a98e58045839eb07e40438fb2af56ec77c31c3d1e9e52cde87e862fb852f54c2

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe
Size

55KB
MD5

f4b1816e21f37caf40965aba638543e3
SHA1

91cb76d68b31dc6b954b0cacae3ac138cc59f7cd
SHA256

a98e58045839eb07e40438fb2af56ec77c31c3d1e9e52cde87e862fb852f54c2
SHA512

bd10e904e21e9fedd2208d7a9b7877a684f7c1065a6a7cb6a63a974b9b6f437ff9c90eee37024b5bdcfd2ff72ba9dbf7310a808226a44fea6be51a8ad5d2c558
SSDEEP

768:jLoHVdCz0/1gIyS6D5D0wrrYHHHSvhiQxayZeTLnhCW6zX2p/1H5GZXdnh:jsCzK1jyJ5DHr7P0nhh6zX2Lm

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hninbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcndbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfnhfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqnjgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioopml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohjlgefb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkkeclfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdialdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehapfiem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooclapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqnkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfmolc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldamm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edoencdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnangaoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiphjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pedbahod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnbeeiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diccgfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fealin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feapkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfldelik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgclpkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkpheidp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkkjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahgad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooagno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhonib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkdliame.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcnpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khlklj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfhjkabi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcjiff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Felbnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfningai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ciafbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehkajig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qikgco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jddnfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgodhkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjcmebie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkconn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njjmni32.exe

Executes dropped EXE 64 IoCs

pid	Process
4636	Eoolbinc.exe
2852	Ehgqln32.exe
3176	Eoaihhlp.exe
740	Ehimanbq.exe
2236	Eocenh32.exe
976	Edpnfo32.exe
3580	Ekjfcipa.exe
4088	Eadopc32.exe
2280	Fcckif32.exe
2436	Fhqcam32.exe
2800	Fcfhof32.exe
4724	Fdgdgnbm.exe
2276	Fomhdg32.exe
3304	Ffgqqaip.exe
3064	Fckajehi.exe
3456	Ffimfqgm.exe
2344	Fbpnkama.exe
1244	Fhjfhl32.exe
492	Gdqgmmjb.exe
3984	Gfbploob.exe
3252	Gokdeeec.exe
3316	Gicinj32.exe
2520	Gomakdcp.exe
2944	Gfgjgo32.exe
2324	Hiefcj32.exe
4244	Hopnqdan.exe
1056	Hckjacjg.exe
3008	Hkfoeega.exe
3172	Hbpgbo32.exe
8	Hbbdholl.exe
3328	Hmhhehlb.exe
4516	Hcbpab32.exe
4580	Hmjdjgjo.exe
1616	Hcdmga32.exe
3292	Iefioj32.exe
892	Ikpaldog.exe
3816	Ibjjhn32.exe
3652	Iehfdi32.exe
2336	Ipnjab32.exe
3040	Iemppiab.exe
1492	Ipbdmaah.exe
2128	Iikhfg32.exe
4760	Jfoiokfb.exe
3576	Jmhale32.exe
4880	Jioaqfcc.exe
1692	Jbhfjljd.exe
1748	Jmmjgejj.exe
4160	Jmpgldhg.exe
4132	Jpnchp32.exe
4004	Jeklag32.exe
536	Kmdqgd32.exe
648	Kepelfam.exe
2916	Kdcbom32.exe
4044	Kdgljmcd.exe
5024	Lfhdlh32.exe
3980	Liimncmf.exe
2696	Lbabgh32.exe
4600	Lgokmgjm.exe
4444	Mgagbf32.exe
4348	Mibpda32.exe
2204	Mdhdajea.exe
1188	Mpoefk32.exe
432	Melnob32.exe
3416	Mdmnlj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fdfmlhna.exe	Fknicb32.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Giqkkf32.exe
File created	C:\Windows\SysWOW64\Fcplmmbl.dll	Nacmdf32.exe
File created	C:\Windows\SysWOW64\Dbcmakpl.exe	Dbndfl32.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Kcidmkpq.exe
File created	C:\Windows\SysWOW64\Ckgohf32.exe	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Adgbpc32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Eonehbjg.exe	Eggmge32.exe
File opened for modification	C:\Windows\SysWOW64\Jaajhb32.exe	Jhifomdj.exe
File created	C:\Windows\SysWOW64\Egcpgp32.dll	Mokfja32.exe
File opened for modification	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hcbpab32.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Oboijgbl.exe	Oldamm32.exe
File created	C:\Windows\SysWOW64\Bbdhiojo.exe	Bkkple32.exe
File created	C:\Windows\SysWOW64\Jhafck32.dll	Kgnbdh32.exe
File created	C:\Windows\SysWOW64\Fdgdgnbm.exe	Fcfhof32.exe
File created	C:\Windows\SysWOW64\Pcicklnn.exe	Pedbahod.exe
File opened for modification	C:\Windows\SysWOW64\Cjliajmo.exe	Cfqmpl32.exe
File created	C:\Windows\SysWOW64\Kmdlffhj.exe	Kkconn32.exe
File created	C:\Windows\SysWOW64\Badanigc.exe	Bnfihkqm.exe
File created	C:\Windows\SysWOW64\Mpaqbf32.dll	Hnnljj32.exe
File created	C:\Windows\SysWOW64\Ohfkgknc.dll	Mjggal32.exe
File created	C:\Windows\SysWOW64\Dhjckcgi.exe	Dapkni32.exe
File opened for modification	C:\Windows\SysWOW64\Faenpf32.exe	Fmjaphek.exe
File created	C:\Windows\SysWOW64\Ljhpog32.dll	Neqopnhb.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Afpjel32.exe
File created	C:\Windows\SysWOW64\Jgkdbacp.exe	Jdmgfedl.exe
File opened for modification	C:\Windows\SysWOW64\Maiccajf.exe	Mjokgg32.exe
File created	C:\Windows\SysWOW64\Bpnihiio.exe	Bmomlnjk.exe
File opened for modification	C:\Windows\SysWOW64\Hajpbckl.exe	Hnodaecc.exe
File opened for modification	C:\Windows\SysWOW64\Hhdhon32.exe	Hdilnojp.exe
File opened for modification	C:\Windows\SysWOW64\Oobfob32.exe	Ohhnbhok.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Kpccmhdg.exe	Khlklj32.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Qhonib32.exe	Qgnbaj32.exe
File created	C:\Windows\SysWOW64\Emeoooml.exe	Ekgbccni.exe
File created	C:\Windows\SysWOW64\Ohjlgefb.exe	Oghppm32.exe
File created	C:\Windows\SysWOW64\Jkdnhmdp.dll	Ocamjm32.exe
File created	C:\Windows\SysWOW64\Cobhcgin.dll	Mlkepaam.exe
File opened for modification	C:\Windows\SysWOW64\Lljklo32.exe	Kngkqbgl.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Hiefcj32.exe	Gfgjgo32.exe
File created	C:\Windows\SysWOW64\Eghpcp32.dll	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Bhhiemoj.exe	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Cpogkhnl.exe	Cdhffg32.exe
File opened for modification	C:\Windows\SysWOW64\Qgpogili.exe	Qhonib32.exe
File opened for modification	C:\Windows\SysWOW64\Llmhaold.exe	Ljnlecmp.exe
File opened for modification	C:\Windows\SysWOW64\Mfeeabda.exe	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Kcjjhdjb.exe	Kplmliko.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Iikhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Pedbahod.exe	Ohqbhdpj.exe
File opened for modification	C:\Windows\SysWOW64\Jcfggkac.exe	Jepjhg32.exe
File opened for modification	C:\Windows\SysWOW64\Pmkofa32.exe	Pbekii32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Djiono32.dll	Emjgim32.exe
File opened for modification	C:\Windows\SysWOW64\Kbnepe32.exe	Kldmckic.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Ejgcaq32.dll	Acgolj32.exe
File created	C:\Windows\SysWOW64\Jedohked.dll	Hjedffig.exe
File opened for modification	C:\Windows\SysWOW64\Jcmdaljn.exe	Ipoheakj.exe
File opened for modification	C:\Windows\SysWOW64\Gfgjgo32.exe	Gomakdcp.exe
File created	C:\Windows\SysWOW64\Ghkmacoj.dll	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Nmenca32.exe	Meiioonj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9644	3960	WerFault.exe	1030

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlppno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkeldnpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipdbmgdb.dll"	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfhjkabi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neimdg32.dll"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahffo32.dll"	Qlggjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojncj32.dll"	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iklgah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjnfdhk.dll"	Hedafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbeojmh.dll"	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifdaage.dll"	Micoed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcgmfg32.dll"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmbeqne.dll"	Mmkkmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhnikc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhnlkfpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enhpaj32.dll"	Gilapgqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnangaoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lllagh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cimcan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjblje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaidib32.dll"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpkkeen.dll"	Babcil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jedohked.dll"	Hjedffig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdgmickl.dll"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocgeag32.dll"	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcglo32.dll"	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfjnjcni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajndioga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfngdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbecoe32.dll"	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acankf32.dll"	Dkekjdck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilkoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diadam32.dll"	Ledepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhcmal32.dll"	Mcoljagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neqhhf32.dll"	Dbcmakpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckdpoji.dll"	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfpcgbim.dll"	Kcndbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhqcam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqjbohhg.dll"	Eajeon32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4636	4616	f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe	85
PID 4616 wrote to memory of 4636	4616	f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe	85
PID 4616 wrote to memory of 4636	4616	f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe	85
PID 4636 wrote to memory of 2852	4636	Eoolbinc.exe	86
PID 4636 wrote to memory of 2852	4636	Eoolbinc.exe	86
PID 4636 wrote to memory of 2852	4636	Eoolbinc.exe	86
PID 2852 wrote to memory of 3176	2852	Ehgqln32.exe	87
PID 2852 wrote to memory of 3176	2852	Ehgqln32.exe	87
PID 2852 wrote to memory of 3176	2852	Ehgqln32.exe	87
PID 3176 wrote to memory of 740	3176	Eoaihhlp.exe	88
PID 3176 wrote to memory of 740	3176	Eoaihhlp.exe	88
PID 3176 wrote to memory of 740	3176	Eoaihhlp.exe	88
PID 740 wrote to memory of 2236	740	Ehimanbq.exe	89
PID 740 wrote to memory of 2236	740	Ehimanbq.exe	89
PID 740 wrote to memory of 2236	740	Ehimanbq.exe	89
PID 2236 wrote to memory of 976	2236	Eocenh32.exe	90
PID 2236 wrote to memory of 976	2236	Eocenh32.exe	90
PID 2236 wrote to memory of 976	2236	Eocenh32.exe	90
PID 976 wrote to memory of 3580	976	Edpnfo32.exe	91
PID 976 wrote to memory of 3580	976	Edpnfo32.exe	91
PID 976 wrote to memory of 3580	976	Edpnfo32.exe	91
PID 3580 wrote to memory of 4088	3580	Ekjfcipa.exe	92
PID 3580 wrote to memory of 4088	3580	Ekjfcipa.exe	92
PID 3580 wrote to memory of 4088	3580	Ekjfcipa.exe	92
PID 4088 wrote to memory of 2280	4088	Eadopc32.exe	93
PID 4088 wrote to memory of 2280	4088	Eadopc32.exe	93
PID 4088 wrote to memory of 2280	4088	Eadopc32.exe	93
PID 2280 wrote to memory of 2436	2280	Fcckif32.exe	94
PID 2280 wrote to memory of 2436	2280	Fcckif32.exe	94
PID 2280 wrote to memory of 2436	2280	Fcckif32.exe	94
PID 2436 wrote to memory of 2800	2436	Fhqcam32.exe	95
PID 2436 wrote to memory of 2800	2436	Fhqcam32.exe	95
PID 2436 wrote to memory of 2800	2436	Fhqcam32.exe	95
PID 2800 wrote to memory of 4724	2800	Fcfhof32.exe	96
PID 2800 wrote to memory of 4724	2800	Fcfhof32.exe	96
PID 2800 wrote to memory of 4724	2800	Fcfhof32.exe	96
PID 4724 wrote to memory of 2276	4724	Fdgdgnbm.exe	97
PID 4724 wrote to memory of 2276	4724	Fdgdgnbm.exe	97
PID 4724 wrote to memory of 2276	4724	Fdgdgnbm.exe	97
PID 2276 wrote to memory of 3304	2276	Fomhdg32.exe	98
PID 2276 wrote to memory of 3304	2276	Fomhdg32.exe	98
PID 2276 wrote to memory of 3304	2276	Fomhdg32.exe	98
PID 3304 wrote to memory of 3064	3304	Ffgqqaip.exe	99
PID 3304 wrote to memory of 3064	3304	Ffgqqaip.exe	99
PID 3304 wrote to memory of 3064	3304	Ffgqqaip.exe	99
PID 3064 wrote to memory of 3456	3064	Fckajehi.exe	100
PID 3064 wrote to memory of 3456	3064	Fckajehi.exe	100
PID 3064 wrote to memory of 3456	3064	Fckajehi.exe	100
PID 3456 wrote to memory of 2344	3456	Ffimfqgm.exe	101
PID 3456 wrote to memory of 2344	3456	Ffimfqgm.exe	101
PID 3456 wrote to memory of 2344	3456	Ffimfqgm.exe	101
PID 2344 wrote to memory of 1244	2344	Fbpnkama.exe	102
PID 2344 wrote to memory of 1244	2344	Fbpnkama.exe	102
PID 2344 wrote to memory of 1244	2344	Fbpnkama.exe	102
PID 1244 wrote to memory of 492	1244	Fhjfhl32.exe	103
PID 1244 wrote to memory of 492	1244	Fhjfhl32.exe	103
PID 1244 wrote to memory of 492	1244	Fhjfhl32.exe	103
PID 492 wrote to memory of 3984	492	Gdqgmmjb.exe	104
PID 492 wrote to memory of 3984	492	Gdqgmmjb.exe	104
PID 492 wrote to memory of 3984	492	Gdqgmmjb.exe	104
PID 3984 wrote to memory of 3252	3984	Gfbploob.exe	105
PID 3984 wrote to memory of 3252	3984	Gfbploob.exe	105
PID 3984 wrote to memory of 3252	3984	Gfbploob.exe	105
PID 3252 wrote to memory of 3316	3252	Gokdeeec.exe	106

C:\Users\Admin\AppData\Local\Temp\f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4b1816e21f37caf40965aba638543e3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\Eoolbinc.exe
  C:\Windows\system32\Eoolbinc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\Ehgqln32.exe
    C:\Windows\system32\Ehgqln32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\Eoaihhlp.exe
      C:\Windows\system32\Eoaihhlp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:492
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        23⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2520
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2944
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        26⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        27⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        28⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        29⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        30⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        31⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        32⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        35⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        36⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:892
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        39⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        40⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        41⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        44⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        45⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        46⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        47⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        49⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        50⤵
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        51⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        52⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        53⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        54⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        56⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        58⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        59⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        61⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1188
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        64⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        65⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        66⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        67⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        68⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        69⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4744
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        71⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        72⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        74⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        75⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        76⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        77⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        78⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        79⤵
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        80⤵
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        81⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        82⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        83⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        84⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        85⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        86⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        87⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        88⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        89⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        90⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        91⤵
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        92⤵
        Drops file in System32 directory
        
        PID:3028
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        93⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        94⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        95⤵
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        96⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        97⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        98⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        99⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        100⤵
        Drops file in System32 directory
        
        PID:700
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        101⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        102⤵
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        103⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        104⤵
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        105⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        106⤵
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        107⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        108⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        109⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        110⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        111⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        112⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        113⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        114⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        115⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        116⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        117⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        118⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        119⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        120⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        121⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        122⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        123⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        124⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        125⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        126⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        127⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        128⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        130⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        132⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        133⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        134⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        135⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        136⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        137⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        138⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        139⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        140⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        141⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        142⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        143⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        144⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        147⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        148⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        149⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        150⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        151⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        152⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        153⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        154⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        155⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        156⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        157⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        158⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        159⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        160⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        161⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        162⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        163⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        164⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        165⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        166⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        167⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        168⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        170⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        172⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        173⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        174⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        176⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        177⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        178⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        179⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        180⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        181⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        182⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        183⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        184⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        185⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        186⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        187⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        188⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        190⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        191⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        192⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        193⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        194⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        195⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        196⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        197⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        198⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        199⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        200⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        201⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        202⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        203⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        204⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        205⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        206⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        207⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        208⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        209⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        210⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        211⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        212⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        213⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        214⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        215⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        216⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        217⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        218⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        220⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3620
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        223⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        224⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        225⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        226⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        228⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        229⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        230⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        231⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        232⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        233⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        234⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        235⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        236⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        238⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        239⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        240⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        241⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        242⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        243⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        244⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        245⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        246⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        247⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        248⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        249⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        250⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        252⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        253⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        254⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        255⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        256⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        257⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        258⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        259⤵
        Modifies registry class
        
        PID:8000
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        260⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        261⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        262⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        263⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        264⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        266⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        267⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        268⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        270⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        271⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        272⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        273⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        274⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        275⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        276⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        277⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        278⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        279⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        280⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        281⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        282⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        283⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        284⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        285⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        286⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        287⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        288⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        289⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        290⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        292⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        293⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        294⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        295⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        296⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        297⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        298⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        299⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        300⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        301⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        302⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        303⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        304⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        305⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        306⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        307⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8396
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8440
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        310⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        312⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        313⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        314⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        315⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        316⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        317⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        318⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        319⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        320⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        321⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        322⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        323⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        324⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        325⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        326⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        327⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        328⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        329⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        330⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        331⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        332⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        333⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        334⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        335⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        336⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        337⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        338⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        339⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        340⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        341⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        342⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        343⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        344⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        345⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        346⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        347⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        348⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        349⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        350⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        351⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        352⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        353⤵
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        354⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        355⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        356⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        357⤵
        Drops file in System32 directory
        
        PID:9156
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        358⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        359⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        360⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        361⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        362⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        363⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        364⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        365⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        366⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        367⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        369⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        370⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        371⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        372⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        373⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        374⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        375⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        377⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        378⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        379⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        380⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        381⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9856
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        383⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        384⤵
        Modifies registry class
        
        PID:9944
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        385⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        386⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        387⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        388⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        389⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        390⤵
        Modifies registry class
        
        PID:10196
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        391⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        392⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        393⤵
        Modifies registry class
        
        PID:9344
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        394⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        395⤵
        Drops file in System32 directory
        
        PID:9476
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        396⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        397⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        398⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        399⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        400⤵
        Modifies registry class
        
        PID:9804
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        401⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        402⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        403⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        404⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10184
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        406⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        407⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        408⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        409⤵
        Drops file in System32 directory
        
        PID:9668
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        410⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        411⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        412⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        413⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        414⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        416⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        417⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        418⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9564
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        420⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        421⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        422⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        423⤵
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        426⤵
        Modifies registry class
        
        PID:10340
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        427⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        428⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        429⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        430⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        431⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        432⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        433⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        434⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        435⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        436⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        437⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        438⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        439⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        440⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        441⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        442⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        443⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        444⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        445⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        446⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        447⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        448⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        449⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        450⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        451⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        452⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        453⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        454⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        455⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        456⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        457⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        458⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        459⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        460⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        462⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        463⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        464⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        465⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        466⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        467⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        468⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        469⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        470⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        471⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        472⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4736
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        474⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        475⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        476⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        477⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        478⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        479⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        480⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        481⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        482⤵
        
        PID:708
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        483⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        484⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        485⤵
        Drops file in System32 directory
        
        PID:10672
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        486⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        487⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        488⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        489⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        490⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        491⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        492⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        493⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        494⤵
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10336
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        496⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        497⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        498⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        499⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        501⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        502⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        504⤵
        Modifies registry class
        
        PID:10948
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        505⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        506⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        507⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        508⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        509⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        510⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        511⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        512⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        513⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        514⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        515⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        516⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        517⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11116
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        519⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        520⤵
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        521⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        522⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        523⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        524⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        525⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        526⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        527⤵
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        528⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        529⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        530⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        531⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:960
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        533⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        534⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        535⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        536⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        537⤵
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        538⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        539⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        540⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        541⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        542⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        543⤵
        Drops file in System32 directory
        
        PID:872
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        544⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        545⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        546⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        547⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        548⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        549⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        550⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        551⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        552⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        553⤵
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        554⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        555⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        556⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        557⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        558⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        559⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        560⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        561⤵
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        562⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        563⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        564⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        565⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        566⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        567⤵
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        568⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        569⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        570⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        571⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        572⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        573⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        574⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        575⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        576⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        577⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        578⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        579⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        580⤵
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        581⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        582⤵
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        583⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3220
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        584⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        585⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        586⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        587⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        588⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        589⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        590⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        591⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        592⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        593⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5112
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        595⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        596⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        597⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        598⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        599⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5476
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        601⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        602⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        603⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        604⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        605⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        606⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        607⤵
        Drops file in System32 directory
        
        PID:4196
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        608⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        609⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        610⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        611⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        612⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        614⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        615⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        617⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        618⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        619⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        620⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        621⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        622⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        623⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        624⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        625⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        626⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        627⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        628⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        629⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        630⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        631⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        632⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        633⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        634⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        635⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        636⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        637⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        638⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        639⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        640⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        641⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        642⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        643⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        644⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        645⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        646⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        647⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        648⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        649⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        650⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        651⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        652⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        653⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        654⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        655⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        656⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        657⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        658⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        659⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        660⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        661⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        662⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        663⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        664⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        665⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        666⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        667⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        668⤵
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        669⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        670⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        671⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        672⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        673⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        674⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        675⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        676⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        677⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        678⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        679⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        680⤵
        Drops file in System32 directory
        
        PID:344
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        681⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        682⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        683⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        684⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        685⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        686⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        687⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11344
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        688⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        689⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        690⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        691⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        692⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        693⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11620
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        694⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11688
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        695⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        696⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        697⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        698⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        699⤵
        Modifies registry class
        
        PID:11936
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        700⤵
        Modifies registry class
        
        PID:11976
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        701⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        702⤵
        Drops file in System32 directory
        
        PID:12084
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        703⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        704⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        705⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        706⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        707⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        708⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11332
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        709⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        710⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        711⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        712⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        713⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        714⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        715⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        716⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        717⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        718⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        719⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        720⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        721⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        722⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        723⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        724⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        725⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        726⤵
        Modifies registry class
        
        PID:12268
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        727⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        728⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        729⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        730⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        731⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        732⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        733⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        734⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        735⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        736⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        737⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        738⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        739⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        740⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        741⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        742⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        743⤵
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        744⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        745⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        746⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        747⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        748⤵
        Drops file in System32 directory
        
        PID:11588
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        749⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        750⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        751⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        752⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        753⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        754⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        755⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        756⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        757⤵
        Drops file in System32 directory
        
        PID:12036
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        758⤵
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        759⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        760⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        761⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        762⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        763⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        764⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        765⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        766⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        767⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        768⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        769⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        770⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        771⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        772⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        773⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        774⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        775⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        776⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        777⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        778⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        779⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        780⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        781⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        782⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        783⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        784⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        785⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        786⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        787⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        788⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        789⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        790⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        791⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        792⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        793⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        794⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        795⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        796⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        797⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        798⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12068
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        799⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        800⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        801⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        802⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        803⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        804⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        805⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        806⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        807⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        808⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        809⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        810⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        811⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        812⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        813⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        814⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        815⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        816⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        817⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        818⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        819⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        820⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        821⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        822⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        823⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        824⤵
        Drops file in System32 directory
        
        PID:7636
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        825⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        826⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        827⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        828⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        829⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        830⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        831⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        832⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        833⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        834⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        835⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        836⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        837⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        838⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        839⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        840⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        841⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        842⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        843⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        844⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        845⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        846⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        847⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        848⤵
        Modifies registry class
        
        PID:8132
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        849⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        850⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        851⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        852⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        853⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        854⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        855⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        856⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8236
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        857⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8944
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        858⤵
        Drops file in System32 directory
        
        PID:9004
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        859⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        860⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        861⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        862⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        863⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        864⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        865⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        866⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        867⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        868⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        869⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        870⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        871⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        872⤵
        Modifies registry class
        
        PID:8388
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        873⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        874⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        875⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        876⤵
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        877⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        878⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        879⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        880⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        881⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        882⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        883⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        884⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        885⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        886⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        887⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        888⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        889⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        890⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        891⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        892⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        893⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        894⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        895⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        896⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        897⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        898⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        899⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        900⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        901⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        902⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8548
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        903⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        904⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        905⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        906⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        907⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        908⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        909⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        910⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        911⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        912⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        913⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        914⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        915⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        916⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        917⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        918⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        919⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        920⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        921⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        922⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10048
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        923⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        924⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        925⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        926⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        927⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        928⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        929⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        930⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        931⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        932⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        933⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        934⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        935⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        936⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        937⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        938⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        939⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        940⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        941⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        942⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        943⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        944⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 400
        945⤵
        Program crash
        
        PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3960 -ip 3960
1⤵
PID:10100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acgolj32.exe

Filesize
55KB

MD5
5f8a88313a55fa20da6554e38faeb883

SHA1
99acdffde6b56714c23bd48744d9bc3c9fb08d8e

SHA256
1bc7afc7e4e10b4ecfc3af5af91a246289b97bd78c14f5a5b187ce49e53ace81

SHA512
af9f1374432f4b6e921884f5802a7f958fc0cb19f5939b815a16ac254552a4584d5c0faa6f5370f6855276fd9c90ca3cc8882a71b5c59e06e33a455d44e7e439

Download Submit
C:\Windows\SysWOW64\Ajpqnneo.exe

Filesize
55KB

MD5
69e26f8e65ea43ea456e4eabe36a82e1

SHA1
6a4d5de0b0aa032d691daf424195c13239461bbb

SHA256
7db8cd2c283e53badd7c7c1413de3aa20af243e2a7fac6934d916dbca7600da6

SHA512
46bf450c9bab71b265eec1641e0dcd564f87ef85c21f7a17a800c7a0a1ee4b3d7985367d70a358fdd69cd034199418be24eed7b0e4e6e31ce4bd6999e97abf38

Download Submit
C:\Windows\SysWOW64\Amcmpodi.exe

Filesize
55KB

MD5
564b88d86dffa652446322686ec06ee0

SHA1
bde66d6042aa117f5b2e460e446bf7a16eeaf42a

SHA256
0baac6af4919fa7858b04791950fdfb0d46b8fca487e96783e6972469a1917f7

SHA512
0c9b30a6804f811b53ad4e0083e2a04f7c8a743596968bbbfd4a619ace9273da860467997cdec0f85a7bc46d98fefa46d279f9a2933dacd4b76df3e9d04fef48

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
55KB

MD5
56bd5ef93166aa03030c0f0b611fdca4

SHA1
2ec0c6fcff1d0b2729bea72974d5934df2d15c92

SHA256
12ad5635a2676de81d7e2773aded4833dcd0451c3cc4b577ee7f8aca9146b9a5

SHA512
ed26c83b7a4282aafd7d38c9e0c219e7781bf7cff08d4ba176af5aa669eea79e82a3119baf5efda183075e955874fa4ad780e25ea23ce2ac46bbbcc8c749b4d5

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
55KB

MD5
ed012e140b4b4e0884891e8b3fc178fe

SHA1
0f7b6016acc069f05f894dc2fbce1b69887fc127

SHA256
e555bb3a0e6654e3f3683d504c00278adaddee60e330a2bffb47220516505652

SHA512
124f88e98e813fed5e30b3383b920acfdaaea57b3f781a62f8a68c9d5b1a5f733a1889681d40c39997c8872db386f5d195892f2dfb8466a0b82ee8f7d1322a73

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
55KB

MD5
d6029084f439cacb521387ccdc3c80ca

SHA1
493ebe4a9acf963a3a76f2e09cbba7a40b22ee58

SHA256
3b65fc6ad99864265fd86f76f445f86a61e459b63cdbe72e9dde0fe02c1d41d8

SHA512
42ba5aafbe5cd21320fa943af77bdf59d47504d5351e793fec3aa7bd5163bbc5ff3cf7023db93e21030160d6eb2922d96be44de148f366671f588866ff614774

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
55KB

MD5
ec1cfa6f033631b650b0a38ce9eb4b64

SHA1
7058e7402601ba21faa48cf73d279839a0bb80b1

SHA256
694429b01f2894c976fe7549f38dc067e655d370c2f8fae320419bd255c96b7f

SHA512
0cb75f76212dfe386fd318e72f07804edca5dfac0b6f1b4b01c1a3ad90b46b0dba6de330886a2b2dfe0d9c23458a5b52add40f2cc548f3c69cdbfa5c01c6d4c3

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
55KB

MD5
1fd9e362eda14f4d48e2014f7585c716

SHA1
ad9bb804e357dbeee8c3a7a9456de293072673cf

SHA256
85cf4d988278f43269f190dd17eac0190b4664036e1cdd06d59450c92bf90d9b

SHA512
83a59e56ad78290b2a7d021c6480abea4882db0a1e860ecfe3eabea1cace1298b96a0f67d9d19018a19444726f675edcfc5e0fea10121ffde7d765051c3c390c

Download Submit
C:\Windows\SysWOW64\Edpnfo32.exe

Filesize
55KB

MD5
5cb077659344f3a84ed6233e0667508b

SHA1
9a29343f3d1e80661d12f414e7831481815e198d

SHA256
222d0a34e9710842298a377da5ab3f4f75d7765d5f60bc49714c8937f66011dc

SHA512
ad9302bc1bc99754a6f1f6d2f38a2e98c5946b4285b2aacebc51bb9b74eaed0264853cc4e1513f8634789baf99fae161e925ab561aa53b0655e9498950a2d1d0

Download Submit
C:\Windows\SysWOW64\Ehgqln32.exe

Filesize
55KB

MD5
1f0789a532b9c365fa3dd456e87665e8

SHA1
173e9f83812e07a2d94a30ab82e5f2d68fbffef4

SHA256
886bc0e71c00b583c685a282fb92b5c8dd9a2c7943a312b8a85418762476c48b

SHA512
21f41b39c365485c6b4c5699c9ffe26b32cedb9436811746221cf2f1e523b5984aeab50e54582991a5034c7d5a0229c2cb7b8bcec5d7f51f4248dd1336bc8691

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
55KB

MD5
f37a7f34f3b50aabfb34b370d81c23c0

SHA1
234cad5429c21c24b303c4a66eb3ddec27c6f570

SHA256
f14361eaf55d55f8cfe66eb3684f77322af725c1b13f8fafa6119740f1bd9ba0

SHA512
064475355a8d7c252f8dc8c21f3b2759fcc0188f54b87c316455658921bb1ab08de81ff2d3e08453eae8cd6ddebba3b0dc690f73ee7ea53337db77a95a2a4f18

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
55KB

MD5
c0d72df3abf57765a05dff2fac796909

SHA1
e852507c6c88bb8a62406e99214cb2178a236944

SHA256
eeb6a05a345f21c97709cd4882f29ab3d5284763a008a36ad8e091c36dbc98a8

SHA512
04494eb7f31cfd6bedbac15499c7df67c0cdc59d29e8cb3d238408301431f19c763284a581c8d292f5e70c924e9320613c3aaea87611a0a0b2b7f095d3138b8c

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
55KB

MD5
14be4b4dbdf45511274e112747eac665

SHA1
544d641bae93a0971e3b401fbcce56599c2350f4

SHA256
c8d680ef286b2cd50f8ea8a7cee8873ec142d1a709054813b04537ae6e9d9696

SHA512
50b989b79f31c2c422386b79dff9759d20cfbedca0a5a0969ff762e171c124298a59ea39aca9c34d8efb5542a8d7c7b90649cbf6ca5ea459df7b4b8c78afb6d4

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
55KB

MD5
4bbba8c0a742c518daf84461e53afc75

SHA1
1e20d3252f3a17c42c613b069d56a8805fead76d

SHA256
9fb03de39c28ed0211cd9b5b0942869bc5c96879e81d08203baa28b44bb5409a

SHA512
b8dc9e64d97d34d23ca1e0b3b5603a85209ac994eba23c35c6ec50aefca07fdff4ce635ae881f227c661482e6a2509c2eb2deab645bde447f02b533c16a601a2

Download Submit
C:\Windows\SysWOW64\Eoolbinc.exe

Filesize
55KB

MD5
4b2435cfa4a51ac87ca3f37363a82115

SHA1
8e89a58ae82529fc2fc06d1f6c08d8c52d78238f

SHA256
6f0111e0abf6374056e2f9f5d0d622fcf1a7ecebf45fee610229a4570798fcc1

SHA512
a1ded15089c2c15d60b2bd6c401e15c46a45a8b7a0833ba5ea0b2d546e74703b9479772d70ab3dc7e5e978f2fc109ea2b10b9f9dc4e91e8313bd384a5c496dc3

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
55KB

MD5
dc2671866674b1b3551d6ab51744692c

SHA1
62345d403e854bbc9302ab32934336fc33408cfc

SHA256
0d6fbe868679fe544f7af798c2c5f327c04c43cf44ec4606c14420df0ee3af92

SHA512
bef778d70dfa2320201a69313a983e1ccc65488f22db328a891a777a27d18f99d878789a25cbd68f20e2646b410f703c63dffae73c83a8c6f416fe90f7c3d836

Download Submit
C:\Windows\SysWOW64\Fbpnkama.exe

Filesize
55KB

MD5
5d23a6dfbb0e713c3d01a4db0464d9c5

SHA1
c72924ca94c931d7a8a39cc2732d7e83307d6b56

SHA256
1384a004785f647c2be2a5032fabadf16fd0ca75f65f6947cea1894c1610442a

SHA512
55a3ea1f27a3e040741eca5c03c4b5a1f9a21a7b9218431f3c2e5e1a8dcb0e890c672f638700f7e3c0e0bb3136b18044d42b821aaceb9b3f49b37d3bc0183589

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
55KB

MD5
ed7981fc9f96e852fd421a44a9c61f92

SHA1
db842e3199ab0503e763010739012f3a3e607378

SHA256
d88538f6e06574cbf5ca75df17975e498f2f58b16339fd36b2903de3255bd8f4

SHA512
38a7c888d94b308e0d7b13875cb1c07ade19f486b33457ac195148a95697373d5c64115d99382a7ceb60d7d4f75e1b0508427fece9e7190646141d3e975ba816

Download Submit
C:\Windows\SysWOW64\Fcfhof32.exe

Filesize
55KB

MD5
00c0d10ffc704fb0ada61ceec7a1a960

SHA1
4905815d2ddc2c716c4c5484e99d9fb8665d9599

SHA256
3e53a7f06860524038185d2c12c0fdfc3e626bdcdc454bbc701f33cf3c247b4f

SHA512
cf6d372cdea6ad3cfd19643898162516194ba8eb09c7626325545f8b0396d09bb21ce2d1c4fbdaa97d00bf77f212a16c311b5c53af28c8305843a03fe5518692

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
55KB

MD5
1eb5610f73e5b2bb7cfa6f8b861686fc

SHA1
9f56d23046a88e41c9df388832016b943b529c6f

SHA256
d9dfdd0acc114cbcff655071b8b99f6a01dc7deb8abf41baac81ed8276ca8905

SHA512
74c8e50ced1664744b2dd9f12a9302bf53c150af94dea2d4e9fc3367d0a15594e397e8d76c7d780003001080ea4289277e664ad9226765dd80e88e22ad331e38

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
55KB

MD5
e30141132817e16b3681cf1e871d5786

SHA1
4241bbb67312af02fc9df4d34f6d0c323929f9dc

SHA256
11d18905ad2df5d3951dc8182d7935885ae8e40bbf1d2e88ec71760b9409e436

SHA512
c47db1935d720f6010b3aea7441e072908a48c38b18df779363dbe3c27adaabb002136c71898506662800fb37af9d94a4d4c83770d6add76d11adc8cf4adf986

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
55KB

MD5
d998ecb43c8e34a107457e5fb3135ea1

SHA1
66119d24b378095e1b2f004f4e80e2812f836560

SHA256
1fc10b507e065895aeeeed20d79e2660f30047b8c6930f83130fa5650fb47e71

SHA512
ccef9564a09ce3f4870c75c1058a680fb535b88e9844720cbea9e431b5223aeab91b5a88c8e34ed519ce12c59cf08bf436a8fffb25a82d8b9fa13d8193e17103

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
55KB

MD5
a25459c9469f925c62c39912e366b787

SHA1
98a4dad559d2aab0a1831ed0495e068cd4aa772e

SHA256
c1a913d632e8e7e024a09d39e2f3f2d7267b61959bc0491cb55fa129f39a3c59

SHA512
27f3ac0c207f872c985852644fc132efc64bbc1c8c9d1cf9cfa2109f8c387678f021b6c5a1cb18510e6ab1407c6c755446df6d70d271f1493e395c753cbd5860

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
55KB

MD5
a9d3ae0666399518249eaaf1453998fb

SHA1
d73a8e5530c9fa484a86343179587ab6568fdc03

SHA256
dd72045df4bdd3f2953c4ffbf6abbf2b50dd912a94a58c71ab10ae6187836a1d

SHA512
b32d4a455c1043d3d02422c481dde9b5a67301d63279fdb18a1accc266f1a53d6d8782fd82ebbbb7fcaf88f9c9792b7fc092eefa80bb6abf5a33e38addc99626

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
55KB

MD5
4d24afbe0393b892b8ddc64413562907

SHA1
2bf8e9b9f3c20050cca6e5e6259ace75111c0d55

SHA256
bb67206250292337b80e0a835f42337e65fe0bf49c959be26f94c60c36c2b572

SHA512
a21c0adb94a7114625188fd96fbaceaaa5df99bd5fddf9baaa086fbb21fdde0586f3731c96d878ac1241a9fd86ce50934f5b87d2a79a6bb9db26811dc1c2d1fc

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
55KB

MD5
100244e81a6dab69299188ee1d7eddf3

SHA1
d756fcbe51610cad99d90e1f7cdd013341de20f1

SHA256
bbe36015051cc0426e9917931cde3f68eddf48f34b8b66f4e48bd5357a5fa7de

SHA512
f03ffcb2510aa4e6612aa485882f22b764b5e8c2e90a4bc1fe5d7bfa657eeaa25df1f7ca78f0775487e541a8ec168edd7b8814499ac73f707f65713e7a9c4753

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
55KB

MD5
a291490704d22b4d69c74d896aafc3c6

SHA1
84ba9403f10155653ce50fa2bd8496c27dffc42f

SHA256
9a292cb66b5a01c2640b550e264bf6972931feff1d8f180af489790e0f4b92bc

SHA512
2e8c15f31adcbde51496b315871c6cff821d90db1094b5448151fae1b2f8e59000ab0c410c705bc3172bda9fa8013b385536dc531a8eeb820a6c18b05e28936a

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
55KB

MD5
bbb4497534647b8b4abc0a59d72b9821

SHA1
8b8977ac4f7720d7c1ea1923f303e1054502d7e9

SHA256
eaa2a7be69b77e017804d594ef15710dec69ff7df9f497f0306caa7d2258156f

SHA512
018234d396f0edd16933d3a9251af7ab5ecc31c91bdbf27e8b5310454c0e5decafe23a29073c9c6a92af071de5077eec216b625d4f893d251a84fe972086ee61

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
55KB

MD5
fed5a9aed378bed28f3043f0b141538c

SHA1
3672d14d922d7403b9f990b0268fcb0ee7cf38c6

SHA256
0607c506109895ffb3314aabba7922dc54a734bc221f4a176a805cef7a7c76d9

SHA512
3ce7e54d64f9ad3640efaf7d6f45f7c52ea4739708a03145387ce52ec9a3edf555d1e8ef162ee19279a871e6fd734a4ed26e7917d5c12aba8d889b8d10983842

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
55KB

MD5
dd4c7134ae09b8d97c65f2bc5b641ae8

SHA1
d7b558dd1c8a1852c56e0ce246ccb04f3abf1f9c

SHA256
5999af01a377857b14ea38347ad1986ddfa4123c04e12d71cc8eaa44b4b174f0

SHA512
b9e9e9f6a4a20359b9a74f421c8d4e0299d51907eaaf03edbf1f2195904b3f714e22e7a76630c4e7cbce8f3ea3b1da4c9302a335324668c462791cfbae5dfc7e

Download Submit
C:\Windows\SysWOW64\Gilapgqb.exe

Filesize
55KB

MD5
3ca2b8f7fec0ffc89e980cd01924188d

SHA1
e96c1653f56ebac71abb164fe3d52fcf951c3036

SHA256
f79a1cb067f3e93314b1b760e9f38ca0c9eac0eff3c12424899beae7da137cff

SHA512
9c17bf57db62566b543fca23fbc9edf178ca1b6f586ac7ee1e74461ed5ae3319dc0fa0f8b9086ec9ed21eaf6e141575cb0ce0ced2e2437bfd91c937cd4718673

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
55KB

MD5
0a5cfc0ed7369277497746a49deee605

SHA1
9e0ff1c19ecd70e4c7ad28d830d5952fbeb1d1d1

SHA256
25a45ebc309a0d41edea459566f2481804c094d5adbeb875b8b2944821538ef6

SHA512
9802b08338b71d93c3a4411d88dfa1d52fc7a1c7fce55b01321f3d1dd76910375df6037d73ac07fff75354eaaec8ab7d77c88fea05cf1370139ea243ce0b9b87

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
55KB

MD5
f70238c5b243368a74208d595e52312e

SHA1
de3b0c90159c84b0dc25901a28aa7716d91da02a

SHA256
0f2053493a0af07d2b964b9e67eed53bc7f624acc497871846b08bdc5b6fbb38

SHA512
eba47f0b757e72218b8e16137cde39c1682fd6440af5834c1dc1d6213c1b2cee51467970270c57c9e42ec7cb2e4cfd96a8673698f10a4020cfcc84ea4ef486ef

Download Submit
C:\Windows\SysWOW64\Hbbdholl.exe

Filesize
55KB

MD5
4a2cd1c136af510f0dc87f8e95981902

SHA1
5da417a8cf528fb4ac1d30596f3b589a0c2d1c8e

SHA256
db6549dcb968b6a9c0d4e3675f83d1c7e9f5154700fbc3f815a7626828c938dc

SHA512
14bfa43629c5d5f605bb794bd6b9ebc597d8e469065e0d746faa5ea19300e749c3ba8aebe52b9fc4cd34b4922452654a7395cb847e740d93cdc521788ab20ed6

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
55KB

MD5
7d0e29a6a1ca3c5cd9752afeef6676d5

SHA1
9d4701578a7fb9be609f46a85178867edcbd9242

SHA256
25439e86f93ea09df8e67b1c0f32a48b08bcbe7f89db5af155b5fa6ea79e2df1

SHA512
a7e3d7d4dc97589ec83e375f5353d7eb62515e2585130f5bea11c40316579d5d4129a025395cfb1632c4f2e6ee6e6282f6d414df8c6cb525b18ceeed8a1b84f4

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
55KB

MD5
5913bde3556b62298dd63841c4df0a9c

SHA1
9daffd8a9f5231cf6e4cbfcb413b99201d3a542a

SHA256
d3aa8b050e20a1719183006280ffefe57baa1246797ec4f19932c88c839b1c33

SHA512
bbff8c30ae12c521db9fecb7fc43244047401b5520354cd207b4f26a30562706e3c45d5faf69752a4ec6f9d56fa92809b164ff43e4c53f9dffb6947ed4f2cbd0

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
55KB

MD5
0cfc643beaa8dc754a1bc05aa6612de5

SHA1
6ecb52719371f18b7dd7081a30aea942a13b48ed

SHA256
debb8abc81b7c65c7f8738b7e6a199f99eff3848907408e556c63898afb3d6f6

SHA512
b6360105e2ff5955b84f46b2ccc316b26ea0f09284606fe45ad9be37f22d14b4d38ee1060df221f9f01d7c58bd97fb421760d1f435a45f3d27b90fd0d6722161

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
55KB

MD5
8a97ae13c24264077416dd3de9f7d926

SHA1
0e6e442c8d67c288a0e9d63f66de5c1a2302981b

SHA256
966893fb884874d1a053fa5ff51fef105cc69815963ad357d43cb062051a17c7

SHA512
4ca0fd845f2b7d024884a171dd74b4f94512ad1b868d1f6739c08278cc0bc2982451cfe1bf310fab99759713931cbe077f415009ffc7d067bbe3eab8b5c6d754

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
55KB

MD5
c05f4bcaf48bf7a803544e722ab7b0d3

SHA1
ed22994f94dd8af3b524a74093b84e7013c9969f

SHA256
0a5bf3509d929ca037c0b99a2f28f02fc39d6455cef480e8528f24e13da0a2ee

SHA512
9afcdb173b18aaecc76a9f675c94d27363f81517310dfaa5ee96799a0762ff173c52c2603a4b4603ab0485399c6a90c49801d47f6b7a9ef2514752cddac821a3

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
55KB

MD5
c4915cc43c5730397f35b73705dde26e

SHA1
eeb6b9352b10b70d81254d2ca6b4f04aa40d7152

SHA256
08f387319a4d47a83998fb28b4013a016f4fb1c68b4712186e33e96efcef7c71

SHA512
0d92082ac4bf1152cd4fbfe4bd4b2e5ab2e5b7a0074c0b462ecf0eec753a2b0c2a5decf233f4d761c63b5e839761ee366478aeb5617a11b593d2b41a76ebda5a

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
55KB

MD5
75115fecd55ebd12ec9554570d13a05f

SHA1
03964af1ade2c5c33397923856b45f357c9b92b0

SHA256
da424f4e7e3715fb74cb0fb17058beb4dd9bbc4b7db1527dae4b821ca6a01f64

SHA512
c9a0a998e765931ab6579fd5cc1eb164a63492deaa753a1e6540814a6768bf126d9aa9c95d441122b119c4991c0cd4a1c46938e489911897e24b15571043d3ad

Download Submit
C:\Windows\SysWOW64\Iijaka32.exe

Filesize
55KB

MD5
b03fc319b42c134556270a8435236673

SHA1
cbd10469b420d136b8a5d6c9e082208885be384e

SHA256
c8676a3de92a61a1698fdc456217863d73c8990bfc56c11d9d9cb00931bd844b

SHA512
90c205e6c075aebb8855e8feb73bc6910a6fcbee57090c3d853aeae22b6e716eadab712d13442edac681e8409c76274f77d9f59bd74343e16b7e2be6e5ab105a

Download Submit
C:\Windows\SysWOW64\Jkmgblok.exe

Filesize
55KB

MD5
31f19605d0cfcaf802fd6f07392b2b4a

SHA1
917f17522280155e4057b4104693ead4bbdd1f20

SHA256
04f929b4cbf56726c9190c2903c07474281a6b419e90bb76bdfd6b71313133f3

SHA512
f6b3127890f3bf464d525f8ebc1ea7384d82686aec0bb794ce41308293c09bb8422d8f5d210d3f91409608642cd25daecb286df531db968e7df4ca2ea01d02ff

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
55KB

MD5
af22d3020afc0634bdd919195764ac25

SHA1
67bb85838c128ee8f0975b26c8e3a7442320f783

SHA256
3f717554e5ca4166c4035d2e1e1312741841c4093df9923b354d66844f5958bc

SHA512
7527d66d5f862735231adbd6e60f0e7734100f855c1f1a1370305069c0cdc67fb6324242cf80d4b35422f5ab029081e28cf0eb1aa16771fccb5a619bf2675755

Download Submit
C:\Windows\SysWOW64\Jnhpoamf.exe

Filesize
55KB

MD5
043200022a15c31fa4fa07d2e3f0504b

SHA1
28e86e304edcdfaeb0916a4935d2b2dae4ef045b

SHA256
1ffb6c1346e804c00f096df6677e71a83b8ec917b6be3ef71ca4fe22f61f7b6c

SHA512
f3286271476066d96ae566919e6e82769d4e2b6befb4781fb4d040a6c9ceb7153466c4e71662d0bb90e08d1a42bd569bcee8b43fec5f156d797556ea5ce508f3

Download Submit
C:\Windows\SysWOW64\Lbchba32.exe

Filesize
55KB

MD5
03cf7b5cbdbcd084244c68bfc5b2a0f8

SHA1
cb7293d877d3ee0c1435ea2ec4683f3b4bf5bbb7

SHA256
6cf60ccf6fac922356a72eda38e4525ea7de45c975bffcca08a281fbf9b97897

SHA512
a7b4066e33d60fdd629c473b9ef3edd5e63ee53a7b8c31e89db7c9d72bb4e2a750c38035bf388780e59253398f1a04d86fa92b892f0aa66e04481d25b39fd9ec

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
55KB

MD5
4ed03897a2336ed7027a48853cd96ceb

SHA1
fa655a983cf5112172264c042706bdcb95fea191

SHA256
085fee0d512a1b3b9c2e30fada14f6d39649f8569cb56430ea93ee4b346e90da

SHA512
bda016a6352b8790df7f1e60a7a4e6e817b267ebd4adf3b172013a379917cf4e6b9f4e5d6f1aa596f3067b91622d8cd37e5c2e63c49e5ced5a0c7d567852b78c

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
55KB

MD5
ef227c1779839fc38010e9d23acd001a

SHA1
40a5a939d561c8f74189356ac0bb11125877c1a6

SHA256
a079e93e4128e70d08a95e8a8c6699949a51dc6c17a12fb8e16b19f271104e75

SHA512
a36f259b8e69c94785284a47e838876dfe2a495c27dbb48803df32c901108a3c853da910ad8ec8c216a9fb85b06aa2a11313e8ec9ef248f1b3162e329cb9c3a9

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
55KB

MD5
dacd789c26e3e166382ebbd47fec16a4

SHA1
572e0516ea1920f6c6b691388754a57b04c151e2

SHA256
8511c946d79bd2e9f7fbac3584880f8229b0cfed180608c1cb75a2a62be0e501

SHA512
8a2d16cbf549f26a193c2760488004846b8c4ba4af09745704ff0a32a61cf56bcc7c33424be1004a2b4434161985815f86384706c940f2d0ca3d4088c85015da

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
55KB

MD5
0de9e5b1e22f0e05f8e2370771d147b8

SHA1
8af2ae1b58f0d07872504fdf0c69e5643a066cc8

SHA256
e41b309ab9727bb09c2d03870ea51436e44344206f267552fd34db54cf4b11b2

SHA512
d01b5024327f2910ec0faf57c9e02204348d2a959bc32756ec2ba3a8a0ce84e3ca02438f353d789a77a071244f722d9ab88ebf277cd689bc64590fba1d6dcaee

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
55KB

MD5
45fc0469fe47b34384fdce16694f42f0

SHA1
8d730c0046143fccc57c870699f49e22d7f858f6

SHA256
94198a98a17fe571bc2d97900a60491d77ea01aacfad5c63e44f1ed5ef92c79e

SHA512
0ab392862bd807bbcb065803d95252bc598fce500b46d3337940eabd464b32a4e6b00e38f8db4802803acc221efa6111a4f061753c087d83c0e416f8d0dfe214

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
55KB

MD5
896c72a1fd713c4275744d526bdd57c6

SHA1
666da3487dfc9d5a0908c87a4600dcc5cae3ade7

SHA256
c2ff98e0c331920375ee3a52c94e84c43d946d91326aa096f066558f76a6a360

SHA512
e3622d900cfba3ac53434e8d2a5e664dc476bdb281613553c60736f2de3dca13a6f8377bbec14dcaa81b9b18bf25f34ac3f80b9bb0a09835d561be16dc6b9f97

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
55KB

MD5
ad23170458883437abbe963a92d7e88f

SHA1
99cd568ac74db8dd35f2ad0f200cac50e5332d74

SHA256
3732648a55424f1f2b4fcaf238c2d0045fcfd6408999e8debd81ba5c487b01a5

SHA512
0f6d382580eeb843f4cf1e149f9f868f55a7a0275d6c6cbb346a962c67b9335b8de73091e94829ab30f353f84085f725ec8a4ea1ada77668905442f1928d8257

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
55KB

MD5
cf483172f6b4c0571bc7bfa4395268f7

SHA1
cd4e1648c6b2f34781cc63010d0d4621a1403a92

SHA256
4b9f8678090828242801dba44426dcf9040672d9a4798dd72b95dc7614543cc1

SHA512
448418fd954085bd9e0233b44f2704f0ac1a3a248900336f19eef2d9e7bb7aa7321eaca0d9930fb0b2d2733af2598e722c73cdc5d69f7d35818a8dabc831894e

Download Submit
C:\Windows\SysWOW64\Plejdkmm.exe

Filesize
55KB

MD5
98b20fdd4c11a69f5e19ddf2a5b9854a

SHA1
1ec08294c963bf7e972c9c4100b2dee670fab153

SHA256
94ffe0dba5bc99f777a20264bb17b24155b535c9e48b27d0e11e8f373289132c

SHA512
71ec5d50d7b20a278317f70df3842d441f0cf9da263a592cf299fd3ab897961762d607c75fb723a8e9873b0bdbb409832537f8e49dc7c0f595dca7e399b425ce

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
55KB

MD5
cbce80892599f77861a12a8979af0ee1

SHA1
9b782c68cc7f9be6053525d191a06e84aa6c318c

SHA256
3868f8d2076ef0bbd326751c2508787461ca37d1891973489c075f6c9aeb9e42

SHA512
45484b3262060be26552a8569555b55453d2d2abb872093d79f6e026faf77f791942747ac0ab7cbdf9754c4a64edc8d135ea629d06bb0dcf26ccca6248c0d076

Download Submit
memory/8-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/492-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/648-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1056-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1244-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1748-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2204-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2236-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2280-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2520-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2852-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2916-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3040-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3252-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3292-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3328-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3652-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3816-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3980-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4160-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4580-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4600-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4724-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads