f026dab3058bddb9db7ae4cdc15cce809ddd308c6f582bb3530661853e748a29

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe
Size

77KB
MD5

b4af75ef7b5d5d6cf66b03ce4ee67c9f
SHA1

d7856e6efbbb3cc98bae9d71e6640ef1c632eaa9
SHA256

f026dab3058bddb9db7ae4cdc15cce809ddd308c6f582bb3530661853e748a29
SHA512

0ee13349676cd3f4e8c39bd78fb1d551967944dc8290a9ca1f2803f457711838091c89bc6f3ccc47fa634a11d11e4c2c5ca959907c6a87bb983f831fe7683027
SSDEEP

1536:0PhMVD0fSDquwvHXjU7sGdgO8bBBWoIxiKodi0nO4+P:ShMVD01vHXoiBB5iy

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbabigfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnohlgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adkgje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnoiqdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igedlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kageaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mecjif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diccgfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oigllh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcinna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpbmfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hffken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foapaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmglcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nihipdhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Najceeoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqdlnde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edgbii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaajhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmihij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefped32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgnbaeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnnimak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhjckcgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cobkhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eplnpeol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ikndgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llhikacp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akoqpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epmmqheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipeeobbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qppaclio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkeaqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqnbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlpokp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjnffjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjhbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oocmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgccinoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Facqkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkgnfhnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnbklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbcjnilj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaamlecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgghjjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbnlaldg.exe

Executes dropped EXE 64 IoCs

pid	Process
1980	Ogfcjm32.exe
4548	Ohgoaehe.exe
2656	Ooagno32.exe
1672	Oigllh32.exe
3912	Oenlqi32.exe
3628	Oofaiokl.exe
4408	Oljaccjf.exe
3132	Ocdjpmac.exe
4852	Ohqbhdpj.exe
1724	Ploknb32.exe
4520	Pjbkgfej.exe
220	Pjehmfch.exe
2200	Ppopjp32.exe
4924	Pjgebf32.exe
3884	Pleaoa32.exe
4288	Pfnegggi.exe
5088	Pqcjepfo.exe
2188	Qjlnnemp.exe
1400	Qoifflkg.exe
4232	Qhakoa32.exe
2988	Acgolj32.exe
3200	Ajqgidij.exe
4404	Cjomap32.exe
3888	Caienjfd.exe
4036	Cffmfadl.exe
4556	Dpnbog32.exe
3732	Diffglam.exe
4272	Dpqodfij.exe
4188	Diicml32.exe
1004	Dhjckcgi.exe
4728	Dmglcj32.exe
2964	Dmihij32.exe
2960	Ddcqedkk.exe
4964	Epjajeqo.exe
5000	Ehailbaa.exe
3344	Eibfck32.exe
948	Eplnpeol.exe
3000	Eidbij32.exe
2296	Ealkjh32.exe
3804	Ehfcfb32.exe
2080	Eigonjcj.exe
4656	Epagkd32.exe
4056	Efkphnbd.exe
3140	Epcdqd32.exe
2712	Fkihnmhj.exe
860	Facqkg32.exe
3120	Ffpicn32.exe
4396	Fineoi32.exe
840	Fphnlcdo.exe
3420	Fknbil32.exe
1392	Fpjjac32.exe
512	Fgdbnmji.exe
2560	Fajgkfio.exe
5016	Fmqgpgoc.exe
4952	Fpodlbng.exe
4788	Gkdhjknm.exe
2120	Gmcdffmq.exe
2100	Gdmmbq32.exe
3228	Gkgeoklj.exe
908	Gaamlecg.exe
3496	Ghkeio32.exe
1968	Gilapgqb.exe
4608	Gpfjma32.exe
1412	Ginnfgop.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nbefdijg.exe	Nlkngo32.exe
File created	C:\Windows\SysWOW64\Fbajbi32.exe	Fpbmfn32.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jpgdai32.exe
File opened for modification	C:\Windows\SysWOW64\Keqdmihc.exe	Kjkpoq32.exe
File opened for modification	C:\Windows\SysWOW64\Dkokcl32.exe	Chqogq32.exe
File created	C:\Windows\SysWOW64\Baiinofi.dll	Nadleilm.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Phcgcqab.exe
File opened for modification	C:\Windows\SysWOW64\Gaqhjggp.exe	Fkofga32.exe
File opened for modification	C:\Windows\SysWOW64\Cbkfbcpb.exe	Cdhffg32.exe
File opened for modification	C:\Windows\SysWOW64\Mgclpkac.exe	Meepdp32.exe
File opened for modification	C:\Windows\SysWOW64\Fphnlcdo.exe	Fineoi32.exe
File created	C:\Windows\SysWOW64\Fjhacf32.exe	Fbajbi32.exe
File created	C:\Windows\SysWOW64\Pninea32.dll	Mhanngbl.exe
File opened for modification	C:\Windows\SysWOW64\Cmpjoloh.exe	Cienon32.exe
File created	C:\Windows\SysWOW64\Dmglcj32.exe	Dhjckcgi.exe
File created	C:\Windows\SysWOW64\Jnifpf32.dll	Mcelpggq.exe
File created	C:\Windows\SysWOW64\Folnlh32.dll	Mqkiok32.exe
File created	C:\Windows\SysWOW64\Malgcg32.exe	Mlpokp32.exe
File created	C:\Windows\SysWOW64\Mecjif32.exe	Mniallpq.exe
File opened for modification	C:\Windows\SysWOW64\Niojoeel.exe	Ncbafoge.exe
File created	C:\Windows\SysWOW64\Hfombjbg.dll	Kinmcg32.exe
File opened for modification	C:\Windows\SysWOW64\Ngjkfd32.exe	Nfjola32.exe
File created	C:\Windows\SysWOW64\Lpepbgbd.exe	Lhnhajba.exe
File created	C:\Windows\SysWOW64\Hpgiggmj.dll	Hkgnfhnh.exe
File opened for modification	C:\Windows\SysWOW64\Lmgabcge.exe	Lkeekk32.exe
File opened for modification	C:\Windows\SysWOW64\Bknlbhhe.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Damfao32.exe	Doojec32.exe
File created	C:\Windows\SysWOW64\Bmabggdm.exe	Bjbfklei.exe
File created	C:\Windows\SysWOW64\Lhhmmcaa.dll	Cjecpkcg.exe
File created	C:\Windows\SysWOW64\Gpdennml.exe	Glhimp32.exe
File created	C:\Windows\SysWOW64\Poblig32.dll	Pfnegggi.exe
File opened for modification	C:\Windows\SysWOW64\Cjgpfk32.exe	Cbphdn32.exe
File opened for modification	C:\Windows\SysWOW64\Iinqbn32.exe	Icdheded.exe
File created	C:\Windows\SysWOW64\Bddjpd32.exe	Bdbnjdfg.exe
File created	C:\Windows\SysWOW64\Dbnmke32.exe	Dnpdegjp.exe
File opened for modification	C:\Windows\SysWOW64\Fineoi32.exe	Ffpicn32.exe
File opened for modification	C:\Windows\SysWOW64\Jcmdaljn.exe	Ilcldb32.exe
File created	C:\Windows\SysWOW64\Kbmimp32.dll	Lqmmmmph.exe
File created	C:\Windows\SysWOW64\Dolqpa32.dll	Lnangaoa.exe
File opened for modification	C:\Windows\SysWOW64\Jojdlfeo.exe	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Jbnffffp.dll	Ojgjndno.exe
File created	C:\Windows\SysWOW64\Pefabkej.exe	Pmoiqneg.exe
File created	C:\Windows\SysWOW64\Kgopidgf.exe	Keqdmihc.exe
File created	C:\Windows\SysWOW64\Dokgdkeh.exe	Dkokcl32.exe
File opened for modification	C:\Windows\SysWOW64\Pnmopk32.exe	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Gengjl32.dll	Jjamia32.exe
File created	C:\Windows\SysWOW64\Lfifmo32.dll	Dbndfl32.exe
File opened for modification	C:\Windows\SysWOW64\Madjhb32.exe	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Enkdaepb.exe	Emjgim32.exe
File created	C:\Windows\SysWOW64\Jeegfibg.dll	Doccpcja.exe
File created	C:\Windows\SysWOW64\Djcoai32.exe	Dblgpl32.exe
File created	C:\Windows\SysWOW64\Lagajn32.dll	Emdajb32.exe
File opened for modification	C:\Windows\SysWOW64\Ncabfkqo.exe	Nndjndbh.exe
File created	C:\Windows\SysWOW64\Iepaaico.exe	Hmdlmg32.exe
File opened for modification	C:\Windows\SysWOW64\Ljbfpo32.exe	Liqihglg.exe
File created	C:\Windows\SysWOW64\Pqcjepfo.exe	Pfnegggi.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Hmimkinm.dll	Ohgoaehe.exe
File created	C:\Windows\SysWOW64\Hnhmla32.dll	Nefped32.exe
File opened for modification	C:\Windows\SysWOW64\Pkadoiip.exe	Pcepkfld.exe
File opened for modification	C:\Windows\SysWOW64\Efccmidp.exe	Ecefqnel.exe
File created	C:\Windows\SysWOW64\Hhhjoabm.dll	Gipdap32.exe
File opened for modification	C:\Windows\SysWOW64\Kqnbkl32.exe	Jnpfop32.exe
File created	C:\Windows\SysWOW64\Jcdihk32.dll	Fijdjfdb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6264	6184	WerFault.exe	822

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehailbaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papambbb.dll"	Ehlhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bbfmgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmlilh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnidao32.dll"	Iinqbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahlom32.dll"	Dgbanq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmcdffmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noomkkpc.dll"	Dbjkkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Meefofek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpdennml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjomap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopnfa32.dll"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogigdpmb.dll"	Holfoqcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnoaaaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epoaed32.dll"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbhpb32.dll"	Kgmcce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iemlnm32.dll"	Gbfldf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajpfn32.dll"	Hcpojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ombcji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bipecnkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqibbo32.dll"	Johnamkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlhego32.dll"	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkchelci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmggcl32.dll"	Komhll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnclimck.dll"	Qljcoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npbblbdb.dll"	Dmalne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glienb32.dll"	Eciplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apmhinni.dll"	Jpfepf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdmqmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgokg32.dll"	Mngegmbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nhdlao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liaolo32.dll"	Bmlilh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aojjhafd.dll"	Cjomap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlbkap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Inqbclob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcgnbaeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkhapk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ommceclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lldopb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pioelhgj.dll"	Ijqmhnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknmplfo.dll"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fineoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkabjbih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqdmimbf.dll"	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndfnlpc.dll"	Ojcpdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfojdh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1980	4804	NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe	88
PID 4804 wrote to memory of 1980	4804	NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe	88
PID 4804 wrote to memory of 1980	4804	NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe	88
PID 1980 wrote to memory of 4548	1980	Ogfcjm32.exe	89
PID 1980 wrote to memory of 4548	1980	Ogfcjm32.exe	89
PID 1980 wrote to memory of 4548	1980	Ogfcjm32.exe	89
PID 4548 wrote to memory of 2656	4548	Ohgoaehe.exe	90
PID 4548 wrote to memory of 2656	4548	Ohgoaehe.exe	90
PID 4548 wrote to memory of 2656	4548	Ohgoaehe.exe	90
PID 2656 wrote to memory of 1672	2656	Ooagno32.exe	91
PID 2656 wrote to memory of 1672	2656	Ooagno32.exe	91
PID 2656 wrote to memory of 1672	2656	Ooagno32.exe	91
PID 1672 wrote to memory of 3912	1672	Oigllh32.exe	92
PID 1672 wrote to memory of 3912	1672	Oigllh32.exe	92
PID 1672 wrote to memory of 3912	1672	Oigllh32.exe	92
PID 3912 wrote to memory of 3628	3912	Oenlqi32.exe	93
PID 3912 wrote to memory of 3628	3912	Oenlqi32.exe	93
PID 3912 wrote to memory of 3628	3912	Oenlqi32.exe	93
PID 3628 wrote to memory of 4408	3628	Oofaiokl.exe	94
PID 3628 wrote to memory of 4408	3628	Oofaiokl.exe	94
PID 3628 wrote to memory of 4408	3628	Oofaiokl.exe	94
PID 4408 wrote to memory of 3132	4408	Oljaccjf.exe	95
PID 4408 wrote to memory of 3132	4408	Oljaccjf.exe	95
PID 4408 wrote to memory of 3132	4408	Oljaccjf.exe	95
PID 3132 wrote to memory of 4852	3132	Ocdjpmac.exe	96
PID 3132 wrote to memory of 4852	3132	Ocdjpmac.exe	96
PID 3132 wrote to memory of 4852	3132	Ocdjpmac.exe	96
PID 4852 wrote to memory of 1724	4852	Ohqbhdpj.exe	97
PID 4852 wrote to memory of 1724	4852	Ohqbhdpj.exe	97
PID 4852 wrote to memory of 1724	4852	Ohqbhdpj.exe	97
PID 1724 wrote to memory of 4520	1724	Ploknb32.exe	99
PID 1724 wrote to memory of 4520	1724	Ploknb32.exe	99
PID 1724 wrote to memory of 4520	1724	Ploknb32.exe	99
PID 4520 wrote to memory of 220	4520	Pjbkgfej.exe	100
PID 4520 wrote to memory of 220	4520	Pjbkgfej.exe	100
PID 4520 wrote to memory of 220	4520	Pjbkgfej.exe	100
PID 220 wrote to memory of 2200	220	Pjehmfch.exe	101
PID 220 wrote to memory of 2200	220	Pjehmfch.exe	101
PID 220 wrote to memory of 2200	220	Pjehmfch.exe	101
PID 2200 wrote to memory of 4924	2200	Ppopjp32.exe	102
PID 2200 wrote to memory of 4924	2200	Ppopjp32.exe	102
PID 2200 wrote to memory of 4924	2200	Ppopjp32.exe	102
PID 4924 wrote to memory of 3884	4924	Pjgebf32.exe	103
PID 4924 wrote to memory of 3884	4924	Pjgebf32.exe	103
PID 4924 wrote to memory of 3884	4924	Pjgebf32.exe	103
PID 3884 wrote to memory of 4288	3884	Pleaoa32.exe	104
PID 3884 wrote to memory of 4288	3884	Pleaoa32.exe	104
PID 3884 wrote to memory of 4288	3884	Pleaoa32.exe	104
PID 4288 wrote to memory of 5088	4288	Pfnegggi.exe	105
PID 4288 wrote to memory of 5088	4288	Pfnegggi.exe	105
PID 4288 wrote to memory of 5088	4288	Pfnegggi.exe	105
PID 5088 wrote to memory of 2188	5088	Pqcjepfo.exe	106
PID 5088 wrote to memory of 2188	5088	Pqcjepfo.exe	106
PID 5088 wrote to memory of 2188	5088	Pqcjepfo.exe	106
PID 2188 wrote to memory of 1400	2188	Qjlnnemp.exe	107
PID 2188 wrote to memory of 1400	2188	Qjlnnemp.exe	107
PID 2188 wrote to memory of 1400	2188	Qjlnnemp.exe	107
PID 1400 wrote to memory of 4232	1400	Qoifflkg.exe	108
PID 1400 wrote to memory of 4232	1400	Qoifflkg.exe	108
PID 1400 wrote to memory of 4232	1400	Qoifflkg.exe	108
PID 4232 wrote to memory of 2988	4232	Qhakoa32.exe	109
PID 4232 wrote to memory of 2988	4232	Qhakoa32.exe	109
PID 4232 wrote to memory of 2988	4232	Qhakoa32.exe	109
PID 2988 wrote to memory of 3200	2988	Acgolj32.exe	110

C:\Users\Admin\AppData\Local\Temp\NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b4af75ef7b5d5d6cf66b03ce4ee67c9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\Ogfcjm32.exe
  C:\Windows\system32\Ogfcjm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\Ohgoaehe.exe
    C:\Windows\system32\Ohgoaehe.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\Ooagno32.exe
      C:\Windows\system32\Ooagno32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        23⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        25⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        26⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        27⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        28⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        29⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        30⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        34⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        35⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        37⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:948
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        39⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        40⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        41⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        42⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        43⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        44⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        45⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        46⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        50⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        51⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        52⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        53⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        54⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        56⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        57⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        59⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        60⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:908
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        62⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        63⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        64⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        65⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        66⤵
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        67⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        68⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        69⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        70⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        71⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        72⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1784
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        74⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3796
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        76⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3892
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        78⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        79⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        80⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        81⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        82⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        83⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        84⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        86⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        87⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        89⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        90⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        91⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        92⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        93⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        94⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        95⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        96⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        97⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        98⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        99⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        100⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        101⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        102⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        105⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        106⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        107⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        108⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        109⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        110⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        112⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        113⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        114⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        117⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        118⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        119⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        120⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        121⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        122⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        123⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        124⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        125⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        127⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        128⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        129⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        130⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6156
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        132⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        133⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        134⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        135⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        137⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        138⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        140⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        141⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        142⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        143⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        144⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        145⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        146⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        148⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        149⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        151⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        152⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        153⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        154⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        157⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        158⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        159⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        160⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        162⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        163⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        165⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        166⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        167⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        168⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        169⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        170⤵
        Drops file in System32 directory
        
        PID:3608
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        171⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        172⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        173⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        174⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        175⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        176⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        177⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        178⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        179⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        180⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        181⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        182⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        184⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        185⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        186⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        187⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        188⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        189⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        190⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        191⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        192⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        193⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        194⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        195⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        196⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        197⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        198⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        200⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        201⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        202⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        203⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        204⤵
        Drops file in System32 directory
        
        PID:7636
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        207⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        209⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        210⤵
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8000
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        212⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        213⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        214⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        215⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        216⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        218⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        219⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        220⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        221⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        222⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        223⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        224⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        225⤵
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        226⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        227⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        228⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        229⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        230⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        231⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        232⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        233⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        234⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        235⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        236⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        240⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        241⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        242⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        243⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        244⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        245⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        246⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        247⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        248⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        249⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        250⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8296
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        252⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        253⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        254⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        255⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        256⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        257⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        258⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        259⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        260⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8728
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        262⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        263⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        264⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        265⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        266⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        267⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        268⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        269⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        270⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        271⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        272⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        273⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        275⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        276⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        277⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        278⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        279⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        280⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        281⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        282⤵
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        283⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        284⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        285⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        286⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        287⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        288⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        289⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        290⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        291⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        292⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        293⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        294⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        295⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        296⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        297⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        299⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        300⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        301⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        302⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        303⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        305⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        306⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        307⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        308⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        309⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        310⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        311⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        313⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        314⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        315⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        317⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        318⤵
        Modifies registry class
        
        PID:9368
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        319⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        320⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9496
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        322⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9580
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        324⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        325⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        326⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        327⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        328⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        330⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        331⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        332⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        333⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        334⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        335⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        336⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        337⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        338⤵
        Drops file in System32 directory
        
        PID:10212
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        339⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        340⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        341⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        342⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        343⤵
        Modifies registry class
        
        PID:9480
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        344⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        345⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        346⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        347⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        348⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        349⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        350⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        351⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        352⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        353⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        354⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        355⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        356⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        357⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        358⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        359⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        360⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        361⤵
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        362⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        363⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        364⤵
        Modifies registry class
        
        PID:9864
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        365⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        366⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        367⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        368⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        369⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        370⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        371⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        372⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        373⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        374⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        375⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        377⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        378⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        379⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        380⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        381⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        382⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        383⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        384⤵
        Drops file in System32 directory
        
        PID:9308
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        385⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        386⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        387⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        388⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        389⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        390⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        391⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        392⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        393⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        394⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        395⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        396⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        397⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        398⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10704
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        400⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10744
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        401⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        402⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        403⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        404⤵
        Drops file in System32 directory
        
        PID:10924
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        405⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        406⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        407⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        408⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        409⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11176
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        411⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        412⤵
        Drops file in System32 directory
        
        PID:748
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        413⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        414⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        415⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        416⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10580
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        418⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        419⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        420⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        421⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        422⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        423⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        424⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        425⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        426⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        427⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        428⤵
        Modifies registry class
        
        PID:10340
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        429⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        431⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        432⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        433⤵
        Modifies registry class
        
        PID:10892
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        434⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        435⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        436⤵
        Modifies registry class
        
        PID:11232
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        437⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10520
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        439⤵
        Drops file in System32 directory
        
        PID:10656
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        440⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        442⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        443⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        444⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        445⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11256
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        447⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        448⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        449⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        450⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        451⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        452⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        453⤵
        Modifies registry class
        
        PID:11356
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        454⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        455⤵
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        456⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        457⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        458⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        459⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        460⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        461⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        462⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        463⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        464⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        465⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        466⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        467⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        468⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        469⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        470⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        471⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        472⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        473⤵
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        474⤵
        Drops file in System32 directory
        
        PID:12280
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        475⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        476⤵
        Drops file in System32 directory
        
        PID:11368
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        477⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        478⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        479⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        480⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        481⤵
        Modifies registry class
        
        PID:11724
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        482⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        483⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        484⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        485⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        486⤵
        Drops file in System32 directory
        
        PID:380
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        487⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        488⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        489⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        490⤵
        Drops file in System32 directory
        
        PID:11364
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        491⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11612
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        493⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        494⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        495⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        496⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        497⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        498⤵
        Drops file in System32 directory
        
        PID:12260
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        499⤵
        Modifies registry class
        
        PID:11488
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        500⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        501⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        502⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        504⤵
        Modifies registry class
        
        PID:11300
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        505⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        506⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        507⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        508⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        509⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        510⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        511⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        513⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        514⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        515⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        516⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        517⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        518⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        519⤵
        Modifies registry class
        
        PID:12168
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        520⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        521⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        522⤵
        Drops file in System32 directory
        
        PID:12412
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        523⤵
        Drops file in System32 directory
        
        PID:12460
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        524⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        525⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        526⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        527⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        528⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        529⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        530⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        531⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        532⤵
        Modifies registry class
        
        PID:12852
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        533⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        534⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        535⤵
        Drops file in System32 directory
        
        PID:12980
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        536⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        537⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        538⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        539⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        540⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        541⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        542⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        543⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        544⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        545⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        546⤵
        Drops file in System32 directory
        
        PID:12384
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        547⤵
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        548⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12488
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        549⤵
        Drops file in System32 directory
        
        PID:12540
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        550⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        551⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        552⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        553⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        554⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        555⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        556⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        557⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12772
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        558⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        559⤵
        Modifies registry class
        
        PID:12884
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        560⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        561⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        562⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        563⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        564⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        565⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        566⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        568⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        569⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        570⤵
        
        PID:12468

C:\Windows\SysWOW64\Edionhpn.exe
C:\Windows\system32\Edionhpn.exe
1⤵
PID:12532
- C:\Windows\SysWOW64\Eiekog32.exe
  C:\Windows\system32\Eiekog32.exe
  2⤵
  PID:12572
- - C:\Windows\SysWOW64\Fooclapd.exe
    C:\Windows\system32\Fooclapd.exe
    3⤵
    PID:3128
  - - C:\Windows\SysWOW64\Fbmohmoh.exe
      C:\Windows\system32\Fbmohmoh.exe
      4⤵
      PID:3172
    - - C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        5⤵
        
        PID:2188
      - C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12664
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        7⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        8⤵
        Drops file in System32 directory
        
        PID:12832
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        9⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        10⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        11⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        12⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        13⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        14⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        15⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        16⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        17⤵
        Drops file in System32 directory
        
        PID:12364
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        18⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        19⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        20⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        21⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        22⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        23⤵
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        24⤵
        Modifies registry class
        
        PID:932
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        25⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        26⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        27⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        28⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        29⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        30⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2712
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        32⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        33⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        34⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        35⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        36⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        37⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4964
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        39⤵
        Modifies registry class
        
        PID:12588
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        40⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        41⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        42⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        43⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        44⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4344
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        46⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        47⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        48⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        49⤵
        Drops file in System32 directory
        
        PID:544
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        50⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        51⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        52⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        53⤵
        
        PID:3992

C:\Windows\SysWOW64\Kcoccc32.exe
C:\Windows\system32\Kcoccc32.exe
1⤵
PID:5152
- C:\Windows\SysWOW64\Kabcopmg.exe
  C:\Windows\system32\Kabcopmg.exe
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\Kiikpnmj.exe
    C:\Windows\system32\Kiikpnmj.exe
    3⤵
    PID:5536
  - - C:\Windows\SysWOW64\Kofdhd32.exe
      C:\Windows\system32\Kofdhd32.exe
      4⤵
      PID:3896
    - - C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        5⤵
        
        PID:5624
      - C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        6⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        7⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        8⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        9⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        10⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        11⤵
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        12⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        13⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        14⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        15⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        16⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        17⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        18⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13216
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        20⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        21⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        22⤵
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        23⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        24⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        25⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4988
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        27⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        28⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        29⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        30⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        31⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        34⤵
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        35⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        36⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        37⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        38⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        39⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        40⤵
        
        PID:6300

C:\Windows\SysWOW64\Ojnfihmo.exe
C:\Windows\system32\Ojnfihmo.exe
1⤵
PID:5220
- C:\Windows\SysWOW64\Ommceclc.exe
  C:\Windows\system32\Ommceclc.exe
  2⤵
  - Modifies registry class
  PID:5772
- - C:\Windows\SysWOW64\Ookoaokf.exe
    C:\Windows\system32\Ookoaokf.exe
    3⤵
    PID:6124
  - - C:\Windows\SysWOW64\Ofegni32.exe
      C:\Windows\system32\Ofegni32.exe
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        5⤵
        Modifies registry class
        
        PID:5876
      - C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4796
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        7⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        8⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        9⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        10⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        11⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        13⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        14⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        15⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        16⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        17⤵
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        18⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        19⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        20⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        21⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        22⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        23⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        25⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        27⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        28⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        29⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        30⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2120
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        32⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        33⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        34⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        35⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        36⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        37⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        38⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        39⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        40⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        41⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        42⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        43⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        44⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        45⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        46⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        47⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        48⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        50⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        51⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        52⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        53⤵
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        54⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        55⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        56⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        57⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        58⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        59⤵
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        60⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 424
        61⤵
        Program crash
        
        PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 6184 -ip 6184
1⤵
PID:6152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acgolj32.exe

Filesize
77KB

MD5
fb9bb00daf39eebfe65fc67453e2db45

SHA1
b953637b43ed6e2c036ee1db7c84a9664175ea1d

SHA256
705575a12f1726a1eacc7896ccbb183a96835bec081779569f1ebf9f6a31a4ad

SHA512
1311a9811b5894c338cc9642b6824bb9892cded0423936409df2d06d9c392fa1745a8efd88b583a21a20949a2a49bfff4d41490ca0ea3fd60fbfd340df78403d

Download Submit
C:\Windows\SysWOW64\Acgolj32.exe

Filesize
77KB

MD5
fb9bb00daf39eebfe65fc67453e2db45

SHA1
b953637b43ed6e2c036ee1db7c84a9664175ea1d

SHA256
705575a12f1726a1eacc7896ccbb183a96835bec081779569f1ebf9f6a31a4ad

SHA512
1311a9811b5894c338cc9642b6824bb9892cded0423936409df2d06d9c392fa1745a8efd88b583a21a20949a2a49bfff4d41490ca0ea3fd60fbfd340df78403d

Download Submit
C:\Windows\SysWOW64\Addaif32.exe

Filesize
77KB

MD5
e6d9c3b63dc8301df655b137260ad893

SHA1
726a1089837d13a3880e5825b20752bd6b795cfb

SHA256
246eb088f548d34c16ed49c06737853d93b9e65ab07080643d9b0c748520e3ba

SHA512
b386c028d941f2e298b3ebfc537788df7359472612cc2d78db094144143fdcef09d28d5e94c93f41a445c94d99900d6e08f0620bcee93447f43fc37bc8a683cf

Download Submit
C:\Windows\SysWOW64\Adndoe32.exe

Filesize
77KB

MD5
c1c9ef1f42d23de6e294fecc17fe7363

SHA1
8a15f177db456932808d1421fd19f5d8aff1d906

SHA256
05e1867b3163ef0b2f81b71839ee6d3266b60a546888fd3e08233dc28eb4dfc6

SHA512
7534f72f7e6adcf18df65a3197dce58596bbe151bfa05a42d82b8f7cba3782bf53e5bcbfcf90cbab0b440b0cc045f58597a7a1a396a831bb9755e35369cadcff

Download Submit
C:\Windows\SysWOW64\Ajqgidij.exe

Filesize
77KB

MD5
989693885380e1ae8d850b875c71b05b

SHA1
2d9f7ec7f60af1efdeb1b7b04511551b34047711

SHA256
c3b6ed1a464ee0ac4f77d0b458cf011c99139f6bc59c62694de039a65a8f1cd4

SHA512
6412cb0fd3912fcfa0b033b99df6754ced359da1b6377b025a1640b4a7ed34fc52eb5813688f53616ba61889142d44564c4eeb42228b23f40fb34c4b4be671bb

Download Submit
C:\Windows\SysWOW64\Ajqgidij.exe

Filesize
77KB

MD5
989693885380e1ae8d850b875c71b05b

SHA1
2d9f7ec7f60af1efdeb1b7b04511551b34047711

SHA256
c3b6ed1a464ee0ac4f77d0b458cf011c99139f6bc59c62694de039a65a8f1cd4

SHA512
6412cb0fd3912fcfa0b033b99df6754ced359da1b6377b025a1640b4a7ed34fc52eb5813688f53616ba61889142d44564c4eeb42228b23f40fb34c4b4be671bb

Download Submit
C:\Windows\SysWOW64\Caienjfd.exe

Filesize
77KB

MD5
e90e3780c06d6b8bcd8aee545748e6da

SHA1
9c03a821bd41bf38c3982aabf94f2ceb1c97651a

SHA256
07c48814788a5759dfe8ae6379d18bb43d67443135615512830f7e0624c6a2c3

SHA512
8f65240a5157dc61b853baa1d47dd838f699e252618510f26a6e4939a636db1e2f5947ba6c662a68c1bee1d5fb646aa2f1fb5955ae89f7f16e3c0a4b8622003e

Download Submit
C:\Windows\SysWOW64\Caienjfd.exe

Filesize
77KB

MD5
e90e3780c06d6b8bcd8aee545748e6da

SHA1
9c03a821bd41bf38c3982aabf94f2ceb1c97651a

SHA256
07c48814788a5759dfe8ae6379d18bb43d67443135615512830f7e0624c6a2c3

SHA512
8f65240a5157dc61b853baa1d47dd838f699e252618510f26a6e4939a636db1e2f5947ba6c662a68c1bee1d5fb646aa2f1fb5955ae89f7f16e3c0a4b8622003e

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
77KB

MD5
70b979d4f41dfac3437a2b69d5f71835

SHA1
0a46f4f04fd55af431de4896e5c82a6724bf6a0a

SHA256
217a5d6a766b9910beae90c5aa26c0d3bd31518a4318f8503d8e1febb056ab33

SHA512
b809e51519e1fc8058538f6fc590ef004bb1c6822143712661682b676d0d6c58b5289feee40d020719263972b9e1a4fc59b7b81bce3894804284bafaee74903d

Download Submit
C:\Windows\SysWOW64\Cffmfadl.exe

Filesize
77KB

MD5
5c477c53f8f033e315a1f0112e3a44b9

SHA1
1994a6118c5bb7cc98f9e9cde58fdee946a629df

SHA256
9313ee8992b3a982f9afbd8da816b7b17a449e15105dab9d2d1d498cea583e98

SHA512
841b8118159f0de97829ae30ff98ff1352b9b58588177ed553e7d907bc7d8c7013f04aaa5fce30661272f1ff1031395a3cfd12b2e67df52a3e39f4d23be75452

Download Submit
C:\Windows\SysWOW64\Cffmfadl.exe

Filesize
77KB

MD5
5c477c53f8f033e315a1f0112e3a44b9

SHA1
1994a6118c5bb7cc98f9e9cde58fdee946a629df

SHA256
9313ee8992b3a982f9afbd8da816b7b17a449e15105dab9d2d1d498cea583e98

SHA512
841b8118159f0de97829ae30ff98ff1352b9b58588177ed553e7d907bc7d8c7013f04aaa5fce30661272f1ff1031395a3cfd12b2e67df52a3e39f4d23be75452

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
77KB

MD5
c39590c83d8dbd2590c2a65377c25a9d

SHA1
bdacfcc6366739ac269aa4cb905dec22a6acac0a

SHA256
c4e70aad00ce02f7e508a6816ea7c9ef47727505f8059bbc65b2924640985bdf

SHA512
2ccd47d0dfd3e765a12024821fb8bc268443b4c7e1c57bc5c989a77035da56072f8d555b1b682e21b4ebe272450778a7b82811435148d6550b1fdbd8dae6d152

Download Submit
C:\Windows\SysWOW64\Cjecpkcg.exe

Filesize
77KB

MD5
b0308becf924bf399b5f9dd983789a6f

SHA1
1f329c203feb397c6831ebc40e34f0b471ac97a5

SHA256
71cc66dfc45903554297c1bc1f7d367e585298bc6ac40cd87ac1978b97b3851e

SHA512
837122622f8c824b1d9480c87a2becfdf87584ca8c813243bd7564acc4f5112f5b3c23876181afc7d74b64981cbaa73646bbfd3b912310cc6f7207ca135034d6

Download Submit
C:\Windows\SysWOW64\Cjomap32.exe

Filesize
77KB

MD5
8db2344c768cac814babfe189ab7301d

SHA1
eabf881d4afb92eda018d36f9c2a9f761b76949a

SHA256
1b58e7915321dc22732f83f55cac84efbd45c841deb73249cdc00d3fa706df98

SHA512
0b9bc5dd8b5ac03bfc32a0407fe81223d929d6c7112c2d8c0bd0c2296f1116e83995deaa277369ceedf5bb6a5552a8f38308d0121607db5470fee07617e00b02

Download Submit
C:\Windows\SysWOW64\Cjomap32.exe

Filesize
77KB

MD5
8db2344c768cac814babfe189ab7301d

SHA1
eabf881d4afb92eda018d36f9c2a9f761b76949a

SHA256
1b58e7915321dc22732f83f55cac84efbd45c841deb73249cdc00d3fa706df98

SHA512
0b9bc5dd8b5ac03bfc32a0407fe81223d929d6c7112c2d8c0bd0c2296f1116e83995deaa277369ceedf5bb6a5552a8f38308d0121607db5470fee07617e00b02

Download Submit
C:\Windows\SysWOW64\Dhjckcgi.exe

Filesize
77KB

MD5
4ed3a8994922f4a8224e1096cb6f0c1b

SHA1
0d9da5449740ad16a86aea66601f40ef301cc8cc

SHA256
7c43416ee92888591ab9d99cf3d6d8304ccc8090e9359b6b50352fdc3c7ead78

SHA512
2effa8f941d4a929434795aedad4eabf1fdb09fe2ad171813856deb9ffb54b53be1f985e75e27c0c44417c5174c6abaac6efbf98f0597fa18c7c06ec74f421f4

Download Submit
C:\Windows\SysWOW64\Dhjckcgi.exe

Filesize
77KB

MD5
3fce55fb6a08fc0266847bc18d5782f7

SHA1
ded53b75f9694eaa58e63514aff85244f4cb2d37

SHA256
76497115e422b795430366a846a16da6c773ec3d8be9f4ab6ddc8f00420169cb

SHA512
9db824ae2ce12def27f68f5089f08def491c2e5efc038c3c81149f9864c47e3ce1ddf46d050e802d3d2c68a7df1b1c6a2f306d770c47cddc802156043c887c76

Download Submit
C:\Windows\SysWOW64\Dhjckcgi.exe

Filesize
77KB

MD5
3fce55fb6a08fc0266847bc18d5782f7

SHA1
ded53b75f9694eaa58e63514aff85244f4cb2d37

SHA256
76497115e422b795430366a846a16da6c773ec3d8be9f4ab6ddc8f00420169cb

SHA512
9db824ae2ce12def27f68f5089f08def491c2e5efc038c3c81149f9864c47e3ce1ddf46d050e802d3d2c68a7df1b1c6a2f306d770c47cddc802156043c887c76

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
77KB

MD5
324860a2313859a2cb23e14e7658ce4b

SHA1
b894219ae702e6109063b6c952c028528c0ca0bd

SHA256
646ed9d04c15c3665bcde9bbcfe4c0bc296f21fa5075c37255fb6018fb2090da

SHA512
e44b593a9e47ae2b3684daae35452ecd5cecd03e83d67e8352a1e654909aefaa0fcd480bc08da4639afb47d0dd9b81702c4e5a4d0716d2c91df7f2f8b60f3fb4

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
77KB

MD5
324860a2313859a2cb23e14e7658ce4b

SHA1
b894219ae702e6109063b6c952c028528c0ca0bd

SHA256
646ed9d04c15c3665bcde9bbcfe4c0bc296f21fa5075c37255fb6018fb2090da

SHA512
e44b593a9e47ae2b3684daae35452ecd5cecd03e83d67e8352a1e654909aefaa0fcd480bc08da4639afb47d0dd9b81702c4e5a4d0716d2c91df7f2f8b60f3fb4

Download Submit
C:\Windows\SysWOW64\Diicml32.exe

Filesize
77KB

MD5
4ed3a8994922f4a8224e1096cb6f0c1b

SHA1
0d9da5449740ad16a86aea66601f40ef301cc8cc

SHA256
7c43416ee92888591ab9d99cf3d6d8304ccc8090e9359b6b50352fdc3c7ead78

SHA512
2effa8f941d4a929434795aedad4eabf1fdb09fe2ad171813856deb9ffb54b53be1f985e75e27c0c44417c5174c6abaac6efbf98f0597fa18c7c06ec74f421f4

Download Submit
C:\Windows\SysWOW64\Diicml32.exe

Filesize
77KB

MD5
4ed3a8994922f4a8224e1096cb6f0c1b

SHA1
0d9da5449740ad16a86aea66601f40ef301cc8cc

SHA256
7c43416ee92888591ab9d99cf3d6d8304ccc8090e9359b6b50352fdc3c7ead78

SHA512
2effa8f941d4a929434795aedad4eabf1fdb09fe2ad171813856deb9ffb54b53be1f985e75e27c0c44417c5174c6abaac6efbf98f0597fa18c7c06ec74f421f4

Download Submit
C:\Windows\SysWOW64\Dmglcj32.exe

Filesize
77KB

MD5
89b9f8535473cb29e38ea83d0cebdcb0

SHA1
1afbe1d076514cd4d78297289e15ca131224adba

SHA256
e4651f62e91f9d5636475dd230db61ef1bb3e6226126ce16ef3aba87ac91241f

SHA512
3d5c44ac80ce6eae16df56932f97096bc8be04ab201500ccaa4ca73ee1e2eb86aa95758e89d5a430266683ec93e2e9783833317eb72b3b36c3507bc488e71e23

Download Submit
C:\Windows\SysWOW64\Dmglcj32.exe

Filesize
77KB

MD5
89b9f8535473cb29e38ea83d0cebdcb0

SHA1
1afbe1d076514cd4d78297289e15ca131224adba

SHA256
e4651f62e91f9d5636475dd230db61ef1bb3e6226126ce16ef3aba87ac91241f

SHA512
3d5c44ac80ce6eae16df56932f97096bc8be04ab201500ccaa4ca73ee1e2eb86aa95758e89d5a430266683ec93e2e9783833317eb72b3b36c3507bc488e71e23

Download Submit
C:\Windows\SysWOW64\Dmihij32.exe

Filesize
77KB

MD5
bc5a2261d20b562442c1824e06e11442

SHA1
9a82fb2fa3ba296e7fb3318d305e9a08fd07be66

SHA256
9f9686c8b28db10d726f5cfb7e9bac26b70bf30faaf9d0ab381645023307202b

SHA512
24a1858fe8352609e0aab374dc8a93b7a9817b9b98eddff5ccf0f0b97e9bfc62b69ab9769fba2b437c45275067ed6e566f01d21f35b872cd1001f16124b3ebaa

Download Submit
C:\Windows\SysWOW64\Dmihij32.exe

Filesize
77KB

MD5
bc5a2261d20b562442c1824e06e11442

SHA1
9a82fb2fa3ba296e7fb3318d305e9a08fd07be66

SHA256
9f9686c8b28db10d726f5cfb7e9bac26b70bf30faaf9d0ab381645023307202b

SHA512
24a1858fe8352609e0aab374dc8a93b7a9817b9b98eddff5ccf0f0b97e9bfc62b69ab9769fba2b437c45275067ed6e566f01d21f35b872cd1001f16124b3ebaa

Download Submit
C:\Windows\SysWOW64\Dpnbog32.exe

Filesize
77KB

MD5
d7deb21b03e690e2305b25ef7c60e7f3

SHA1
61c1452be025f3ff8483f4b78b52183eae02db7d

SHA256
aab20a4d4f7152b88414c05715c33f146cc58605749a8c2c4e65576e9e4e945b

SHA512
8ffac6cd532c4c18cd656a4b9de4f69ed58da65075c95b2bea57eeb7b28707f78df48ffe48b28f04a583f2ec66ac2de8b452f85135e77889217c47a8dca8bc59

Download Submit
C:\Windows\SysWOW64\Dpnbog32.exe

Filesize
77KB

MD5
d7deb21b03e690e2305b25ef7c60e7f3

SHA1
61c1452be025f3ff8483f4b78b52183eae02db7d

SHA256
aab20a4d4f7152b88414c05715c33f146cc58605749a8c2c4e65576e9e4e945b

SHA512
8ffac6cd532c4c18cd656a4b9de4f69ed58da65075c95b2bea57eeb7b28707f78df48ffe48b28f04a583f2ec66ac2de8b452f85135e77889217c47a8dca8bc59

Download Submit
C:\Windows\SysWOW64\Dpqodfij.exe

Filesize
77KB

MD5
1ef3540b31419ee1a6c0230a26ecc24e

SHA1
940d4e28c6fed50827b4219c419790eeae0a2abf

SHA256
02f10944c47a875a449d5b2a81aab7d58bde277ba86aca7a41efba384bc1632e

SHA512
66ca4aa5f24b86feacaece9f10feb01d36e9a36e142cbe58f381954b9a682ac42fdc1efde53ccd7cc11cfc182673f6899029df4436138f69da179e65b1106423

Download Submit
C:\Windows\SysWOW64\Dpqodfij.exe

Filesize
77KB

MD5
1ef3540b31419ee1a6c0230a26ecc24e

SHA1
940d4e28c6fed50827b4219c419790eeae0a2abf

SHA256
02f10944c47a875a449d5b2a81aab7d58bde277ba86aca7a41efba384bc1632e

SHA512
66ca4aa5f24b86feacaece9f10feb01d36e9a36e142cbe58f381954b9a682ac42fdc1efde53ccd7cc11cfc182673f6899029df4436138f69da179e65b1106423

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
77KB

MD5
0a68be8ffb62af236a2a64895a27788b

SHA1
3ee692183d07a3479a78ca49fc867b2736788744

SHA256
45b0ca200534a198ef1e068dc4c08253321c116c986f7609de70b21be4bf9661

SHA512
93cab690894bac9dc5aa3dc1c747509a1affbfc937e54c4ad240fb1be969fe4f3066a9f7d5a6983594a4600b1f8679f0720c0eba2e171986cac24676db43f968

Download Submit
C:\Windows\SysWOW64\Fohfbpgi.exe

Filesize
77KB

MD5
c91d7cde0d8f3874a8b6aa2b7c2b88df

SHA1
cb67d44991026763d666545b2534b6eb78d0480f

SHA256
64fec34b251523324decd2ab9cb65837a9e9c1c569cd934324e865fb509546e8

SHA512
b35ecd64e88acf292455c0dfbb97cb2841d25c57524f0c021f9d32bb053b458149049b061974fe2fa6640cf666143f3ddf7c91d3c6d171c36aaea48d70aa2390

Download Submit
C:\Windows\SysWOW64\Gkgeoklj.exe

Filesize
77KB

MD5
986d05989924858f8bceeba0a3cc25ed

SHA1
32bda19ff92431019ceee19e7c0e3704157832ab

SHA256
57de90b616312d4569835cf45c2b21cab7026d79057556bc4d414210b01b29f9

SHA512
faaffd11366096c28a819999c078d9c67f93b6e04c3b298e959ba650b2af1352335e5e75c950d5f5c8594c4ae86be514762ff7dac7616f2b97bc64b7b41372e4

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
77KB

MD5
a28ae4f1bd440772a541bdcf5d5abc21

SHA1
bfce25631fab3a184e8a6683dedde60cc96689df

SHA256
495f976330229b5f82ccddabc38589368fce9170ae125f7a223471f706f22b24

SHA512
065f5fd90b0161da2cc5126dc99427f1e9718ccfd4e1cadef06db2e6ab2edfb3904e80123a1ebec3b50adf105d03238f5d7a9c45515a33b263cd1a7e01d3ac86

Download Submit
C:\Windows\SysWOW64\Hffken32.exe

Filesize
77KB

MD5
147a1a85f07b26c44985ea67c2cb675b

SHA1
53d327d8dda96a07825073fbd54239f62edc62b0

SHA256
db1132d9b07b33e3cdd5aea1693dacc0ed0d62f0fa14c5f605505a713415042e

SHA512
9583b9e9080a7d2662774f421aa45f6fd705671795ca6193438309cca496a0db0070a2d91fdfa742b0a755e80f3f990673535c786c856f37f3955be8e4c640ba

Download Submit
C:\Windows\SysWOW64\Hkgnfhnh.exe

Filesize
77KB

MD5
c6f2fd1e210d2683f00b2e3f945ec44e

SHA1
2c2fb9f8c629caac91e210bd75e5eb3d2d271bf3

SHA256
504c226bc917ad27d12a20db9d2792ce5158c3a55ae59898a549bfc59aced560

SHA512
b33fd9df6e24968025094cd5f93ba9bfba7428752f1491bb2148b172f3520bde71c51f9f81d8e6a71f9b110752adb78a7e9b4a14eb9d9bf3570c2fafd009321a

Download Submit
C:\Windows\SysWOW64\Ijdgcpaf.dll

Filesize
7KB

MD5
424809c29f1db5535b26f871c78303d1

SHA1
42439f3f85abbe9ec0fb0fe5011df09667f3a6a7

SHA256
727a2a2f3acc9c7ab68233e30a1c62a3931c6acfc57f11b8bd3bcb567ed48c71

SHA512
b15ece65c53397fa0507bb33856aff6305cac0ceb247ba339678668e5d3ffee28b958689574c8945d9ec34c8429219aa1b1a78d791c9d1ba13894c9d64c09761

Download Submit
C:\Windows\SysWOW64\Johnamkm.exe

Filesize
77KB

MD5
050b333fb380a5bd6068960119a458d3

SHA1
2a5f5337c67e9fadf2d8f602b34f662f3c557278

SHA256
600329945a4310c91133a6fdc98c028a76676885803373cd71d2fd6983681513

SHA512
10feb91a2f6ae1659bee0b0210794caa3400fe5558ef99708c2cdacf31ec83cc180a4592a5e9a689dfc7cc918ec39a64af6c30fb13fe12d9a6740041834c9ff8

Download Submit
C:\Windows\SysWOW64\Kegpifod.exe

Filesize
77KB

MD5
35f5d6c4f7943200a84334c04105465b

SHA1
857c789a31964a32a2b06936ac06584677aba172

SHA256
f887f670cea53627660049b1240764cd7d692d2cc3b1823a12ccf64d4b600f49

SHA512
1bce30ed04c4ffcf8136a8e4cb570f7c45e0d0770ff89bc4c01f6a30b0879cb9f995d7dc7daabe7a14babc3cd4c9e05f49b9f57a3ca07b9792085e95f6653bc4

Download Submit
C:\Windows\SysWOW64\Kinmcg32.exe

Filesize
77KB

MD5
d3174ded3987b9b85df61704e3d64008

SHA1
5f3823691e68bee188ecec3423e332f72180706e

SHA256
ed5cbbb3b86f28c48dfd7f549ff886497fb1677dc97282babac160391e740c72

SHA512
05be9a6c5a324dc3e0fdfc4ed4fe5fd5273aedbd42b5abf682d4703a2cfdea5735885115caef5cb46429d03a010a3ebb7eeb593550d6f654414de0e531d93b85

Download Submit
C:\Windows\SysWOW64\Lcgpni32.exe

Filesize
77KB

MD5
46686d90ba4b8a8e72f0e19bd17e0705

SHA1
e69aca10655b6cd95a838c8294a4486bd9405a95

SHA256
69ff4cf8ae59025b47838355af35064196914c7fb3583477756097f879cdfc5c

SHA512
f7e102af58ebd3568bc01d40e3e91c646616909322379c63198c0fecea1663897ec774c3d39804b1531ebb1db00aa3c4ef0d03b1071726916b439617b3a78b23

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
77KB

MD5
e02a14a7a2ab9f2074b162cb72c20809

SHA1
9751d0029e2db9a0919290c8e8471d308c826362

SHA256
04e72b8686747231920fd42caf1aa4bba9af827328c7ca32128423ce31bbb414

SHA512
198317c9d7e016e450b078b9934228da69712399bb019facb6e8410590a84325d6c84d2bbdfd7208e9ee3401275f5b377536c76d9789dba63d44d1c6d6445ca0

Download Submit
C:\Windows\SysWOW64\Ncabfkqo.exe

Filesize
77KB

MD5
aebfae2c4f37fdc2814acb2338c9a596

SHA1
efaedc914d94f1381526ba6bef283903f4dd6b32

SHA256
15625efc3180a0e92b75082c2a8de7a9660c39fa6c0d70b10f172be9bb986d3a

SHA512
19d60a4d5940a160f4c2d6531c393ee16b5a73500edd0d92442e18dbb5d514a66f08d1d33989ef85da29912bcc92dffae98bab7245212518438bfa2c6d2373dc

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
77KB

MD5
12196308180b8cf2d8be064bd8863edf

SHA1
76f0dcb24a03838ebd6cdd409baeb47dc8eb5721

SHA256
6c96e275f7c460edfa33f98878f569f9bf566372bf094d5b5a13cbdfbeee6875

SHA512
0ed2d0477685e1dfe1f54017f64fa30dfab2b17fa188c3ba99e8e97420e02882ab23941081e4e442842b5e92df3063cbc2c80ed6ab1fd7f2f31807b5916d9fc3

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
77KB

MD5
cd7a54e7022f7148db1085f8547ebc53

SHA1
86d33212fbab54ac9d08a7b33416df57cdc979b9

SHA256
192858a9d874e8a79f35b08eeb1b8c6f24fbb4807d48f33c18b3ec9e3593714c

SHA512
fc96cc17100ab5efa37b854f6078fcd56c08c9b1d4eea9d248d44b7b131c0796c2f1c2403368644b876ff89af1fd3766f6f6903d87009ffb3181e81d453f78f0

Download Submit
C:\Windows\SysWOW64\Ocdjpmac.exe

Filesize
77KB

MD5
f515abe3471522629c7171c82e403bd0

SHA1
7d38d8be2177f4586c13a65533bd74cc1e79d6ba

SHA256
0175c0a9613d3abfd58d53034d162af6a16133c3662409e8af404ad1fcc962a6

SHA512
a81e69ed0500bee4f5d41ea38d34346ae579ff71eea575ea19a1aa08ad0f21597b54002c25c252ae57fb16e4e4cee493ba559dd3994065bb488cd41386cc2671

Download Submit
C:\Windows\SysWOW64\Ocdjpmac.exe

Filesize
77KB

MD5
f515abe3471522629c7171c82e403bd0

SHA1
7d38d8be2177f4586c13a65533bd74cc1e79d6ba

SHA256
0175c0a9613d3abfd58d53034d162af6a16133c3662409e8af404ad1fcc962a6

SHA512
a81e69ed0500bee4f5d41ea38d34346ae579ff71eea575ea19a1aa08ad0f21597b54002c25c252ae57fb16e4e4cee493ba559dd3994065bb488cd41386cc2671

Download Submit
C:\Windows\SysWOW64\Oenlqi32.exe

Filesize
77KB

MD5
a1d6c4f47a509dbf33702dc1e5718fde

SHA1
bd7f732a741c011be8407ef97a56033051894430

SHA256
94d0485b54c37bb77ba7ce7684dc0c2991d169ef79b0056789b09acb0c994b64

SHA512
cf2c19728c9e46f8ee9d64ee1e010fc0a4fa67b4cc4b18c82825c4b24afa7a738b9c930d0e4dec94b9487bfa9af38d25ef9bb7a5183178c071e30f97cb031e71

Download Submit
C:\Windows\SysWOW64\Oenlqi32.exe

Filesize
77KB

MD5
a1d6c4f47a509dbf33702dc1e5718fde

SHA1
bd7f732a741c011be8407ef97a56033051894430

SHA256
94d0485b54c37bb77ba7ce7684dc0c2991d169ef79b0056789b09acb0c994b64

SHA512
cf2c19728c9e46f8ee9d64ee1e010fc0a4fa67b4cc4b18c82825c4b24afa7a738b9c930d0e4dec94b9487bfa9af38d25ef9bb7a5183178c071e30f97cb031e71

Download Submit
C:\Windows\SysWOW64\Ogfcjm32.exe

Filesize
77KB

MD5
8b7557d9924ec95c93ec1dc2dcd83f94

SHA1
0e6cf2579ff114a48e367665c633dc7faa29c286

SHA256
cc95ff1bddc98f234cef8b841a8136f4c2bf1f412f78e648831da86e2948d2e0

SHA512
6939455e1411375cf03f3c3fb61a39c2a297dba28e71388989cf516f2e69c630259a98fde18c6bced0294117dd39962e8c6fe59910aa4ee87c67093607ee667e

Download Submit
C:\Windows\SysWOW64\Ogfcjm32.exe

Filesize
77KB

MD5
8b7557d9924ec95c93ec1dc2dcd83f94

SHA1
0e6cf2579ff114a48e367665c633dc7faa29c286

SHA256
cc95ff1bddc98f234cef8b841a8136f4c2bf1f412f78e648831da86e2948d2e0

SHA512
6939455e1411375cf03f3c3fb61a39c2a297dba28e71388989cf516f2e69c630259a98fde18c6bced0294117dd39962e8c6fe59910aa4ee87c67093607ee667e

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
77KB

MD5
df244dc505804195180632e4353f35a6

SHA1
99e18dd43090d5c9cd6d324e8d86c51a43e03c95

SHA256
92ec5077b8bd101b687480849bb1613348c0f79cadabf02374d78982a69aa2d7

SHA512
097becb4b02c6e38b3557a631118953c8074ca3e09767882d92b0c75570b9aaf05b60d15f3abb526d34f90bcb064b6835a408bd3d10a3580df30b096f4ae816c

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
77KB

MD5
df244dc505804195180632e4353f35a6

SHA1
99e18dd43090d5c9cd6d324e8d86c51a43e03c95

SHA256
92ec5077b8bd101b687480849bb1613348c0f79cadabf02374d78982a69aa2d7

SHA512
097becb4b02c6e38b3557a631118953c8074ca3e09767882d92b0c75570b9aaf05b60d15f3abb526d34f90bcb064b6835a408bd3d10a3580df30b096f4ae816c

Download Submit
C:\Windows\SysWOW64\Ohqbhdpj.exe

Filesize
77KB

MD5
ddf20c95daf297af0899c938d5610878

SHA1
310e27d34bb77f32741ccc646d4dba49a608747a

SHA256
0ce15fc66fab6906b59ce25e3c54af81284ec3f80ba7ffd5ad773c9ab62426b7

SHA512
4e3a77311da2812b8d77dd2fa1768270d7200a859ec2f168044586329f05d84999e92ea76713bbcfb26abbcf05924eb81c7e9941a2d5ed366e46a9e88d7b99fe

Download Submit
C:\Windows\SysWOW64\Ohqbhdpj.exe

Filesize
77KB

MD5
ddf20c95daf297af0899c938d5610878

SHA1
310e27d34bb77f32741ccc646d4dba49a608747a

SHA256
0ce15fc66fab6906b59ce25e3c54af81284ec3f80ba7ffd5ad773c9ab62426b7

SHA512
4e3a77311da2812b8d77dd2fa1768270d7200a859ec2f168044586329f05d84999e92ea76713bbcfb26abbcf05924eb81c7e9941a2d5ed366e46a9e88d7b99fe

Download Submit
C:\Windows\SysWOW64\Oigllh32.exe

Filesize
77KB

MD5
619a7e88807dcc9ba659b0c5e6da1db8

SHA1
0bdb135f48e3aca0af2903b0df98991818b48458

SHA256
fff15dd8c86bfba6c84adf939ff9cd363af35d342f67e256d7f5c7ff449be6dc

SHA512
9548aeebdc294c43eecd71343dbce185fbfc2c78205cae9cff085306f5de2aaa0c5f003bb6901d6054d90530810fa70b535eaaba77a5505d15b10bbdcc7d849a

Download Submit
C:\Windows\SysWOW64\Oigllh32.exe

Filesize
77KB

MD5
619a7e88807dcc9ba659b0c5e6da1db8

SHA1
0bdb135f48e3aca0af2903b0df98991818b48458

SHA256
fff15dd8c86bfba6c84adf939ff9cd363af35d342f67e256d7f5c7ff449be6dc

SHA512
9548aeebdc294c43eecd71343dbce185fbfc2c78205cae9cff085306f5de2aaa0c5f003bb6901d6054d90530810fa70b535eaaba77a5505d15b10bbdcc7d849a

Download Submit
C:\Windows\SysWOW64\Oljaccjf.exe

Filesize
77KB

MD5
182be0c2603b7f2b70f20d1707e2e87d

SHA1
5e9a97342c1606c6bade3f4139ba52d4fee0f23b

SHA256
0192e6af43cd0f618d71c3749b8f4d64b521251d5dbd702c8c60ba7b0ec01f66

SHA512
fba0f930b2a3ce666108ea34bfa2c137005c29bfadd4941114dea257ccc69d8cb07e3ac0a6434f610172897faa2206e9fd3d7f04a87f4050999be217d8003c38

Download Submit
C:\Windows\SysWOW64\Oljaccjf.exe

Filesize
77KB

MD5
182be0c2603b7f2b70f20d1707e2e87d

SHA1
5e9a97342c1606c6bade3f4139ba52d4fee0f23b

SHA256
0192e6af43cd0f618d71c3749b8f4d64b521251d5dbd702c8c60ba7b0ec01f66

SHA512
fba0f930b2a3ce666108ea34bfa2c137005c29bfadd4941114dea257ccc69d8cb07e3ac0a6434f610172897faa2206e9fd3d7f04a87f4050999be217d8003c38

Download Submit
C:\Windows\SysWOW64\Ooagno32.exe

Filesize
77KB

MD5
a3924a2c3f7361377d6857c66b1b3cf1

SHA1
ebf23504387525829c0268e9cb3aa2c5018f8aa2

SHA256
59308649b381729653231a38072f18565b53ad64e0fc2ea270f3dfe187b7ddc0

SHA512
6c2fe7f46ab30384033faa26472c1c881beade44d149ce59a4cebe41243ac8ec6fd5e56c714ee21629b48f98af6502100eff8be028a7bf4fa85f2140c6bfeefa

Download Submit
C:\Windows\SysWOW64\Ooagno32.exe

Filesize
77KB

MD5
a3924a2c3f7361377d6857c66b1b3cf1

SHA1
ebf23504387525829c0268e9cb3aa2c5018f8aa2

SHA256
59308649b381729653231a38072f18565b53ad64e0fc2ea270f3dfe187b7ddc0

SHA512
6c2fe7f46ab30384033faa26472c1c881beade44d149ce59a4cebe41243ac8ec6fd5e56c714ee21629b48f98af6502100eff8be028a7bf4fa85f2140c6bfeefa

Download Submit
C:\Windows\SysWOW64\Oofaiokl.exe

Filesize
77KB

MD5
04c42664defd65ae292ff678feb7fa7a

SHA1
3643e805d5a3aff62cb823382ff52f148d75536f

SHA256
d631d932b36d606fb43aa2751fd0e090871dcbaa11cf29ee7747232a1ee880ff

SHA512
e66d9b2bc4db411e2c1e54ffff9e4432536f736ae1e91fd65d43a1fc368918d80ef5d6e76cbecd147e676a819101d218b94455c726bac937084707c7cf045a12

Download Submit
C:\Windows\SysWOW64\Oofaiokl.exe

Filesize
77KB

MD5
04c42664defd65ae292ff678feb7fa7a

SHA1
3643e805d5a3aff62cb823382ff52f148d75536f

SHA256
d631d932b36d606fb43aa2751fd0e090871dcbaa11cf29ee7747232a1ee880ff

SHA512
e66d9b2bc4db411e2c1e54ffff9e4432536f736ae1e91fd65d43a1fc368918d80ef5d6e76cbecd147e676a819101d218b94455c726bac937084707c7cf045a12

Download Submit
C:\Windows\SysWOW64\Pfnegggi.exe

Filesize
77KB

MD5
55874e6cb7aa50355e66a3c645e763bd

SHA1
90767b0749f6630553857764cfb7548137398f59

SHA256
b59a69e5dd6555c96243a18abce45fee57481c617eae550c705435382d518cbc

SHA512
8e4f410c6b5febd209c9a07f8272cb205a199acc567c0032533dbc7ef75c3a6eb4d3cfeb8a51c1af8d5b5ef893fce3756b5bf5651a066d4e7919165c552b4057

Download Submit
C:\Windows\SysWOW64\Pfnegggi.exe

Filesize
77KB

MD5
55874e6cb7aa50355e66a3c645e763bd

SHA1
90767b0749f6630553857764cfb7548137398f59

SHA256
b59a69e5dd6555c96243a18abce45fee57481c617eae550c705435382d518cbc

SHA512
8e4f410c6b5febd209c9a07f8272cb205a199acc567c0032533dbc7ef75c3a6eb4d3cfeb8a51c1af8d5b5ef893fce3756b5bf5651a066d4e7919165c552b4057

Download Submit
C:\Windows\SysWOW64\Pjbkgfej.exe

Filesize
77KB

MD5
788f07b3e62ec3b782c47f3e47bcd1fa

SHA1
24b46c88efb3653d3ace20a613eee3a0d871a59d

SHA256
4aa028c5248f78de9b46e4299196466ce15e46ac6651171981ebaa946e728235

SHA512
a8175fa3fcf252746cb5cdc00a8bd382837f4d9cd0d2ab22543936d3ce7275e02571cc3b03de6f741f236375a3dbb610da4a377b090a9cbfd537971d08cccc0a

Download Submit
C:\Windows\SysWOW64\Pjbkgfej.exe

Filesize
77KB

MD5
788f07b3e62ec3b782c47f3e47bcd1fa

SHA1
24b46c88efb3653d3ace20a613eee3a0d871a59d

SHA256
4aa028c5248f78de9b46e4299196466ce15e46ac6651171981ebaa946e728235

SHA512
a8175fa3fcf252746cb5cdc00a8bd382837f4d9cd0d2ab22543936d3ce7275e02571cc3b03de6f741f236375a3dbb610da4a377b090a9cbfd537971d08cccc0a

Download Submit
C:\Windows\SysWOW64\Pjehmfch.exe

Filesize
77KB

MD5
bbfd35c45590eb39283603e7350d97a3

SHA1
2f9c73dd3116eac614932bedf69d42c6bf444bdd

SHA256
6f75e96e190a0640e8b368c6ffadad89e9036cd332e4caef2fdaac4627604cda

SHA512
053581b06cf7073d20582daf7462d5611b9c4da1cf8549ec649add7faf28ca1db927768e602aa5845e3f36e07327798cc3b5502ce82856df7d6b181fc3d4068e

Download Submit
C:\Windows\SysWOW64\Pjehmfch.exe

Filesize
77KB

MD5
bbfd35c45590eb39283603e7350d97a3

SHA1
2f9c73dd3116eac614932bedf69d42c6bf444bdd

SHA256
6f75e96e190a0640e8b368c6ffadad89e9036cd332e4caef2fdaac4627604cda

SHA512
053581b06cf7073d20582daf7462d5611b9c4da1cf8549ec649add7faf28ca1db927768e602aa5845e3f36e07327798cc3b5502ce82856df7d6b181fc3d4068e

Download Submit
C:\Windows\SysWOW64\Pjgebf32.exe

Filesize
77KB

MD5
dd2a5d75b93987aa024b0f0baa57a6a3

SHA1
7976625ba4dab5583da3e5c06b2142f85385a1d7

SHA256
13a64db7ab1a3a1efe016093e032f902d7ca2c864cc94618a2736df68c5a9250

SHA512
5a5eef37d3c703011c0aa63b2811dcbfa1dad9704f7681b6b9b387991942f33dc77c06c10344a39b1590952137f85a63376109e0e56a052aea437fc6a66d0e62

Download Submit
C:\Windows\SysWOW64\Pjgebf32.exe

Filesize
77KB

MD5
dd2a5d75b93987aa024b0f0baa57a6a3

SHA1
7976625ba4dab5583da3e5c06b2142f85385a1d7

SHA256
13a64db7ab1a3a1efe016093e032f902d7ca2c864cc94618a2736df68c5a9250

SHA512
5a5eef37d3c703011c0aa63b2811dcbfa1dad9704f7681b6b9b387991942f33dc77c06c10344a39b1590952137f85a63376109e0e56a052aea437fc6a66d0e62

Download Submit
C:\Windows\SysWOW64\Pleaoa32.exe

Filesize
77KB

MD5
b33c95e761565c879dace6c5f410512c

SHA1
d8b41a20f78daa0919970f0c397c7f3e17137c84

SHA256
3d7369378b5ce95fb852b4108543bd6462981495576f545400624110f50ff054

SHA512
f71605786e1a4323bc9e020dce799976339b21e02ec1b8e75ab36a44005fd597112ea41611d8ae07f60f6525b69b5280b1f8ec805f924558d1432c0530d580c8

Download Submit
C:\Windows\SysWOW64\Pleaoa32.exe

Filesize
77KB

MD5
b33c95e761565c879dace6c5f410512c

SHA1
d8b41a20f78daa0919970f0c397c7f3e17137c84

SHA256
3d7369378b5ce95fb852b4108543bd6462981495576f545400624110f50ff054

SHA512
f71605786e1a4323bc9e020dce799976339b21e02ec1b8e75ab36a44005fd597112ea41611d8ae07f60f6525b69b5280b1f8ec805f924558d1432c0530d580c8

Download Submit
C:\Windows\SysWOW64\Ploknb32.exe

Filesize
77KB

MD5
ce070e7b7a266a4020dc0e071f5468b0

SHA1
ce32193e6392c1f7de5ce7c0570cd608b3f8dc71

SHA256
c4223d62ec473461efae37bf7cb4fe01d3ca7db7a315558ca2ea555f7f486dc4

SHA512
b699aff951a2b9f0d0594b2f013c9312e7a36071e7aaf78d449305989918e0b00ebdb86cc4c0d880fb07948fa3b419c472926b3ba49309823dfee1efcdaf6776

Download Submit
C:\Windows\SysWOW64\Ploknb32.exe

Filesize
77KB

MD5
ce070e7b7a266a4020dc0e071f5468b0

SHA1
ce32193e6392c1f7de5ce7c0570cd608b3f8dc71

SHA256
c4223d62ec473461efae37bf7cb4fe01d3ca7db7a315558ca2ea555f7f486dc4

SHA512
b699aff951a2b9f0d0594b2f013c9312e7a36071e7aaf78d449305989918e0b00ebdb86cc4c0d880fb07948fa3b419c472926b3ba49309823dfee1efcdaf6776

Download Submit
C:\Windows\SysWOW64\Ppopjp32.exe

Filesize
77KB

MD5
fbb6441fc7863c3dca77a4b4c281c3f6

SHA1
ded038bdac5a08cf6b8068315930347f0406457a

SHA256
c8f87901f1367e23ef27aa103a05b81fad0f405d47496e63b6eabb0495129570

SHA512
90f4152e56c6fc1cef7b2802bcbe56fec1774c55a5268940f7f0403d7afd47084b827fa722324ac74c540309ea94e369b1a3971544a68555f3de9668d3a683f5

Download Submit
C:\Windows\SysWOW64\Ppopjp32.exe

Filesize
77KB

MD5
fbb6441fc7863c3dca77a4b4c281c3f6

SHA1
ded038bdac5a08cf6b8068315930347f0406457a

SHA256
c8f87901f1367e23ef27aa103a05b81fad0f405d47496e63b6eabb0495129570

SHA512
90f4152e56c6fc1cef7b2802bcbe56fec1774c55a5268940f7f0403d7afd47084b827fa722324ac74c540309ea94e369b1a3971544a68555f3de9668d3a683f5

Download Submit
C:\Windows\SysWOW64\Pqcjepfo.exe

Filesize
77KB

MD5
87596191ee73bfcce4a1c290a5a2414f

SHA1
25a67cfa50dd9aca558cf877ac95405f349cdff0

SHA256
1f9df26bc16141ff3a2199f15e63f1c892cca9be6c5b0f08a381075e1c293604

SHA512
bd6282d36d12a7e2c7a923dc21da48c29835e5ec388b0f59c4b88c39739f29e6250ec1d6f70a091bd8721dfff2708023e59425abdda8a748416237accaa9eeb6

Download Submit
C:\Windows\SysWOW64\Pqcjepfo.exe

Filesize
77KB

MD5
87596191ee73bfcce4a1c290a5a2414f

SHA1
25a67cfa50dd9aca558cf877ac95405f349cdff0

SHA256
1f9df26bc16141ff3a2199f15e63f1c892cca9be6c5b0f08a381075e1c293604

SHA512
bd6282d36d12a7e2c7a923dc21da48c29835e5ec388b0f59c4b88c39739f29e6250ec1d6f70a091bd8721dfff2708023e59425abdda8a748416237accaa9eeb6

Download Submit
C:\Windows\SysWOW64\Qhakoa32.exe

Filesize
77KB

MD5
71a2647a6788a043b761a4dc44264369

SHA1
98f047838acd37bfd3352d3a9577fb1fdd842b9c

SHA256
97d98e9a0fb13494ac55b61a71d7224c788e8f7781d6d53bdf482e26134b7682

SHA512
400aeb5d406ec98708d3ee2febaff251b376766d70bbaaefe61677899e5fa6c458d2f62ebb54c2f87b712f6d6b907c3d5557cda8e2b04577cd55847a6e79f338

Download Submit
C:\Windows\SysWOW64\Qhakoa32.exe

Filesize
77KB

MD5
71a2647a6788a043b761a4dc44264369

SHA1
98f047838acd37bfd3352d3a9577fb1fdd842b9c

SHA256
97d98e9a0fb13494ac55b61a71d7224c788e8f7781d6d53bdf482e26134b7682

SHA512
400aeb5d406ec98708d3ee2febaff251b376766d70bbaaefe61677899e5fa6c458d2f62ebb54c2f87b712f6d6b907c3d5557cda8e2b04577cd55847a6e79f338

Download Submit
C:\Windows\SysWOW64\Qjlnnemp.exe

Filesize
77KB

MD5
a03bfd719d0d4d538b2230aad588ed6d

SHA1
a1c091a8bda22c7c804bfee574945700c2b9a9ff

SHA256
afdb1d1635fa86cec97de4e824abc23d1c7395cfb1d4564f1adb46046ae10df7

SHA512
3e684e756c028d79e008b7b8b947e597cf911a655b879a30a2448fe6edce1799cfb3894670e83899908a05e1a77548d59bbfec3600b8c247b314822af9deec0c

Download Submit
C:\Windows\SysWOW64\Qjlnnemp.exe

Filesize
77KB

MD5
a03bfd719d0d4d538b2230aad588ed6d

SHA1
a1c091a8bda22c7c804bfee574945700c2b9a9ff

SHA256
afdb1d1635fa86cec97de4e824abc23d1c7395cfb1d4564f1adb46046ae10df7

SHA512
3e684e756c028d79e008b7b8b947e597cf911a655b879a30a2448fe6edce1799cfb3894670e83899908a05e1a77548d59bbfec3600b8c247b314822af9deec0c

Download Submit
C:\Windows\SysWOW64\Qoifflkg.exe

Filesize
77KB

MD5
a6fbfcc138cc7849fad8a2a1fa9e3c8e

SHA1
08a3f49ec2b669a619f4342a77eba6708d76c5f7

SHA256
20c4734d5795dfafd292828577f49b0d713b992dff84603f6c79c06520a1a164

SHA512
e91013414f83159441b331d486d667360e3ddb0a2ba2bf385135c7952d57c4c1d8ecc3cec1e912fd1d3b46817a58d60e92659fe56faefc139c4ab36c999ca299

Download Submit
C:\Windows\SysWOW64\Qoifflkg.exe

Filesize
77KB

MD5
a6fbfcc138cc7849fad8a2a1fa9e3c8e

SHA1
08a3f49ec2b669a619f4342a77eba6708d76c5f7

SHA256
20c4734d5795dfafd292828577f49b0d713b992dff84603f6c79c06520a1a164

SHA512
e91013414f83159441b331d486d667360e3ddb0a2ba2bf385135c7952d57c4c1d8ecc3cec1e912fd1d3b46817a58d60e92659fe56faefc139c4ab36c999ca299

Download Submit
memory/220-96-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/512-380-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/840-363-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/860-340-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/908-424-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/948-286-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1004-240-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1392-375-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1400-152-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1672-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1724-79-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1968-440-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1980-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2080-310-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2100-412-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2120-406-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2188-143-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2200-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2296-298-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2560-382-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2656-23-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2712-334-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2960-262-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2964-256-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2988-172-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3000-292-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3120-350-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3132-64-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3140-328-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3200-175-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3228-418-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3344-283-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3420-369-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3496-430-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3628-47-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3732-220-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3804-304-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3884-120-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3888-197-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3912-40-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4036-200-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4056-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4188-232-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4232-160-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4272-224-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4288-128-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4396-357-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4404-184-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4408-55-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4520-88-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4548-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4556-212-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4608-442-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4656-320-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4728-247-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4788-400-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4804-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4852-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4924-112-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4952-394-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4964-268-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5000-274-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5016-388-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5088-135-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads