
11f4577047bbeb368621d527d60acd26800f18a5277eed09f5c3cbdd83852922

SHA512
bdb499300a48daafffa243acb849ed9fbb7d526b7e506574500a717d39ea8cfb0a949ce4883d5b777e78592a23d5d6624e4ec968b14ce2e31298ea35a31d6f40

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
64KB

MD5
37808cc9743a1e9e5fb3b7e89ce8dde4

SHA1
a81157cd53d7efaefc9687d6727bf5f0e442ff11

SHA256
660d9475321eae529839f9f071ecf4b970feec8c9474414096b564094eac4e56

SHA512
7eee5a65d4981ec9436bfefefaf13176bbda15d57a0e78a5c7934d1aeaab33c4c32ff6b1673bee453237972ca70540cc176c425eed57bd7a595cfbb919eff674

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
440KB

MD5
9f81e1e5dc4d24c4f048be7f4bd1881b

SHA1
0f24964e2dde79e6e46b474f53f1756150061a7a

SHA256
cd0a1070d8e39ff10d4da11dc3d345c5a15061f6cbdf306bd9f7de2243fa1e8a

SHA512
1b09ec7b5184d46c9b4e7eb17bcf389af5d07e9279833df968edcf3a7435b7a1797b17d38f03887b3fe33102ccd965be1a7f2f5e655a7b2f4d3554a703b254da

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
440KB

MD5
fe3fc650899cd27eeec3c461b9acd166

SHA1
1e946bc8273b65e5328ce68c3fc2a8c0ffdd0862

SHA256
76d296bd0bc39ba4ca15528f584dd48d0e73a7676d5212be323b1b9199361409

SHA512
29572d553dda1c0cd8bca249b7580eb6263c709ab43ab4255d6a3a19a22a45b5ee6f7db3d19fe0aea234507e655151fac3993ad27c25175f2e23e20e4a768613

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
440KB

MD5
50b495205b89702c5f5ce327bd503f02

SHA1
9739c894f872777ef8503de5649edeeb75d3b0de

SHA256
41e324943c9b0d51f65d040777cbfe5d7e124a519ebd79e0b59737d4cf7afb71

SHA512
f705129e402fe7826b9e936df40c79d6ecb1cf093d92c888ca21f6c66eea7fe1537cd4b0411023697c476b9db46f9573e8e6596e831df3eb5b550a4f7be7bbd7

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
440KB

MD5
2cbf8e4de10c5915fe8f850adb0a9ed1

SHA1
a7487f1f9f73b51d7796cc9a671b4d6d293865e7

SHA256
745e1f058dbb8f7e4ebe9e7cd900e81ae35215bbc7d207cf00e23ca9a9768721

SHA512
a9d50a77025f0076cebfb2b78fa441af94ef93a9a8f63824b513793fad0ceff1381c31618e2e6f92416596a20b0650a816bc1ae86da1f0e94f870cdb2f1abf2c

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
440KB

MD5
11b933b53f2ab2572c93f5436d166278

SHA1
23ca4fb7f0ac452e8f4d5379697b73508f2b91f5

SHA256
987aaad77d1be51068594ca7d4cea903cca0839ab4b72ace724445442039ffbc

SHA512
737fd44f17a95ba6b4fbb9c044f8bd264c0f19ccaee0620bb4ce790c9c0880bababb3920aba3b994202fe1f88ca6be2bade4f534da73ee6c003117998c013fd9

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
440KB

MD5
9adf914210f5bebd89f48d93eaf55c7b

SHA1
12a80decb4ce2d5de31ead4438c741338320f87b

SHA256
53f5b0142c9c7130c9b19a1d7255e17db63ab0e7d789542d0ed3fc8f6d593c73

SHA512
f646a4d6b65faab3fc33621b7b35f5645409d8a5532218b8ea7cea2f245151ea1eabd58a1ed12225b620939c6dde04c03403e885f039d9b5ed2bba667b517fcf

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
440KB

MD5
29f0b93a55fca960f5df038fc58415d3

SHA1
e1120b815bb39d86c88df3ff87240b4cdc4661aa

SHA256
3528951dbf00fab94630e4e05112fec3192aae5bcb35e96adbb7994f768043ed

SHA512
48d80a2783e2ea1a99cb60fb111e5de294a3cdaac11332b31869539b64ce5c958d66f71f65b8cc7d14a38121f040eb9f6b9c121f799ea7ac57fc50f878efecf7

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
440KB

MD5
ca04941ddb9ab4b176b5ead4af3999e4

SHA1
2cbe767bbc05fe876b17e9629dfc222e70400ccd

SHA256
05afb5f2de66f9811b3aaa7133b38dc4628808f5e9fa9bee8f96906ceb04df17

SHA512
62024db7eb74a43fbbac1478af44341a50d86c7bea80ead4c878afe3b7802b9b74006d3fd27df1db5586875f9a803d3f0516f6f1535f8043723624fb5c161cfc

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
440KB

MD5
cc7a757def38efac8e01e1638553e377

SHA1
8ac37d674a65d2f785ecd1e2e60a958499483cf8

SHA256
9529a8d57a6120fc4692cfb88ab58e1b5a8bcee9d6317fd2c416b6f1cdf557c5

SHA512
8cb4ed6175cbe92c61f9d011f0a9ae4a49c7de5069f1e21e93555e33efee48922958d1d30a4a1665a022d6ba8ecf04badda38d0c36d8456aa4cbd2c52d7826aa

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
440KB

MD5
9933f17f08eb2f2ab838f119b0fe433c

SHA1
8102f223b26fa8a7630d3e393a1c787ab6ab541c

SHA256
a47ef8f73894cab746f35a8e3d19ef450854c6fa8712234d432f9894ae7f06f7

SHA512
5769cf1ead9114b32e196eeb6fec9efedf038be3fb54551fd538a6d08c515eea347b9fae6e4835cc30157c2fad6435a1eb9989d7983d1f2fcf0cff8f36536531

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
440KB

MD5
a99c0c022e684f4e4ebb20955439c3ed

SHA1
8957c171a047df5ffab3d3dbad5e1d7de7a85d54

SHA256
edc0290451e561f0df9c16f5cba5981eca38325f373e40eb65036f0c4c63b615

SHA512
c25da864be0f6a648fec8af8affb4f9b824afeeeda27a194d4ed6e6a97786a648fa3c8893b6e622293b410d027e2301742e2c963dd5c17a29b3a7caa264cbde5

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
440KB

MD5
449e99774ae560910931497dd310cd37

SHA1
83ee28b159dae9e8d971b1dca1614009c9c4e5ba

SHA256
2638a2dbba3c2cbaf31f8ee551092e6e1b59af7d07717eca084fbd49f3f4b979

SHA512
babc554a9fa9e56a1287b7f2a7281689e0a3f84a75b5e6b353dd1bcbf96d5e838e419ffcf0051501683b63e689836e6fba43357a2269bebf2d9c43ccf44aeedc

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
440KB

MD5
224b2734e2d6815ddb36d1cc7bbd3de8

SHA1
775d7b87090f88c0240714ca993741ff512ca636

SHA256
13844020e172fd7679cd1b0aeca144cd137566f62de15351cedf8ecdb18e9b83

SHA512
4d80b3d43abe71258837f3668edd55c382d85d77bc885724329772c63570399902e144e3e37bc7fd4ea70e616f93884ba79b74f834131ddc78ea71439089d457

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
440KB

MD5
99335cfdbfdda27378c7989adffced40

SHA1
7a55ad2c36d0e087d08c6b459d3abb8ea87183ee

SHA256
8876ebb2a0f08ac78ac4ea380ed6b0ea1d80d28a141d4304cfdc5bdafdd944e5

SHA512
f2ec3d33539b255b187acc4b2a676122c334666ed28c62ae4ffc79049e0ecda361fdb215fe09192e543679227a3b09cd1c478e72f3f632460f01e9ba2ba531a0

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
440KB

MD5
e0ed9601d427d0ac19c39e1b0cee1d1a

SHA1
dc03213e4e4a96fb172c559dfd18224589f2ad07

SHA256
11d1c29dc6690d7b8b0220f4c2c275ae376edf278b3d1c7f50f3fb4bb49f3fe4

SHA512
6665c6dbaae7045cd60c1d784410899a56b2ab2b3e901a45d8d0f9d659a26f592a8566bbfdeb3e78e55b2022552dc641daa42b1e2076fb280b53edf7caff5f38

Download Submit
memory/228-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/540-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/784-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/988-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/992-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1132-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1204-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1752-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1804-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1908-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1916-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2088-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2292-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2340-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2856-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2956-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3056-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3656-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4252-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4500-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads