njrat | 60265d1d88f1be0ed6a250cdc1cf46771d5b7ae6300c6c5daf8f0034433ea716

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe
Size

337KB
MD5

b9265f1aeccdd227c0dfccdc5dc34a80
SHA1

e04218b441c07074aa583ffe95c63a0d9bda8962
SHA256

60265d1d88f1be0ed6a250cdc1cf46771d5b7ae6300c6c5daf8f0034433ea716
SHA512

f157a38ec854b915a263a47fb6687638dd63fc9e93af0ebfa3532682fd811bb6531cf4eab3ed4d4af3c892473178892f12a4ac7f9e583bd1d7e6e1d79eeb3a2d
SSDEEP

3072:zQq13IlL5B1jMgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:r3Ix5B1jM1+fIyG5jZkCwi8r

Score

10^/10

njrat persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cibain32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqimikfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbhgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amikgpcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibjqaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mapppn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjfgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpmcmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomqcjie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgloefco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqnejaff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fajbjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikmbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dggbcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiiicf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbnaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondljl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhnojl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dakikoom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhpao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dphiaffa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afcmfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajaelc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dickplko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpchib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpjoloh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnoaaaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdcmkgmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimldogg.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
4524	Ognpebpj.exe
4332	Odapnf32.exe
2964	Ojoign32.exe
5032	Ogbipa32.exe
4184	Pmoahijl.exe
4856	Pgefeajb.exe
2168	Pclgkb32.exe
4432	Pnakhkol.exe
4428	Pgioqq32.exe
3868	Pmfhig32.exe
2152	Pgllfp32.exe
3396	Pcbmka32.exe
2164	Qfcfml32.exe
1000	Qcgffqei.exe
60	Fffhifdk.exe
5008	Fmpqfq32.exe
4740	Lknojl32.exe
2212	Blqllqqa.exe
2676	Dbbffdlq.exe
1316	Eoideh32.exe
3588	Ekodjiol.exe
4700	Ekaapi32.exe
3440	Eejeiocj.exe
4200	Enbjad32.exe
512	Fmcjpl32.exe
4936	Fbpchb32.exe
5104	Fligqhga.exe
4716	Fbgihaji.exe
5116	Fmmmfj32.exe
3272	Gpnfge32.exe
3208	Gpgind32.exe
652	Hipmfjee.exe
704	Holfoqcm.exe
1432	Hibjli32.exe
4712	Hbjoeojc.exe
4372	Hidgai32.exe
4812	Hoaojp32.exe
2152	Hmbphg32.exe
5032	Hpqldc32.exe
4584	Hfjdqmng.exe
4624	Hpchib32.exe
2860	Ibaeen32.exe
2752	Iikmbh32.exe
1344	Iohejo32.exe
4232	Ifomll32.exe
3752	Ipgbdbqb.exe
3672	Igajal32.exe
1196	Ilnbicff.exe
4792	Imnocf32.exe
2876	Ioolkncg.exe
2952	Ieidhh32.exe
2264	Ipoheakj.exe
1536	Jekqmhia.exe
3100	Jpaekqhh.exe
1948	Jiiicf32.exe
1716	Jlgepanl.exe
440	Jepjhg32.exe
2732	Jcdjbk32.exe
5068	Jniood32.exe
4444	Jcfggkac.exe
4476	Jnlkedai.exe
1060	Komhll32.exe
4408	Kjblje32.exe
220	Kpmdfonj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pmhkafda.dll	Ifomll32.exe
File created	C:\Windows\SysWOW64\Cibain32.exe	Bgdemb32.exe
File created	C:\Windows\SysWOW64\Ogbipa32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Gpgind32.exe	Gpnfge32.exe
File created	C:\Windows\SysWOW64\Efoomp32.dll	Aaiqcnhg.exe
File opened for modification	C:\Windows\SysWOW64\Cpcpfg32.exe	Cmedjl32.exe
File created	C:\Windows\SysWOW64\Dnqcfjae.exe	Dckoia32.exe
File created	C:\Windows\SysWOW64\Ndmojj32.dll	Enemaimp.exe
File created	C:\Windows\SysWOW64\Joekag32.exe	Jhkbdmbg.exe
File created	C:\Windows\SysWOW64\Pkffgpdd.dll	Khbiello.exe
File created	C:\Windows\SysWOW64\Caecnh32.dll	Mhjhmhhd.exe
File created	C:\Windows\SysWOW64\Afakoidm.dll	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Pboglh32.dll	Ilphdlqh.exe
File opened for modification	C:\Windows\SysWOW64\Lpjjmg32.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Ncbafoge.exe	Nqcejcha.exe
File opened for modification	C:\Windows\SysWOW64\Oclkgccf.exe	Ombcji32.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Jlbejloe.exe	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fdbkja32.exe
File opened for modification	C:\Windows\SysWOW64\Komhll32.exe	Jnlkedai.exe
File created	C:\Windows\SysWOW64\Halhfe32.exe	Hlppno32.exe
File opened for modification	C:\Windows\SysWOW64\Jldbpl32.exe	Jifecp32.exe
File opened for modification	C:\Windows\SysWOW64\Mjpjgj32.exe	Mqhfoebo.exe
File created	C:\Windows\SysWOW64\Mqjbddpl.exe	Mjpjgj32.exe
File opened for modification	C:\Windows\SysWOW64\Jnlkedai.exe	Jcfggkac.exe
File opened for modification	C:\Windows\SysWOW64\Eomffaag.exe	Edgbii32.exe
File created	C:\Windows\SysWOW64\Fbmohmoh.exe	Fooclapd.exe
File created	C:\Windows\SysWOW64\Ckcdlpbd.dll	Fqgedh32.exe
File opened for modification	C:\Windows\SysWOW64\Ilfennic.exe	Hemmac32.exe
File opened for modification	C:\Windows\SysWOW64\Bpjmph32.exe	Bipecnkd.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Jnlkedai.exe	Jcfggkac.exe
File created	C:\Windows\SysWOW64\Nqgnfcmm.dll	Ekonpckp.exe
File opened for modification	C:\Windows\SysWOW64\Fkhpfbce.exe	Fdnhih32.exe
File created	C:\Windows\SysWOW64\Giecfejd.exe	Gnpphljo.exe
File opened for modification	C:\Windows\SysWOW64\Noppeaed.exe	Nfgklkoc.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Clmipm32.dll	Dhikci32.exe
File created	C:\Windows\SysWOW64\Badjai32.dll	Foapaa32.exe
File created	C:\Windows\SysWOW64\Njlmnj32.dll	Ilfennic.exe
File created	C:\Windows\SysWOW64\Knnele32.dll	Kcoccc32.exe
File opened for modification	C:\Windows\SysWOW64\Gjficg32.exe	Gggmgk32.exe
File created	C:\Windows\SysWOW64\Falmlm32.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Jnakbdid.dll	Dnljkk32.exe
File created	C:\Windows\SysWOW64\Enemaimp.exe	Ekgqennl.exe
File opened for modification	C:\Windows\SysWOW64\Edoencdm.exe	Enemaimp.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Ofkgcobj.exe	Oclkgccf.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Jadgnb32.exe	Joekag32.exe
File opened for modification	C:\Windows\SysWOW64\Aaiqcnhg.exe	Afcmfe32.exe
File created	C:\Windows\SysWOW64\Kbpkkeen.dll	Bpedeiff.exe
File created	C:\Windows\SysWOW64\Onogcg32.dll	Kifojnol.exe
File opened for modification	C:\Windows\SysWOW64\Ljbnfleo.exe	Lchfib32.exe
File created	C:\Windows\SysWOW64\Ialjan32.dll	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Gpcpel32.dll	Jnlkedai.exe
File opened for modification	C:\Windows\SysWOW64\Ahofoogd.exe	Amjbbfgo.exe
File created	C:\Windows\SysWOW64\Kdebopdl.dll	Ahaceo32.exe
File opened for modification	C:\Windows\SysWOW64\Bogkmgba.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cponen32.exe
File created	C:\Windows\SysWOW64\Glkkmjeh.dll	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Mjpjgj32.exe	Mqhfoebo.exe
File created	C:\Windows\SysWOW64\Oqmhqapg.exe	Ojcpdg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10464	10340	WerFault.exe	522

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qimkic32.dll"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kakmna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mapppn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcghkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgccelpk.dll"	Mjnnbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnqcfjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnjkcfod.dll"	Fbmohmoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhqamj.dll"	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iponmakp.dll"	Bipecnkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejlnfjbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilnbicff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoiloe.dll"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekellcop.dll"	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpemfc32.dll"	Lhqefjpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dknnoofg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqfpckhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekonpckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpfbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jifecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccdihbgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjodla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npepkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpaqbf32.dll"	Hlppno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpepbgbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckboblp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jllhpkfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmfqknfm.dll"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbqceofn.dll"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpcpfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhnbgoib.dll"	Gqnejaff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhphpicg.dll"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dblamanm.dll"	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afappe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgdemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhaggp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilfennic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgfnm32.dll"	Joekag32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4524	4484	NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe	88
PID 4484 wrote to memory of 4524	4484	NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe	88
PID 4484 wrote to memory of 4524	4484	NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe	88
PID 4524 wrote to memory of 4332	4524	Ognpebpj.exe	89
PID 4524 wrote to memory of 4332	4524	Ognpebpj.exe	89
PID 4524 wrote to memory of 4332	4524	Ognpebpj.exe	89
PID 4332 wrote to memory of 2964	4332	Odapnf32.exe	90
PID 4332 wrote to memory of 2964	4332	Odapnf32.exe	90
PID 4332 wrote to memory of 2964	4332	Odapnf32.exe	90
PID 2964 wrote to memory of 5032	2964	Ojoign32.exe	91
PID 2964 wrote to memory of 5032	2964	Ojoign32.exe	91
PID 2964 wrote to memory of 5032	2964	Ojoign32.exe	91
PID 5032 wrote to memory of 4184	5032	Ogbipa32.exe	92
PID 5032 wrote to memory of 4184	5032	Ogbipa32.exe	92
PID 5032 wrote to memory of 4184	5032	Ogbipa32.exe	92
PID 4184 wrote to memory of 4856	4184	Pmoahijl.exe	93
PID 4184 wrote to memory of 4856	4184	Pmoahijl.exe	93
PID 4184 wrote to memory of 4856	4184	Pmoahijl.exe	93
PID 4856 wrote to memory of 2168	4856	Pgefeajb.exe	94
PID 4856 wrote to memory of 2168	4856	Pgefeajb.exe	94
PID 4856 wrote to memory of 2168	4856	Pgefeajb.exe	94
PID 2168 wrote to memory of 4432	2168	Pclgkb32.exe	95
PID 2168 wrote to memory of 4432	2168	Pclgkb32.exe	95
PID 2168 wrote to memory of 4432	2168	Pclgkb32.exe	95
PID 4432 wrote to memory of 4428	4432	Pnakhkol.exe	96
PID 4432 wrote to memory of 4428	4432	Pnakhkol.exe	96
PID 4432 wrote to memory of 4428	4432	Pnakhkol.exe	96
PID 4428 wrote to memory of 3868	4428	Pgioqq32.exe	97
PID 4428 wrote to memory of 3868	4428	Pgioqq32.exe	97
PID 4428 wrote to memory of 3868	4428	Pgioqq32.exe	97
PID 3868 wrote to memory of 2152	3868	Pmfhig32.exe	98
PID 3868 wrote to memory of 2152	3868	Pmfhig32.exe	98
PID 3868 wrote to memory of 2152	3868	Pmfhig32.exe	98
PID 2152 wrote to memory of 3396	2152	Pgllfp32.exe	99
PID 2152 wrote to memory of 3396	2152	Pgllfp32.exe	99
PID 2152 wrote to memory of 3396	2152	Pgllfp32.exe	99
PID 3396 wrote to memory of 2164	3396	Pcbmka32.exe	100
PID 3396 wrote to memory of 2164	3396	Pcbmka32.exe	100
PID 3396 wrote to memory of 2164	3396	Pcbmka32.exe	100
PID 2164 wrote to memory of 1000	2164	Qfcfml32.exe	102
PID 2164 wrote to memory of 1000	2164	Qfcfml32.exe	102
PID 2164 wrote to memory of 1000	2164	Qfcfml32.exe	102
PID 1000 wrote to memory of 60	1000	Qcgffqei.exe	103
PID 1000 wrote to memory of 60	1000	Qcgffqei.exe	103
PID 1000 wrote to memory of 60	1000	Qcgffqei.exe	103
PID 60 wrote to memory of 5008	60	Fffhifdk.exe	105
PID 60 wrote to memory of 5008	60	Fffhifdk.exe	105
PID 60 wrote to memory of 5008	60	Fffhifdk.exe	105
PID 5008 wrote to memory of 4740	5008	Fmpqfq32.exe	106
PID 5008 wrote to memory of 4740	5008	Fmpqfq32.exe	106
PID 5008 wrote to memory of 4740	5008	Fmpqfq32.exe	106
PID 4740 wrote to memory of 2212	4740	Lknojl32.exe	109
PID 4740 wrote to memory of 2212	4740	Lknojl32.exe	109
PID 4740 wrote to memory of 2212	4740	Lknojl32.exe	109
PID 2212 wrote to memory of 2676	2212	Blqllqqa.exe	111
PID 2212 wrote to memory of 2676	2212	Blqllqqa.exe	111
PID 2212 wrote to memory of 2676	2212	Blqllqqa.exe	111
PID 2676 wrote to memory of 1316	2676	Dbbffdlq.exe	112
PID 2676 wrote to memory of 1316	2676	Dbbffdlq.exe	112
PID 2676 wrote to memory of 1316	2676	Dbbffdlq.exe	112
PID 1316 wrote to memory of 3588	1316	Eoideh32.exe	113
PID 1316 wrote to memory of 3588	1316	Eoideh32.exe	113
PID 1316 wrote to memory of 3588	1316	Eoideh32.exe	113
PID 3588 wrote to memory of 4700	3588	Ekodjiol.exe	114

C:\Users\Admin\AppData\Local\Temp\NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b9265f1aeccdd227c0dfccdc5dc34a80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\Ognpebpj.exe
  C:\Windows\system32\Ognpebpj.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\Odapnf32.exe
    C:\Windows\system32\Odapnf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\SysWOW64\Ojoign32.exe
      C:\Windows\system32\Ojoign32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        23⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        24⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        25⤵
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        26⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        27⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        29⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        30⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3272
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        32⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        33⤵
        Executes dropped EXE
        
        PID:652
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        35⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        37⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        38⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        39⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        40⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        41⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        43⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        47⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        50⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2876
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        52⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        53⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        55⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        57⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        58⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        59⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        60⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        63⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        64⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        65⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        66⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        67⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        68⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        69⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        70⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        71⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        72⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        73⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        74⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2544
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        76⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1108
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        78⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        81⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        82⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        83⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5328
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        85⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        86⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        87⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        88⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        89⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        90⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        91⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        93⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        94⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        95⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        96⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        97⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        99⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        100⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        101⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        102⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        103⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        104⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        106⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        108⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        109⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        110⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        111⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        112⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        113⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        114⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        116⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        117⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2708
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        121⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        122⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        123⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        125⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        126⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        127⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        128⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        129⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        130⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        131⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        132⤵
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        133⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        134⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        136⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        138⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        140⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        141⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        142⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        143⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        144⤵
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        145⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        146⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        147⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        148⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        150⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        151⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        152⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        153⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        154⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        156⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        157⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        158⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        160⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        161⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        163⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        164⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        166⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        167⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        169⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        171⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        172⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        174⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        175⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        177⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        180⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        181⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        182⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        183⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        185⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        187⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        188⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        189⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        190⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        191⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        192⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        193⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        195⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        197⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        198⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        199⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        200⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        202⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        203⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        205⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        206⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        207⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        208⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        209⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        210⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        211⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        212⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        213⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        214⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        216⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        217⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        218⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        219⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        220⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        221⤵
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        222⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        223⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        224⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        225⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        226⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        227⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        228⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        229⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        230⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        232⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        233⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        234⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        235⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4292
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        237⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        238⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        239⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        241⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        242⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        243⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        244⤵
        Drops file in System32 directory
        
        PID:7284
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        245⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        248⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        249⤵
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        251⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        252⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        253⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        254⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        255⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        256⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        257⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        258⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        259⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        260⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        261⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        262⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8380
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        264⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        265⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        266⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        267⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        268⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        270⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        271⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        273⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        274⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        275⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        276⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        278⤵
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        279⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        280⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        281⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        282⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        283⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        285⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        286⤵
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        288⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        290⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        291⤵
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        292⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        293⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        294⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        295⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9156
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        297⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        298⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        299⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        300⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        301⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        302⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        303⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        304⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        305⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        306⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        307⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        310⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        311⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        312⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        313⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        314⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        315⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8148
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        317⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        318⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        319⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4504
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        321⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        322⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        323⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        324⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9304
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        326⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        327⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        328⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        329⤵
        Modifies registry class
        
        PID:9496
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        331⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        332⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        333⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9712
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        335⤵
        Modifies registry class
        
        PID:9756
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        336⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        337⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        339⤵
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        341⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        342⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        343⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        344⤵
        Drops file in System32 directory
        
        PID:10140
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        345⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        346⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9244
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        348⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        349⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        350⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        351⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9544
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9616
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        354⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        355⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        356⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        357⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        358⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        359⤵
        Drops file in System32 directory
        
        PID:10088
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        360⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        361⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        362⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        364⤵
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        365⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        366⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1160
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        368⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        369⤵
        Modifies registry class
        
        PID:9608
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        370⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9804
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        372⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        375⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        376⤵
        Modifies registry class
        
        PID:9356
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        377⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        378⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        379⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        380⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        381⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        382⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        383⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        384⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        385⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        386⤵
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        387⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        388⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        389⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        390⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10080
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        392⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        394⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        395⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        396⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        397⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        398⤵
        Drops file in System32 directory
        
        PID:10328
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        399⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        400⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        401⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        402⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        403⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10600
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        405⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        406⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        407⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        408⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        409⤵
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        410⤵
        Modifies registry class
        
        PID:10868
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        411⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        412⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        413⤵
        Modifies registry class
        
        PID:10996
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        414⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        415⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        416⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        417⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11216
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        419⤵
        Drops file in System32 directory
        
        PID:10064
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        420⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        421⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10340 -s 400
        422⤵
        Program crash
        
        PID:10464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 10340 -ip 10340
1⤵
PID:10400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqgojmb.exe

Filesize
337KB

MD5
6e1d1123fdf454d821e0ea184ff3bc5d

SHA1
ec0f41c25021c95b123623917e6500b68040c479

SHA256
125ea90631d0c3d75c217193143edd3a10e26fab7fb4e59fc1c816976f26eabf

SHA512
ffcecc35df300b4a180f1e5e666e1349ec0d50d75ff2708e43f93e14cdb228e65e5b2dc96ae7289f5a9d4c75b7ddeb27fe2d90fa5bbe421228da998a444142fb

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
337KB

MD5
91b37a1f35c4f97cfe390a93471fd157

SHA1
797cc539030aac8be4b94427ee007ed0a7e882dc

SHA256
397ed8779c8b8ffc0505d3be9797a9018ebcd2db28592b29def924b558e489f4

SHA512
2e2c0ee7b473ad0fdde4188e0eebf860f1a0f1ea7a9dc8d8b10660b9eda1c57ee9db424d9bfdadc40c6a8523cb53849e909323f7ae1075eb737b2b49899e0d7c

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
337KB

MD5
91b37a1f35c4f97cfe390a93471fd157

SHA1
797cc539030aac8be4b94427ee007ed0a7e882dc

SHA256
397ed8779c8b8ffc0505d3be9797a9018ebcd2db28592b29def924b558e489f4

SHA512
2e2c0ee7b473ad0fdde4188e0eebf860f1a0f1ea7a9dc8d8b10660b9eda1c57ee9db424d9bfdadc40c6a8523cb53849e909323f7ae1075eb737b2b49899e0d7c

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
337KB

MD5
15f6b19a536fd2a9ccdc6dfc2ce267e2

SHA1
10ad66861036da9546a934f9d312771e6ba0a70a

SHA256
c58ba8a86d4be6fcc7ec921787241e8071cb08e1762f0f1ba8d8ad913bd47485

SHA512
d1dcbc1666abbbf0ff751947b1e4d1f151d29edb9a5c094d74dd96eabdda80e8cd9f33028a101610e335c747c95e688fa37a2caf432e9242dc948e0ff06ec95d

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
337KB

MD5
15f6b19a536fd2a9ccdc6dfc2ce267e2

SHA1
10ad66861036da9546a934f9d312771e6ba0a70a

SHA256
c58ba8a86d4be6fcc7ec921787241e8071cb08e1762f0f1ba8d8ad913bd47485

SHA512
d1dcbc1666abbbf0ff751947b1e4d1f151d29edb9a5c094d74dd96eabdda80e8cd9f33028a101610e335c747c95e688fa37a2caf432e9242dc948e0ff06ec95d

Download Submit
C:\Windows\SysWOW64\Dckoia32.exe

Filesize
337KB

MD5
fdd7d2a15d2d4d13ac74fcc0dc45d92a

SHA1
8ad482aa05cce7bb89b70b0d1e2f6d134b10c641

SHA256
f1ae8d0112598f4342249037afe36fd136fc4456b9e67a08f99efcd9138cb97e

SHA512
84cc4c1e485ae84f1f05ef3f51f56a50ddd14ee67bed9326878ea36e096eadced0c6402eb6a25f0de9d58fdd3e16c3e32f9625778e60c89eec028f64b36a511e

Download Submit
C:\Windows\SysWOW64\Dnqcfjae.exe

Filesize
337KB

MD5
9a7e532936addbf4321f4866be4cc3d8

SHA1
63599e0e2346684346a6a4adb3a96dac4cb7b63a

SHA256
ecb9968439889de82a56ca2477e45b02edd3b026189bb6b955c48f2edd1a33f1

SHA512
7c1644b79b1ceea39fc01fc91ba775bfef478c0fe90b53758f5e204e8b06f9104ad6e9b3b3b0fad17afa368ceb4e18872e3a313cf5b563422985e1e2010470fc

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
337KB

MD5
c846ab3830b69591159623761148c2ec

SHA1
566d38dd52f17755f8f6675ecb651dac17ed6271

SHA256
c61ed9e3f5434634b0eceeda4b328666df03884938c0a552eae8e50973049483

SHA512
594c2a0d0eec475cd9e75a54d92559d15972ec7f7a9d87010f4d365d8e5c6f5e668f75a9c6a8e12d1614ceaace2fcba552976e78603c0c6679d3d7d7b2ab6dd4

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
337KB

MD5
c846ab3830b69591159623761148c2ec

SHA1
566d38dd52f17755f8f6675ecb651dac17ed6271

SHA256
c61ed9e3f5434634b0eceeda4b328666df03884938c0a552eae8e50973049483

SHA512
594c2a0d0eec475cd9e75a54d92559d15972ec7f7a9d87010f4d365d8e5c6f5e668f75a9c6a8e12d1614ceaace2fcba552976e78603c0c6679d3d7d7b2ab6dd4

Download Submit
C:\Windows\SysWOW64\Ekaapi32.exe

Filesize
337KB

MD5
06d5f8ce3e9445074c58b9a287002d95

SHA1
7bdf07989b74f80a0102c6c742f5ca11be623365

SHA256
1e871703748bcde493804a64045b324ee7c7d5ce9d821b72d2e56bbf3e3fac3d

SHA512
6f432f44f3695839df55b1000c492b0859df4f299fd2b24b3da818fec7dd8c1da1895fe89d3c733cf642b8addd61a40c4a2706eb15026ca74dd146f5d381973d

Download Submit
C:\Windows\SysWOW64\Ekaapi32.exe

Filesize
337KB

MD5
06d5f8ce3e9445074c58b9a287002d95

SHA1
7bdf07989b74f80a0102c6c742f5ca11be623365

SHA256
1e871703748bcde493804a64045b324ee7c7d5ce9d821b72d2e56bbf3e3fac3d

SHA512
6f432f44f3695839df55b1000c492b0859df4f299fd2b24b3da818fec7dd8c1da1895fe89d3c733cf642b8addd61a40c4a2706eb15026ca74dd146f5d381973d

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
337KB

MD5
4b7094b4f51997c231870ce14b121eb6

SHA1
89c59bb9fb072afa947d5d93b3d0fb44cee59f4d

SHA256
d66451155d79ad2b547e81d0fa710663994de08df2c902f6f30d10884411f2d9

SHA512
817297f2bbfef7a1b1f096efa584f5b958e63a5f8a3898ae49d0b765e0c6a809d7b5e00513c7b30f28090eabc1fceb77453375f1faad7e412c7aa4ce9c990494

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
337KB

MD5
4b7094b4f51997c231870ce14b121eb6

SHA1
89c59bb9fb072afa947d5d93b3d0fb44cee59f4d

SHA256
d66451155d79ad2b547e81d0fa710663994de08df2c902f6f30d10884411f2d9

SHA512
817297f2bbfef7a1b1f096efa584f5b958e63a5f8a3898ae49d0b765e0c6a809d7b5e00513c7b30f28090eabc1fceb77453375f1faad7e412c7aa4ce9c990494

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
337KB

MD5
48a38e6a85455f3451304c99700345ed

SHA1
d8b7fce42268818d2f4061430263c188b3deccab

SHA256
a3c8f9a9bbfb44fa3d8fa574bacdd3720c922810e43968b4a03de71bcd3d7f5c

SHA512
28d96f7bfb5deb4077a7cfe673d98679597f0583de6286af60b83651e61b6aecd140d6c27bfcd23ad1df72b43f9fec6169d036831591efbbf118128329893440

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
337KB

MD5
48a38e6a85455f3451304c99700345ed

SHA1
d8b7fce42268818d2f4061430263c188b3deccab

SHA256
a3c8f9a9bbfb44fa3d8fa574bacdd3720c922810e43968b4a03de71bcd3d7f5c

SHA512
28d96f7bfb5deb4077a7cfe673d98679597f0583de6286af60b83651e61b6aecd140d6c27bfcd23ad1df72b43f9fec6169d036831591efbbf118128329893440

Download Submit
C:\Windows\SysWOW64\Eoideh32.exe

Filesize
337KB

MD5
e998486b682ba7dc760314ab6e4fd219

SHA1
6fd1c47fc944bc2018c9a0095985e86541b3c418

SHA256
4a482e53327aa79c183431f2850f507fc877f78c68df8bcb9ccb733b7757c43f

SHA512
e38c48f9eb4cbde3446e55bdc18066eb3fe2c73f8d5f33b2b690bbbcd803243dcca0f162956de260a6c2de0012a89fcf270d911b4427f7626f09f7ea893fa830

Download Submit
C:\Windows\SysWOW64\Eoideh32.exe

Filesize
337KB

MD5
e998486b682ba7dc760314ab6e4fd219

SHA1
6fd1c47fc944bc2018c9a0095985e86541b3c418

SHA256
4a482e53327aa79c183431f2850f507fc877f78c68df8bcb9ccb733b7757c43f

SHA512
e38c48f9eb4cbde3446e55bdc18066eb3fe2c73f8d5f33b2b690bbbcd803243dcca0f162956de260a6c2de0012a89fcf270d911b4427f7626f09f7ea893fa830

Download Submit
C:\Windows\SysWOW64\Fbgihaji.exe

Filesize
337KB

MD5
aa3318141c0b517695363b0349d15ffe

SHA1
7e54fc276a769acb22640d6847994b963cb6496f

SHA256
b9faa9c0e8abdf5519b9c8ae00865a7ac7e180d5c8d89d0f96ce4eb55f6ba5a6

SHA512
e5f48c69ea47b64b8ab8f7136735a67c1180f7d3fb61c1e29aa396cb8b0999b71a53299aff24c8a4aa4081da868de0d2a4d224e18bdcfdce3de0459e8f4f127b

Download Submit
C:\Windows\SysWOW64\Fbgihaji.exe

Filesize
337KB

MD5
aa3318141c0b517695363b0349d15ffe

SHA1
7e54fc276a769acb22640d6847994b963cb6496f

SHA256
b9faa9c0e8abdf5519b9c8ae00865a7ac7e180d5c8d89d0f96ce4eb55f6ba5a6

SHA512
e5f48c69ea47b64b8ab8f7136735a67c1180f7d3fb61c1e29aa396cb8b0999b71a53299aff24c8a4aa4081da868de0d2a4d224e18bdcfdce3de0459e8f4f127b

Download Submit
C:\Windows\SysWOW64\Fbpchb32.exe

Filesize
337KB

MD5
1dedb7fd9aad68ae4801cdc94af2b235

SHA1
3ebbce9a9e2eaf612397791e08986ca3b50f2f30

SHA256
816d27f2c7a56d073a4b5a247a1b1a0fb84a412b28af82bc86ae898cb47a2da6

SHA512
eb34c49e0ec295ee9a58cd9a992af7a8700620472db449c6ef6a06cc67d99293089edf65ead6d642c47d22160d2dbc5a8c0f19137159b1371b3e192d874824c9

Download Submit
C:\Windows\SysWOW64\Fbpchb32.exe

Filesize
337KB

MD5
1dedb7fd9aad68ae4801cdc94af2b235

SHA1
3ebbce9a9e2eaf612397791e08986ca3b50f2f30

SHA256
816d27f2c7a56d073a4b5a247a1b1a0fb84a412b28af82bc86ae898cb47a2da6

SHA512
eb34c49e0ec295ee9a58cd9a992af7a8700620472db449c6ef6a06cc67d99293089edf65ead6d642c47d22160d2dbc5a8c0f19137159b1371b3e192d874824c9

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
337KB

MD5
0c2c6119493e0efb2032a68122dfbe61

SHA1
1d09fc17f095a5a640f2ab354ad9b7a8924bcbcc

SHA256
9e6780729300c040b778c9daa334f33383b38a4e5129b24133d658de2ce307f3

SHA512
aae6bd56cf9988abb0ebf8f60ed2d900012ba166aaa8ebbfbf2f39622ae47a81e30cc642a16c2df347a26b685500bd78093253e057a827221126a9eac75b2352

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
337KB

MD5
0c2c6119493e0efb2032a68122dfbe61

SHA1
1d09fc17f095a5a640f2ab354ad9b7a8924bcbcc

SHA256
9e6780729300c040b778c9daa334f33383b38a4e5129b24133d658de2ce307f3

SHA512
aae6bd56cf9988abb0ebf8f60ed2d900012ba166aaa8ebbfbf2f39622ae47a81e30cc642a16c2df347a26b685500bd78093253e057a827221126a9eac75b2352

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
337KB

MD5
f47691e53742d7d71e714ed3d7d339ac

SHA1
8b3a297cbab6f62812e56ad1270287bdbaa17244

SHA256
98085089b02975ed946fb2f75fe1a82a712b5618e80ca368b95cabadd847f1bb

SHA512
c5e7ba0111d6c691be22417c50637d9baf58f7c8a1a984faabc4033c411456d9b7b0e4ea32fbbdfc12aa68e299eb1b824674598d082328f74c60a85cecc13f68

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
337KB

MD5
f47691e53742d7d71e714ed3d7d339ac

SHA1
8b3a297cbab6f62812e56ad1270287bdbaa17244

SHA256
98085089b02975ed946fb2f75fe1a82a712b5618e80ca368b95cabadd847f1bb

SHA512
c5e7ba0111d6c691be22417c50637d9baf58f7c8a1a984faabc4033c411456d9b7b0e4ea32fbbdfc12aa68e299eb1b824674598d082328f74c60a85cecc13f68

Download Submit
C:\Windows\SysWOW64\Fmcjpl32.exe

Filesize
337KB

MD5
26bb084d57185d284606a3428a2919fa

SHA1
797ef4c631dad717a6f37d8d601a90c14eba4a3f

SHA256
c1b828dd0c8cbead3e6281af53a7cba16ee196c1cbe383da6418fe321e926f81

SHA512
55f918f5a55b0c5385b9afc57a2aeb9029ea65fac8e663abdce8bf35046dfea17583151cae0af2299c3058a9d3580cdd23fe6eb473bf80a912c4601e1e22c2ae

Download Submit
C:\Windows\SysWOW64\Fmcjpl32.exe

Filesize
337KB

MD5
26bb084d57185d284606a3428a2919fa

SHA1
797ef4c631dad717a6f37d8d601a90c14eba4a3f

SHA256
c1b828dd0c8cbead3e6281af53a7cba16ee196c1cbe383da6418fe321e926f81

SHA512
55f918f5a55b0c5385b9afc57a2aeb9029ea65fac8e663abdce8bf35046dfea17583151cae0af2299c3058a9d3580cdd23fe6eb473bf80a912c4601e1e22c2ae

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
337KB

MD5
439f89c8d3b057576bad18b70fd6489c

SHA1
2875bdb308488bc64dffc83bcf888cb6129c0346

SHA256
eed9d8eb70a300e80b49fb37740f76a563b14ba38ae64d50dde9f1feefc5f469

SHA512
d97c5245ce6a0fdbb7be1fe5e0f9f42472427d07a53e8f1044af5e738102c436c5a13415a22feaadf6b157c08bea4cae0d991ffb1e5c5c3996c3e3cf06f5fbf0

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
337KB

MD5
439f89c8d3b057576bad18b70fd6489c

SHA1
2875bdb308488bc64dffc83bcf888cb6129c0346

SHA256
eed9d8eb70a300e80b49fb37740f76a563b14ba38ae64d50dde9f1feefc5f469

SHA512
d97c5245ce6a0fdbb7be1fe5e0f9f42472427d07a53e8f1044af5e738102c436c5a13415a22feaadf6b157c08bea4cae0d991ffb1e5c5c3996c3e3cf06f5fbf0

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
337KB

MD5
9333b14cc09294679709d6c29a3289ad

SHA1
b9b5df87cf83cc1dee26decc4f319847f2e3d617

SHA256
b07d2e0da1523f2c809ffc79349591a7c32ead5c8d48b7a8877ec3491fd79e09

SHA512
ad60ecdd5bad9cf0c91d98609a101a791a64f2114843922765fd1b8d2711f3baeeea49a06e60d308cc76895003cda9fcfc5d9cbf4d5a0b36068d95a11e0a4db5

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
337KB

MD5
9333b14cc09294679709d6c29a3289ad

SHA1
b9b5df87cf83cc1dee26decc4f319847f2e3d617

SHA256
b07d2e0da1523f2c809ffc79349591a7c32ead5c8d48b7a8877ec3491fd79e09

SHA512
ad60ecdd5bad9cf0c91d98609a101a791a64f2114843922765fd1b8d2711f3baeeea49a06e60d308cc76895003cda9fcfc5d9cbf4d5a0b36068d95a11e0a4db5

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
337KB

MD5
18179e38de1d09c9c1f253607aaa16aa

SHA1
017c5de5a02b823d05b148018e9aab1c55573139

SHA256
3efa8e0cd4e52fc6a804cc91831216e9d64b6d829621a7c7ac028972c3345bc0

SHA512
252535d989862bd4cdd98264585a7c81394f9ded10de51e5574ba97e6767c3ff6211747f10733184309bd1ee6c3f65577edd7ad0c9b29f4f755fc1f5187544df

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
337KB

MD5
18179e38de1d09c9c1f253607aaa16aa

SHA1
017c5de5a02b823d05b148018e9aab1c55573139

SHA256
3efa8e0cd4e52fc6a804cc91831216e9d64b6d829621a7c7ac028972c3345bc0

SHA512
252535d989862bd4cdd98264585a7c81394f9ded10de51e5574ba97e6767c3ff6211747f10733184309bd1ee6c3f65577edd7ad0c9b29f4f755fc1f5187544df

Download Submit
C:\Windows\SysWOW64\Gpnfge32.exe

Filesize
337KB

MD5
cb5876631fdabfbe7139d5f7ea0f3db9

SHA1
97bcd88fcd268e8f35024c8e6aea0179e4593a46

SHA256
d102645fcce287792f7c45720b3cc1a4ece25259a725fa046cfc4e30ff1676b7

SHA512
df32fe22a524ed9cc6b2a7dad5fbdaf5f7cdbeac289faeb580d7b6c9a85b52df01cf2acf069f9bce4c72135175c157c8d7535780ada2592f3a30f6bb5b8fbc00

Download Submit
C:\Windows\SysWOW64\Gpnfge32.exe

Filesize
337KB

MD5
cb5876631fdabfbe7139d5f7ea0f3db9

SHA1
97bcd88fcd268e8f35024c8e6aea0179e4593a46

SHA256
d102645fcce287792f7c45720b3cc1a4ece25259a725fa046cfc4e30ff1676b7

SHA512
df32fe22a524ed9cc6b2a7dad5fbdaf5f7cdbeac289faeb580d7b6c9a85b52df01cf2acf069f9bce4c72135175c157c8d7535780ada2592f3a30f6bb5b8fbc00

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
337KB

MD5
315f4e2418ff3bc6c0f762cf97672e21

SHA1
0bd5c67f96239429f851604436f0123c2565ce33

SHA256
1310523693cae72005eb2a850d48e5135e022a8e19321fe463b7949f88513ef5

SHA512
3a398102bfa993b37e93acc8017c2616b60f1f2160dc12be151649e1b9b1ade21ddf4790ab1f9dc93d6b10a8f1c5fdc543399e9bda0a2b6536d37823fba5631e

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
337KB

MD5
315f4e2418ff3bc6c0f762cf97672e21

SHA1
0bd5c67f96239429f851604436f0123c2565ce33

SHA256
1310523693cae72005eb2a850d48e5135e022a8e19321fe463b7949f88513ef5

SHA512
3a398102bfa993b37e93acc8017c2616b60f1f2160dc12be151649e1b9b1ade21ddf4790ab1f9dc93d6b10a8f1c5fdc543399e9bda0a2b6536d37823fba5631e

Download Submit
C:\Windows\SysWOW64\Kgiiiidd.exe

Filesize
337KB

MD5
1eeb8f28056d98101573182213b96a26

SHA1
90432e76d44676d3d6dbe4acb692de05220dd842

SHA256
db551a1999dbd2a1d03d2c30cade88f6870cae93473e06346a8c46b2640f92cf

SHA512
1d28c646ed09b4fbe7c518f2a2d42ce9c295ba390b18535c63ab7383c91e938ba9fad3e721b0510b1b39a0c5e61e39d49ddeaebe7623ff80fabe17d322f9b3cf

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
337KB

MD5
7534a2c45132638195eda8c3d6a22d94

SHA1
8a5dc78dc5ef63ef7f965e7006e48fdd98398079

SHA256
03a4bd49153e9ff5101c92b049b96f4fd8911fe4f91b072354529e0b870dcded

SHA512
356eb72efeeaf894e36c23a0a273f8b611625da7170345158b8a8560e90c9ea81d6dd8f7f811ee46f2dddcef804819dcfae4b4c3c263e6bdf6d50f90cc214d91

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
337KB

MD5
7534a2c45132638195eda8c3d6a22d94

SHA1
8a5dc78dc5ef63ef7f965e7006e48fdd98398079

SHA256
03a4bd49153e9ff5101c92b049b96f4fd8911fe4f91b072354529e0b870dcded

SHA512
356eb72efeeaf894e36c23a0a273f8b611625da7170345158b8a8560e90c9ea81d6dd8f7f811ee46f2dddcef804819dcfae4b4c3c263e6bdf6d50f90cc214d91

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
337KB

MD5
7534a2c45132638195eda8c3d6a22d94

SHA1
8a5dc78dc5ef63ef7f965e7006e48fdd98398079

SHA256
03a4bd49153e9ff5101c92b049b96f4fd8911fe4f91b072354529e0b870dcded

SHA512
356eb72efeeaf894e36c23a0a273f8b611625da7170345158b8a8560e90c9ea81d6dd8f7f811ee46f2dddcef804819dcfae4b4c3c263e6bdf6d50f90cc214d91

Download Submit
C:\Windows\SysWOW64\Mhjhmhhd.exe

Filesize
337KB

MD5
989fa2b49cb5fc1dd4644e953025fbe2

SHA1
c273c309de43c931851c4685a9e11d5d48a4815c

SHA256
e4a623bf73a6f4e0cdf9ca070aa1637988fa8dd02da9e0d5e446d75f37f2bcc4

SHA512
d8c7872a7786d2a838bddb2808befbc70c0983cb3a34993cb23ed0c5576ce22f32708070d92dc1e70779187aa5b0a27b42a176738837c0fa65b2ba0ce9e81bd9

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
64KB

MD5
eacbef9ddd594c924ba0c5150319e0d4

SHA1
ec80f6a0ca8c352dfa40aa961522fdf7b5ffd169

SHA256
515036f71ff0e54191cecd8a4cbfb913eb243a8ff616b9d016585004e681763c

SHA512
6baa5eaeaced1b132f251508186d4275743047028e859316bde8b27da5734fe6d3778c7b79fca93718c1aae063d00b696186b11a998136d9af76813be6faf1b2

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
337KB

MD5
bcf2bca13ce8366ee7806a1490596770

SHA1
45c957ec6d891d7548c01b5bf0dcf42748b395c5

SHA256
cc765f8ba1753d8442d9e7ae84011bcb0f1b6ab2e3d9f78990c112e85fcfde6c

SHA512
469ff7d60d7917afdbcbed2f9ae74e35452154c9086221de11c8860b7b7689ac2028d797fa615e23755adbb144b27531013b0d8b0a50e97c8acb50bb2d857955

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
337KB

MD5
bcf2bca13ce8366ee7806a1490596770

SHA1
45c957ec6d891d7548c01b5bf0dcf42748b395c5

SHA256
cc765f8ba1753d8442d9e7ae84011bcb0f1b6ab2e3d9f78990c112e85fcfde6c

SHA512
469ff7d60d7917afdbcbed2f9ae74e35452154c9086221de11c8860b7b7689ac2028d797fa615e23755adbb144b27531013b0d8b0a50e97c8acb50bb2d857955

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
337KB

MD5
ce8a60870aa1f4a74e1763b880b0bfc4

SHA1
aee285d2a4a3908fa6830ea336498bba5d17faf9

SHA256
4b721d01db251976eccf50969f44bc8f5451b965603286b52b7fe895aa6284ad

SHA512
715bf4bdf5613982df0de06d3531034a6f6d10983a6666275cdbb537325401eb8eceeceea03270555876768fed00920a027cba6f5fa0e06571fe8dc79c69c450

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
337KB

MD5
ce8a60870aa1f4a74e1763b880b0bfc4

SHA1
aee285d2a4a3908fa6830ea336498bba5d17faf9

SHA256
4b721d01db251976eccf50969f44bc8f5451b965603286b52b7fe895aa6284ad

SHA512
715bf4bdf5613982df0de06d3531034a6f6d10983a6666275cdbb537325401eb8eceeceea03270555876768fed00920a027cba6f5fa0e06571fe8dc79c69c450

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
337KB

MD5
e6ba6890b2565b2573bbe2a5933f1469

SHA1
c012396d985d1597ff58765f77ce9d9659c505c4

SHA256
002e2c3717251c93b42b9a14bcb751ed3b1cf2a402070f931bea950828b4ef1d

SHA512
1ebcf09d920b48dd8a8b781a2c42bcba359edb2a27cfcbd95cc54e5fa53bc515f910244d2ea81d36224d13baaa5f310a37226c4f80e7fea9d1a593f06d8d1e70

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
337KB

MD5
e6ba6890b2565b2573bbe2a5933f1469

SHA1
c012396d985d1597ff58765f77ce9d9659c505c4

SHA256
002e2c3717251c93b42b9a14bcb751ed3b1cf2a402070f931bea950828b4ef1d

SHA512
1ebcf09d920b48dd8a8b781a2c42bcba359edb2a27cfcbd95cc54e5fa53bc515f910244d2ea81d36224d13baaa5f310a37226c4f80e7fea9d1a593f06d8d1e70

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
337KB

MD5
996810fac6d80736653664b969b9c85c

SHA1
de5bc17cb5a1e7dc52ccd6de43914e0c87592677

SHA256
88e3f92a8f49c0b0e6d1ea8d4319e66eb9406f1130f2c690aaf9b1f1a80885ee

SHA512
a1097ba8e21c57c80f6ef058de118b097d49af17e7a0244934b9a64819020adc6d01cef971431a1f880dbb5a6767c6931a768d2b4b39cdf3bfdeb4a360da0c24

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
337KB

MD5
996810fac6d80736653664b969b9c85c

SHA1
de5bc17cb5a1e7dc52ccd6de43914e0c87592677

SHA256
88e3f92a8f49c0b0e6d1ea8d4319e66eb9406f1130f2c690aaf9b1f1a80885ee

SHA512
a1097ba8e21c57c80f6ef058de118b097d49af17e7a0244934b9a64819020adc6d01cef971431a1f880dbb5a6767c6931a768d2b4b39cdf3bfdeb4a360da0c24

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
337KB

MD5
3925af7b35f331d9f706ebb9515593a5

SHA1
3cce77a7109eed46fdf9bb6746769631abf30993

SHA256
503c3584499da12ecbdadeb53b1c74e1cdb3dcadd01dd20dc177de45a5882de7

SHA512
3805958a6c2d67c7d345cc5273ace2abc8eeeb76ed95c46486202d2cc2b3df5bc5124cd54059bc530540651977d50e2c4cec1d7690ad458226f881751ef92b4f

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
337KB

MD5
3925af7b35f331d9f706ebb9515593a5

SHA1
3cce77a7109eed46fdf9bb6746769631abf30993

SHA256
503c3584499da12ecbdadeb53b1c74e1cdb3dcadd01dd20dc177de45a5882de7

SHA512
3805958a6c2d67c7d345cc5273ace2abc8eeeb76ed95c46486202d2cc2b3df5bc5124cd54059bc530540651977d50e2c4cec1d7690ad458226f881751ef92b4f

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
337KB

MD5
6353d7949eff633a551cfaf04e43a368

SHA1
f5e24784c815bd7fcd7c5753575c05826a58ea52

SHA256
14be13b8b00c5129ac01fa3132d86e550a868a5a6d2b89a0fe805509ff3a9f77

SHA512
042a8b10b1930d07d45c450eedacf0c4e8a02b6bc3ddf5879636254802f9b10896fa2ff1f0053986b453261b311815f7e136a788f83f38950f45326fa7cacb1e

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
337KB

MD5
6353d7949eff633a551cfaf04e43a368

SHA1
f5e24784c815bd7fcd7c5753575c05826a58ea52

SHA256
14be13b8b00c5129ac01fa3132d86e550a868a5a6d2b89a0fe805509ff3a9f77

SHA512
042a8b10b1930d07d45c450eedacf0c4e8a02b6bc3ddf5879636254802f9b10896fa2ff1f0053986b453261b311815f7e136a788f83f38950f45326fa7cacb1e

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
337KB

MD5
a16b3cc20ea0d28bf65023bd7c76a8dc

SHA1
b10f4237f77d572e845a00eb61c2acc95571986b

SHA256
2cfc9f54558752b6962c54c4b66876d6d870ad5fcb018ec84baf58029f84a2de

SHA512
fd676b63f7662848adf841a89e1c6e2a3c4b29fef5e36e7438dc83ffb3f06dddc1fb08c33a16588a17fe842f4df466f3a580b9ea8fdc4336bdbddfb4de69a74a

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
337KB

MD5
a16b3cc20ea0d28bf65023bd7c76a8dc

SHA1
b10f4237f77d572e845a00eb61c2acc95571986b

SHA256
2cfc9f54558752b6962c54c4b66876d6d870ad5fcb018ec84baf58029f84a2de

SHA512
fd676b63f7662848adf841a89e1c6e2a3c4b29fef5e36e7438dc83ffb3f06dddc1fb08c33a16588a17fe842f4df466f3a580b9ea8fdc4336bdbddfb4de69a74a

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
337KB

MD5
3bbec26924fed81c7fed046d0dbcc9ba

SHA1
25186693d8adf711df154b14ad4e727e59a1703a

SHA256
bc4cdb997442181b95473d1842e88b6895529d7c158d3ba0770dbac61226472c

SHA512
43435a12c09ace1b3f8a112e024714a11fc73e9c57182d42d821d78da6a5a71f396e49e2eb007e7dd8634e8cfc04c5bd8974e61e178e2cd294515975e11679f9

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
337KB

MD5
3bbec26924fed81c7fed046d0dbcc9ba

SHA1
25186693d8adf711df154b14ad4e727e59a1703a

SHA256
bc4cdb997442181b95473d1842e88b6895529d7c158d3ba0770dbac61226472c

SHA512
43435a12c09ace1b3f8a112e024714a11fc73e9c57182d42d821d78da6a5a71f396e49e2eb007e7dd8634e8cfc04c5bd8974e61e178e2cd294515975e11679f9

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
337KB

MD5
e63428a1eea89a36646472dbc63e162c

SHA1
6f6229aa31dcd6df61e206a0a962c5603cb49249

SHA256
9419a55354b5ab7f5633896ee21984cb9f276c3b18f2c2a45e4505f33e889494

SHA512
cde2eaef21473d8a12e1a14a70319b7d5ddd7219c9e6d8f40d3b337c6f9a501ab82a786aa30b529ff9dca386027266d561ed3350d5e678fbf771563569f4122d

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
337KB

MD5
e63428a1eea89a36646472dbc63e162c

SHA1
6f6229aa31dcd6df61e206a0a962c5603cb49249

SHA256
9419a55354b5ab7f5633896ee21984cb9f276c3b18f2c2a45e4505f33e889494

SHA512
cde2eaef21473d8a12e1a14a70319b7d5ddd7219c9e6d8f40d3b337c6f9a501ab82a786aa30b529ff9dca386027266d561ed3350d5e678fbf771563569f4122d

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
337KB

MD5
7139f655009d996624934c3857ccb58b

SHA1
5d808733394ed042ac8a34406957d1a6b81ada86

SHA256
17bcecdc0bca8cdffeb251fd88f4fbb2ff8b416e44ee82ad2f228f80797a25a1

SHA512
1257ce56e7585c7acb93f94cca9e2eaad4caa36fd674afa28c3e15f6cf6fb236da60827290e3e21cd0e90fe801c125dc264bd420830beb4f639d7792ab715388

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
337KB

MD5
7139f655009d996624934c3857ccb58b

SHA1
5d808733394ed042ac8a34406957d1a6b81ada86

SHA256
17bcecdc0bca8cdffeb251fd88f4fbb2ff8b416e44ee82ad2f228f80797a25a1

SHA512
1257ce56e7585c7acb93f94cca9e2eaad4caa36fd674afa28c3e15f6cf6fb236da60827290e3e21cd0e90fe801c125dc264bd420830beb4f639d7792ab715388

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
337KB

MD5
8196bb1b985a1c42b518c5441d0640db

SHA1
7e3efa54d0898492448579205af2d64c54471ad5

SHA256
c79839f9d4fa0e73a3c59ecae4e93ddeb32d43e211815d6cec09ddafb030c337

SHA512
4df5b8bf606c080a7e5a17324d0299a92c9aa3c3b516fbd131d610f1d3337f483fabab518052cb4060ba608db7f71a2cf648f1ad4a79530a998b2aefda903be2

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
337KB

MD5
8196bb1b985a1c42b518c5441d0640db

SHA1
7e3efa54d0898492448579205af2d64c54471ad5

SHA256
c79839f9d4fa0e73a3c59ecae4e93ddeb32d43e211815d6cec09ddafb030c337

SHA512
4df5b8bf606c080a7e5a17324d0299a92c9aa3c3b516fbd131d610f1d3337f483fabab518052cb4060ba608db7f71a2cf648f1ad4a79530a998b2aefda903be2

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
337KB

MD5
5b12636541f2f66b37bc9e20ff5855f8

SHA1
934d6d2b61dcf57dde110087eeccf89e22e5ea0d

SHA256
4d2817a0235980bb09f99f769ec7b378138755c3f0dafb8531bcaaf6236e1ceb

SHA512
6aaa5c3299f9726eedf655c9cbfb80a89b1956ac30fb9ec3175453b55a1e8b2ef1a1022352deeaed7f8575d52920c037c0cae59c7fc559b9b8bc46983122b7dc

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
337KB

MD5
5b12636541f2f66b37bc9e20ff5855f8

SHA1
934d6d2b61dcf57dde110087eeccf89e22e5ea0d

SHA256
4d2817a0235980bb09f99f769ec7b378138755c3f0dafb8531bcaaf6236e1ceb

SHA512
6aaa5c3299f9726eedf655c9cbfb80a89b1956ac30fb9ec3175453b55a1e8b2ef1a1022352deeaed7f8575d52920c037c0cae59c7fc559b9b8bc46983122b7dc

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
337KB

MD5
6aa9f96fec0102d7c8f39b7368efb905

SHA1
7838f0b9dd5b4026ea91e87567398184629c704a

SHA256
c0845605dc728fd1e12384da0e4325bd334fb3d655d04c518d73dfd82172930c

SHA512
79131b4e6ff6c62e17e90e48af1f8ceb36e5d53f54a1b8e70abe19c3f778b3e031c9b9ac089504bd35770815a0e8d38d0e5d08e25b4f06b72a2e0cbd52e51c1d

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
337KB

MD5
6aa9f96fec0102d7c8f39b7368efb905

SHA1
7838f0b9dd5b4026ea91e87567398184629c704a

SHA256
c0845605dc728fd1e12384da0e4325bd334fb3d655d04c518d73dfd82172930c

SHA512
79131b4e6ff6c62e17e90e48af1f8ceb36e5d53f54a1b8e70abe19c3f778b3e031c9b9ac089504bd35770815a0e8d38d0e5d08e25b4f06b72a2e0cbd52e51c1d

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
337KB

MD5
b10c10852c43dd463e37f040855e05b1

SHA1
78f327879ffde4acfd057b18e88aec30cfff0394

SHA256
c85253043d79ba0dae34bc33b4f66ef2e159bf41deb78a4e73d887f0922e9d14

SHA512
886a7caaab7da42d8ff076d2494a04ef18dcf2b77357d61278099c42e9785d416cff45fbe5e406260757fb85a324f31a7e883f9034550218f473b9791ddb85a3

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
337KB

MD5
b10c10852c43dd463e37f040855e05b1

SHA1
78f327879ffde4acfd057b18e88aec30cfff0394

SHA256
c85253043d79ba0dae34bc33b4f66ef2e159bf41deb78a4e73d887f0922e9d14

SHA512
886a7caaab7da42d8ff076d2494a04ef18dcf2b77357d61278099c42e9785d416cff45fbe5e406260757fb85a324f31a7e883f9034550218f473b9791ddb85a3

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
337KB

MD5
b10c10852c43dd463e37f040855e05b1

SHA1
78f327879ffde4acfd057b18e88aec30cfff0394

SHA256
c85253043d79ba0dae34bc33b4f66ef2e159bf41deb78a4e73d887f0922e9d14

SHA512
886a7caaab7da42d8ff076d2494a04ef18dcf2b77357d61278099c42e9785d416cff45fbe5e406260757fb85a324f31a7e883f9034550218f473b9791ddb85a3

Download Submit
memory/60-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/60-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/512-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/652-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/704-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1316-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1344-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1432-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-118-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-469-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2752-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2964-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2964-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3588-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3868-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3868-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4184-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4184-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4232-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-481-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4476-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4712-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4716-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5008-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5008-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-475-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads