87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe
Size

110KB
MD5

fba4f47a94878a55f392306f2177724d
SHA1

9f0ba33cb73f9f68f5a929f85d403a68b0e3a94b
SHA256

87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2
SHA512

154e4b607aff370d7b1932b20fc5af6d54799aa1e4032fce904de71ebbc2b7949a5de1f787457a735fcbe768e158f7674f3ffa070a6a1305eef998c7dd5ac5b6
SSDEEP

1536:kB6LnBP5GX6Guer6SKfCxLfnto7vlcf72a5sqdDgsfsxxjmD6gUhPKIh8efvlQs:xBRGpKfCZG7vlcz2aWqdDg8oxjVfvl7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knlleepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loeolc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leoghn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kecabifp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djhpgofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjpijpdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjpijpdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jniood32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgfdmlcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gklnjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acilajpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daediilg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehiffh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kihnmohm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbcqiope.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Podmkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkdhjknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgihfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leoghn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gijekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nliaao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lclpdncg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkobjpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfjjga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpfjma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikcdlmgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlnbgddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhniccb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mldhfpib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdbfodfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jejefqaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlleaeff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogfcjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpneegel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlfelogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmqmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Felbnn32.exe

Executes dropped EXE 64 IoCs

pid	Process
4672	Llemdo32.exe
5112	Lmdina32.exe
3680	Lbabgh32.exe
2616	Lljfpnjg.exe
4032	Lgokmgjm.exe
4044	Lmiciaaj.exe
4772	Mdckfk32.exe
4296	Mgagbf32.exe
4784	Mmlpoqpg.exe
640	Megdccmb.exe
5060	Mlampmdo.exe
888	Mgfqmfde.exe
3004	Miemjaci.exe
1268	Migjoaaf.exe
1664	Mnebeogl.exe
4560	Ncbknfed.exe
4632	Ndcdmikd.exe
2936	Njqmepik.exe
3332	Ndfqbhia.exe
4380	Njciko32.exe
1428	Nggjdc32.exe
4012	Odkjng32.exe
2396	Ojgbfocc.exe
1816	Ofnckp32.exe
4164	Odocigqg.exe
4376	Ojllan32.exe
2512	Ocdqjceo.exe
2032	Oddmdf32.exe
5020	Ojaelm32.exe
3176	Pdfjifjo.exe
4748	Pflplnlg.exe
4984	Pqbdjfln.exe
4544	Pgllfp32.exe
4084	Pnfdcjkg.exe
1320	Pgnilpah.exe
2088	Qmkadgpo.exe
3852	Qgqeappe.exe
1404	Qnjnnj32.exe
4556	Qcgffqei.exe
928	Anmjcieo.exe
4440	Adgbpc32.exe
2988	Afhohlbj.exe
2620	Ambgef32.exe
4616	Afjlnk32.exe
3380	Aqppkd32.exe
3348	Acnlgp32.exe
4920	Ajhddjfn.exe
5100	Aminee32.exe
5088	Accfbokl.exe
440	Bfabnjjp.exe
4600	Bagflcje.exe
1992	Bcebhoii.exe
1352	Baicac32.exe
4620	Bgcknmop.exe
2688	Balpgb32.exe
1792	Bcjlcn32.exe
1216	Bjddphlq.exe
4208	Bclhhnca.exe
3400	Bfkedibe.exe
4116	Bnbmefbg.exe
3360	Bcoenmao.exe
3096	Cjinkg32.exe
3084	Cenahpha.exe
4808	Cfpnph32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mdckfk32.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Nggjdc32.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Baannc32.exe
File opened for modification	C:\Windows\SysWOW64\Cocjiehd.exe	Chiblk32.exe
File created	C:\Windows\SysWOW64\Gepmlimi.exe	Gkjhoq32.exe
File created	C:\Windows\SysWOW64\Gaopfe32.exe	Gkdhjknm.exe
File created	C:\Windows\SysWOW64\Ajqgidij.exe	Aokcklid.exe
File created	C:\Windows\SysWOW64\Kajimagp.dll	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Qpcecb32.exe	Qaqegecm.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Boihcf32.exe
File created	C:\Windows\SysWOW64\Cpkhqmjb.dll	Caojpaij.exe
File created	C:\Windows\SysWOW64\Fqokaeco.dll	Mhbmphjm.exe
File created	C:\Windows\SysWOW64\Opcqnb32.exe	Ohlimd32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Ncchae32.exe
File created	C:\Windows\SysWOW64\Gphgbafl.exe	Gklnjj32.exe
File created	C:\Windows\SysWOW64\Aaohcj32.exe	Aoalgn32.exe
File created	C:\Windows\SysWOW64\Bfnikd32.dll	Lcgpni32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Ebcdpe32.dll	Hakgmjoh.exe
File opened for modification	C:\Windows\SysWOW64\Gklnjj32.exe	Ghmbno32.exe
File created	C:\Windows\SysWOW64\Mminhceb.exe	Lenicahg.exe
File created	C:\Windows\SysWOW64\Lpamfo32.dll	Aaohcj32.exe
File opened for modification	C:\Windows\SysWOW64\Lbngllob.exe	Lkabjbih.exe
File created	C:\Windows\SysWOW64\Fgijpe32.dll	Bhpofl32.exe
File opened for modification	C:\Windows\SysWOW64\Megdccmb.exe	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Klfaapbl.exe	Kflide32.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Ckjknfnh.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Bdjinlko.dll	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Gaamlecg.exe	Gijekg32.exe
File opened for modification	C:\Windows\SysWOW64\Jibmgi32.exe	Jbiejoaj.exe
File opened for modification	C:\Windows\SysWOW64\Ollnhb32.exe	Ogpepl32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Iigdfa32.exe	Ibnligoc.exe
File created	C:\Windows\SysWOW64\Nbjklp32.dll	Djklmo32.exe
File created	C:\Windows\SysWOW64\Lbabgh32.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Iigkob32.dll	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Hbjoeojc.exe	Hlpfhe32.exe
File created	C:\Windows\SysWOW64\Ghmbno32.exe	Gpfjma32.exe
File created	C:\Windows\SysWOW64\Cnmqme32.dll	Ihbdplfi.exe
File created	C:\Windows\SysWOW64\Jilpfgkh.dll	Dkndie32.exe
File created	C:\Windows\SysWOW64\Nomncpcg.exe	Nlnbgddc.exe
File opened for modification	C:\Windows\SysWOW64\Mnebeogl.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Glojhi32.dll	Eaakpm32.exe
File opened for modification	C:\Windows\SysWOW64\Mojhgbdl.exe	Mlklkgei.exe
File opened for modification	C:\Windows\SysWOW64\Ccgajfeh.exe	Cibmlmeb.exe
File created	C:\Windows\SysWOW64\Dfgjhf32.dll	Ghmbno32.exe
File created	C:\Windows\SysWOW64\Ihdafkdg.exe	Iqmidndd.exe
File created	C:\Windows\SysWOW64\Mpnnle32.exe	Midfokpm.exe
File opened for modification	C:\Windows\SysWOW64\Ncchae32.exe	Ncqlkemc.exe
File created	C:\Windows\SysWOW64\Jponoqjl.dll	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Kqjkhbpd.dll	Dcjnoece.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Gkglja32.exe	Gdncmghi.exe
File created	C:\Windows\SysWOW64\Pkpimfpo.dll	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Hkmnln32.exe	Hdbfodfa.exe
File created	C:\Windows\SysWOW64\Ginlmijp.dll	Lhncdi32.exe
File created	C:\Windows\SysWOW64\Pflplnlg.exe	Pdfjifjo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7884	2616	WerFault.exe	639

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcpgb32.dll"	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijjli32.dll"	Kecabifp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iidphgcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnecbhin.dll"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gepmlimi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaopfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpmbai32.dll"	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gahcmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcigfeaf.dll"	Mnnkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkogl32.dll"	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbgoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhdqnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpnnle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbgpnkdm.dll"	Nhkikq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehjhee32.dll"	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niklpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohjlgefb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chfegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpfcdojl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Filiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ealkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfnikd32.dll"	Lcgpni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioambknl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjlkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iqmidndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkngke32.dll"	Jleijb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmplqd32.dll"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjneln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oidhlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dicdcemd.dll"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihjjl32.dll"	Acilajpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Megdccmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhdqnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kalhafbk.dll"	Okchnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoonaj32.dll"	Iigdfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhniccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhkgoiqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffpicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pijmiq32.dll"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkank32.dll"	Ijhjcchb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonnoglh.dll"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleecc32.dll"	Mmlpoqpg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4672	1560	87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe	88
PID 1560 wrote to memory of 4672	1560	87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe	88
PID 1560 wrote to memory of 4672	1560	87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe	88
PID 4672 wrote to memory of 5112	4672	Llemdo32.exe	89
PID 4672 wrote to memory of 5112	4672	Llemdo32.exe	89
PID 4672 wrote to memory of 5112	4672	Llemdo32.exe	89
PID 5112 wrote to memory of 3680	5112	Lmdina32.exe	90
PID 5112 wrote to memory of 3680	5112	Lmdina32.exe	90
PID 5112 wrote to memory of 3680	5112	Lmdina32.exe	90
PID 3680 wrote to memory of 2616	3680	Lbabgh32.exe	91
PID 3680 wrote to memory of 2616	3680	Lbabgh32.exe	91
PID 3680 wrote to memory of 2616	3680	Lbabgh32.exe	91
PID 2616 wrote to memory of 4032	2616	Lljfpnjg.exe	92
PID 2616 wrote to memory of 4032	2616	Lljfpnjg.exe	92
PID 2616 wrote to memory of 4032	2616	Lljfpnjg.exe	92
PID 4032 wrote to memory of 4044	4032	Lgokmgjm.exe	93
PID 4032 wrote to memory of 4044	4032	Lgokmgjm.exe	93
PID 4032 wrote to memory of 4044	4032	Lgokmgjm.exe	93
PID 4044 wrote to memory of 4772	4044	Lmiciaaj.exe	94
PID 4044 wrote to memory of 4772	4044	Lmiciaaj.exe	94
PID 4044 wrote to memory of 4772	4044	Lmiciaaj.exe	94
PID 4772 wrote to memory of 4296	4772	Mdckfk32.exe	95
PID 4772 wrote to memory of 4296	4772	Mdckfk32.exe	95
PID 4772 wrote to memory of 4296	4772	Mdckfk32.exe	95
PID 4296 wrote to memory of 4784	4296	Mgagbf32.exe	96
PID 4296 wrote to memory of 4784	4296	Mgagbf32.exe	96
PID 4296 wrote to memory of 4784	4296	Mgagbf32.exe	96
PID 4784 wrote to memory of 640	4784	Mmlpoqpg.exe	97
PID 4784 wrote to memory of 640	4784	Mmlpoqpg.exe	97
PID 4784 wrote to memory of 640	4784	Mmlpoqpg.exe	97
PID 640 wrote to memory of 5060	640	Megdccmb.exe	98
PID 640 wrote to memory of 5060	640	Megdccmb.exe	98
PID 640 wrote to memory of 5060	640	Megdccmb.exe	98
PID 5060 wrote to memory of 888	5060	Mlampmdo.exe	100
PID 5060 wrote to memory of 888	5060	Mlampmdo.exe	100
PID 5060 wrote to memory of 888	5060	Mlampmdo.exe	100
PID 888 wrote to memory of 3004	888	Mgfqmfde.exe	101
PID 888 wrote to memory of 3004	888	Mgfqmfde.exe	101
PID 888 wrote to memory of 3004	888	Mgfqmfde.exe	101
PID 3004 wrote to memory of 1268	3004	Miemjaci.exe	102
PID 3004 wrote to memory of 1268	3004	Miemjaci.exe	102
PID 3004 wrote to memory of 1268	3004	Miemjaci.exe	102
PID 1268 wrote to memory of 1664	1268	Migjoaaf.exe	104
PID 1268 wrote to memory of 1664	1268	Migjoaaf.exe	104
PID 1268 wrote to memory of 1664	1268	Migjoaaf.exe	104
PID 1664 wrote to memory of 4560	1664	Mnebeogl.exe	105
PID 1664 wrote to memory of 4560	1664	Mnebeogl.exe	105
PID 1664 wrote to memory of 4560	1664	Mnebeogl.exe	105
PID 4560 wrote to memory of 4632	4560	Ncbknfed.exe	106
PID 4560 wrote to memory of 4632	4560	Ncbknfed.exe	106
PID 4560 wrote to memory of 4632	4560	Ncbknfed.exe	106
PID 4632 wrote to memory of 2936	4632	Ndcdmikd.exe	108
PID 4632 wrote to memory of 2936	4632	Ndcdmikd.exe	108
PID 4632 wrote to memory of 2936	4632	Ndcdmikd.exe	108
PID 2936 wrote to memory of 3332	2936	Njqmepik.exe	109
PID 2936 wrote to memory of 3332	2936	Njqmepik.exe	109
PID 2936 wrote to memory of 3332	2936	Njqmepik.exe	109
PID 3332 wrote to memory of 4380	3332	Ndfqbhia.exe	110
PID 3332 wrote to memory of 4380	3332	Ndfqbhia.exe	110
PID 3332 wrote to memory of 4380	3332	Ndfqbhia.exe	110
PID 4380 wrote to memory of 1428	4380	Njciko32.exe	111
PID 4380 wrote to memory of 1428	4380	Njciko32.exe	111
PID 4380 wrote to memory of 1428	4380	Njciko32.exe	111
PID 1428 wrote to memory of 4012	1428	Nggjdc32.exe	112

C:\Users\Admin\AppData\Local\Temp\87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe
"C:\Users\Admin\AppData\Local\Temp\87d41a3b559e221e4daa136faed38a9721177f792736402f0ed4789edab728f2.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\Llemdo32.exe
  C:\Windows\system32\Llemdo32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\Lmdina32.exe
    C:\Windows\system32\Lmdina32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\Lbabgh32.exe
      C:\Windows\system32\Lbabgh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        23⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        25⤵
        Executes dropped EXE
        
        PID:1816
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        27⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        28⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        29⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        32⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        34⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        36⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        37⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        39⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        40⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        41⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        43⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        44⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        45⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        46⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3348
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        48⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        49⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        50⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:440
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4600
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        53⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        54⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        55⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        57⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        58⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        59⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        60⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        61⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        62⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        63⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        64⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        66⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        67⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        68⤵
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        69⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        70⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        71⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3748
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        73⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        74⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        75⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        76⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        77⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        78⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        79⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        80⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        81⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        82⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        83⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        84⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        85⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        86⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        87⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        88⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        90⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        92⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        93⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        94⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        95⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        96⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        97⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        98⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        99⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        100⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        101⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        102⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        103⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        104⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        105⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        107⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        108⤵
        Drops file in System32 directory
        
        PID:4228
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        110⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        111⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        112⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        113⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        114⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        115⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        116⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        117⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        118⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        119⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        120⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        121⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        122⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        123⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        124⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        126⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        127⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3124
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        129⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        130⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        131⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        132⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        133⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        134⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        135⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        136⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        137⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        138⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        139⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        140⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        141⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6752
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        143⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        146⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        147⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7024
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        149⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        150⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        151⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        152⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        154⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        155⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        157⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        158⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        160⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4636
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        162⤵
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        163⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        164⤵
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        165⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        166⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        167⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        168⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        169⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        170⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        171⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        172⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        173⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        174⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        175⤵
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        176⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        177⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        178⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        179⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        180⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        181⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        182⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3284
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2456
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        186⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        187⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        188⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        190⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        191⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        192⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        193⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        194⤵
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        196⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        197⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        198⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        199⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        201⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        202⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        203⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        204⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        205⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        206⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7484
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        208⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        210⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        211⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        212⤵
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        213⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Amfjeobf.exe
        
        C:\Windows\system32\Amfjeobf.exe
        216⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        217⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        218⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        219⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        220⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        221⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        222⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        223⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        224⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        225⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        226⤵
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        227⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        228⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        229⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        230⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        231⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        232⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        233⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        235⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        236⤵
        Drops file in System32 directory
        
        PID:8120
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        238⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        239⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        240⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        241⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        242⤵
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        243⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        244⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        245⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        246⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        247⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        248⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        249⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        250⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        251⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        252⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        253⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        255⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        256⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        258⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        259⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        260⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        261⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        265⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        266⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        267⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        268⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        269⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        270⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        271⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        272⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        273⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        274⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        275⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        276⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        277⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        278⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        279⤵
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        280⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        281⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        282⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        283⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        285⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        286⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        287⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        288⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        289⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        290⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        291⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        292⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        294⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        295⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        296⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        297⤵
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        298⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        299⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        300⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        301⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        302⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        303⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        304⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        306⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        308⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        309⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        310⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        311⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        312⤵
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        313⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        314⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        315⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        316⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        317⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        318⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        319⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        320⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        321⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        322⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        323⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        324⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        325⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        326⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        327⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        328⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        329⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        331⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        332⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        333⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        334⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9708
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        337⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        338⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9836
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        340⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        341⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        342⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        343⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        344⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        345⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        346⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        347⤵
        Modifies registry class
        
        PID:10192
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        348⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        349⤵
        Modifies registry class
        
        PID:9256
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        351⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        352⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        353⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        354⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        355⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        356⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        357⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        358⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        359⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        360⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        361⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        362⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        363⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        364⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9740
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        367⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        368⤵
        Drops file in System32 directory
        
        PID:9996
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        369⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        370⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        371⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        372⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        373⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        374⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        375⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        376⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        377⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        378⤵
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        379⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        380⤵
        Drops file in System32 directory
        
        PID:468
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        381⤵
        Drops file in System32 directory
        
        PID:3488
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        382⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        383⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        384⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        385⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        386⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        387⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        388⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        389⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        390⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        391⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4472
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        393⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        394⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        395⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        396⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        397⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        398⤵
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        399⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        401⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3680
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        402⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        403⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        404⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        405⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        406⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        407⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        408⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        409⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        410⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        411⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        412⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        413⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        414⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        415⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        416⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        417⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        418⤵
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        419⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        420⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:776
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        422⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        423⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        424⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        425⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        426⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        427⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        428⤵
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        429⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        430⤵
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3852
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        432⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        433⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        434⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        435⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        436⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        437⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        439⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        440⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        441⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        442⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        443⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        444⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        445⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        446⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        447⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        448⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        449⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4528
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        451⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        454⤵
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        456⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        457⤵
        
        PID:668
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        458⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        459⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        460⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        461⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        462⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        463⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        464⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        465⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        466⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        467⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        468⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        469⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4664
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        471⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        472⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        473⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        474⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        475⤵
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        476⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        477⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        478⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        479⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        480⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        481⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        482⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        483⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        484⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        485⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        486⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        487⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        488⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        489⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        490⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        491⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        492⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        493⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        494⤵
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        495⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        496⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        497⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        498⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        499⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        500⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        502⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        503⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        504⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        505⤵
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        506⤵
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4816
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        508⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        509⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        510⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        511⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        512⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        513⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        514⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        515⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7272
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        517⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        518⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        519⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        520⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        521⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        522⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        523⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        524⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        526⤵
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        527⤵
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        528⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        529⤵
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        530⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        531⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        532⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        533⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        534⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        535⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        536⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        537⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        538⤵
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        539⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 400
        540⤵
        Program crash
        
        PID:7884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2616 -ip 2616
1⤵
PID:7776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
110KB

MD5
df810b19f2737412c6d6229add20ae82

SHA1
61d17e821fc29282805fab2302eaeea00556126f

SHA256
05c0f8224c586d5b16cd01d67fcdf816c5c0538729659859fc7922cb0e925305

SHA512
5b37b2f1041d308e2befcf1d3d67254dc4600d516db775f7cb58311b1bc48e0d63827452d7605b8dcd590bcf54de48d3f8661c37c8c100d6212f6a552258d628

Download Submit
C:\Windows\SysWOW64\Cfogeb32.exe

Filesize
110KB

MD5
c338efb42d69114575f12d7edd370c2e

SHA1
2a0049c6941e751b4d926e419c67d35ec335bcac

SHA256
1decc48cf4e1cf20bdb5a0dbc1c7bda00349f73b3af190639ab87dafc7fb491b

SHA512
6753f4fc11981ddf6f3dadbf835cbd00421be83673ab0425634b89e2bf6fe5972343dad7f1858b3e2da99e2848b56a051c41899032fd7fd03951f9c4c0fa1a5d

Download Submit
C:\Windows\SysWOW64\Dahhio32.exe

Filesize
110KB

MD5
59d9cd8dd9d47a7509d82b5c04f51036

SHA1
acd77143491ac8d8b59ab35825e772b2c9fa618c

SHA256
966e4526bad24045893f9dbb91535c90067c164cdaee2e398699367fe1ea24f1

SHA512
a58c81877f809f0a5593001e6805951fedc4d2d2b1fd3766ead29ec11a08bb9d593c0cc93f3d234cd3077438a2d2e4fcda828243ad900548a0fa1706bd617c74

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
110KB

MD5
f4395ab417a44f5d4876a7f4d4dff40c

SHA1
6399e73d6798315124a5ca76b6e90068d4a23a88

SHA256
69138307355686eef8caaff20d3bee41a69a9b466996345c5507a11b29d17547

SHA512
afa04a3b6c389fbee0c84d27ef10660802f86970c77a90a3e9088280da7523b4d573f72b4849374290306d4ee3a24bbe704cce2476c35c1045b599ec77222314

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
110KB

MD5
b059c908f2a5687363b98f71a6cfefd7

SHA1
7be7abf8326a9dd9d258ec2665f28437bebc8e82

SHA256
c3f76ddc672803da00e1db8917488a41c441e75106f33b6418a5d33485aebe0a

SHA512
79c3cf381c7d905b2b21ec28833a5edae855f2c53eb0756b7f6fac66550f95f9bc30108319eaa2322592aa6932faefed0cea19dc734011c606923fc6ba0eefe1

Download Submit
C:\Windows\SysWOW64\Ealadnik.exe

Filesize
110KB

MD5
aee035b2f0bdebbf4af38cc6e660ae09

SHA1
965accf7de48ac11e5c23a9cb0aea99097cffe57

SHA256
3a56fbf35fd7a2114874ce74349535365e6b129d67e21139e2be122edd357889

SHA512
29b07bad6ca74874dac71a158a07e72bd46fe70f25de6335fa87bdf3fec00dab44667c4515eac6a2fbd38da5f60aef0d25419b27885db1fbaaf41a79068f32ad

Download Submit
C:\Windows\SysWOW64\Edemkd32.exe

Filesize
110KB

MD5
94c00ce877c06feca66b68d4fd4189a5

SHA1
9e7b91ee3d12ca9ca410d63fd000c39f0f76e473

SHA256
8aa0ebde12cc164f606b23e643b10bfadd6093d34f2255e09fe576191c82b068

SHA512
c9ace882d30824c4f635fb45d95403e5cd1a973bfc0a063b9e29b3f8ab557a23c40cc406356d44d580fd81454b680ffeafc4da728bbad338982394cb1c046a6f

Download Submit
C:\Windows\SysWOW64\Filiii32.exe

Filesize
110KB

MD5
267d05a57db85efc226b9811735088af

SHA1
458fbb166f1d6020f63426b4f7e2b1f9e96021ce

SHA256
3fafd2763472ddc32fd3e5924cf20261a9b3423c4782932bab6d87d49d7401c5

SHA512
1b7484eea73845fda93731e2f02e5322dd353c98ca6f18673aac95726fc6d6c5188af46a45d8731c49570def1b1beb718f13c29c2db1e8c65970e136e672562e

Download Submit
C:\Windows\SysWOW64\Fkllnbjc.exe

Filesize
110KB

MD5
3bf3fc2d92391513ce6dc8392e2b366d

SHA1
6c545b6abbda9131a1504060620c646e4cf974c3

SHA256
e684fa4fb615b1f8e1ba9208fcf039af00db27d736929319c0c55e265bbfa8b2

SHA512
880a827c2955d72df2bd7f772938e780c83f39dcd420f7ea5ee67f12120f8a542129d819ef0ea9fd32cbc29f55e6ba670cdeb6d578d2d9c7f72a8ef581daa7fc

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
110KB

MD5
84d24ed021f31e62f600b4d4c62fe8ba

SHA1
6b2beccf4b7e22f37f63ce893a6de27f26a17bc9

SHA256
4fbf90e0eed9fbb5842239790585005b9db6b1298c999fded71fee7f0cdc7619

SHA512
2466fd64de79f8e2bbf3e68e61e8c07fe3b301443fa57f0bfec3ecc15d70ee534d9a40216f176cce7339697ecc36426c32da053f17d8698e503e07fdff05d744

Download Submit
C:\Windows\SysWOW64\Jejefqaf.exe

Filesize
110KB

MD5
2ea061bc8c68027db56b4b6aa4618100

SHA1
da7e8e943d40db678490a873083ba903ed9ac88e

SHA256
6c5a6c7eb192490d79aae8262d01807f17afcd97f5f0c1d3829a13ca8268fc10

SHA512
9296ab5c7fbb6ecdf3d2ace6f988d30f20544db5131f67584c716476acb74dd3b685baa75b6b9f9fefdac5ba265f50b128f09250d072fb62c0a872b7a39e095a

Download Submit
C:\Windows\SysWOW64\Jkhngl32.exe

Filesize
110KB

MD5
b89f0fbdf7064afce3376bc573456fed

SHA1
87438461c0ba5dbe6ac0f11a5cddd086927e1778

SHA256
b70f814b7a8a52f694efb618a64ba911640b68b518147e2af3aa513d2c93b18e

SHA512
83e1d6dda1bbd286713e1105e10f0b5f877b4ce5e3cfaababd5e67bc0fcd7f28d9eb4ccecdf6d3df8e3f63c573d991d09731c961299104fefacb5ade5a2a8cd1

Download Submit
C:\Windows\SysWOW64\Klfjijgq.exe

Filesize
110KB

MD5
c3b3168d92c812ed9b7e065f61353f9d

SHA1
3dcd6db6e5cbabc534b802b4c25459fd4ae97e31

SHA256
8105fe9bc611e92d98d35b3ce7c0f5f3dc7caed441496aa8a381fd246a097d08

SHA512
2cb1c977cde708a995ac9ef2add5d36032e0cfdcbe0f5f9b9d443a531d835364ef10529353ae0d91b9ccae3de10f0f4a8bf3c4b5a63fd7738ff430fe9e9be27a

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
110KB

MD5
995a4a4069388d4ab5ac3f9202c56f81

SHA1
5fc395d9c25fd57e613d375bc20b2fc93f274f2e

SHA256
4f1c861ecfa511730724e1e35b824e71db7e6bdb9f6c663fb20f6650f7ff6d85

SHA512
0b92ac00c8cf1dcf8786c2b504bb407141a5aa31bbe1a73a53c4def5346be57ca89bf10fff741a077ec81ea1ba9ed7dcc0663ce9228fa32d0bc22854aebbf92e

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
110KB

MD5
be0a7df84109090499b6bb6086871817

SHA1
525ad920ade0d261ec548784d8f54040c7585e01

SHA256
66b8f8f9275712e5190326f782271a684728a5e64a290adf6f8709385cf156f5

SHA512
93393c892ba8800d4ba923983ff3b3e3f715ab912c023a878a72968a998a4d860327adc1fe6832589e687e08a87308105e0d32cb14366707c16df7ab98bb4d3c

Download Submit
C:\Windows\SysWOW64\Llemdo32.exe

Filesize
110KB

MD5
a47443b5390ff7c20107d4db13d8c989

SHA1
355ce8bbe794a200456bacb6bdb223dfb735c073

SHA256
44644bf928344f7af784bea59422c9ed97a21ffb0432293c852a021ab0eeb422

SHA512
720284b63ab88ad7e07441848de51ac18e19fa876dbf7aaca113066e741f574b87ddfaacd106f2c673bf38fe478e2ad36718e3da0d1239a09ef69e354f1ef1b7

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
110KB

MD5
70a086bc562088af46d6c9f869ab26e9

SHA1
498223c1826dcd19c907ad4beacc10275cae7b94

SHA256
e027610e820aba97adda06617e2361d42adc394f6ca4eb2d6b62fd0f16628435

SHA512
c1443a6c39ff24b06b0a020668d5c2ee4510775d9b73885dea7f963993c4119c7cf6dd8eb32babc6455391ab771e9b537525d617629ff5316f37724bf48cc9e4

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
110KB

MD5
3c405409bcb5d6fc9add6e7a4b815124

SHA1
da7a85daa77cdc8b987668b1865347d828e1a3e5

SHA256
456a41c38e265fd39ecbc8eaa75da7aa47effa17ee8f9a6581babdf969fb8c44

SHA512
fb82a6109685c0092965d255b2fda38a5fee37547d037a486682d4ba75aacdb0445e748cb89d6e204fb85b09a41a031f7777e0446fa40aeebe72f03b233f6f2c

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
110KB

MD5
d3f351c9aa237d76f1f567220608ea0d

SHA1
1b8fe7040f8b7d772c386e40afafdb87b40c5979

SHA256
8cd76e9cac7d8e08bc9b19029607ea6a41f6bef311305e614386bc245caf9b6c

SHA512
719f02c4ed5496026588558795bef6c8056c00e99c388823481b672cc4d6eaa95b7913aff2629d615f454f44c174c5f2f3092be06e81678e20ba64d7517885be

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
110KB

MD5
5513dfa2f7824905d73b35efffbd051b

SHA1
58f93253b8d668e266649b742886fc11035e992a

SHA256
620e5282bf60a0f8c2c0c073f4e319ae8c006d57584ffe0d1ab41062a2400cd8

SHA512
2262d84743f0dd789f25f8bfac826d422c866ff7baa3610adb5b8df986941aa13e78e3183f1b1cdb6bb7a892a35844b4f7f081c46e2cd163b74ea22194c1c995

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
110KB

MD5
35e1bedfb02e942833bb0691141f0f55

SHA1
6917bcc74a5f92db5d2741e96bc402753eaf2c53

SHA256
6a41ef24a8c3faa8c3e1f3d806f23fa67622b2495cd99f5d3558ca47277867fe

SHA512
58af923644521f5f3798bac16e92dac7cb54574ee4d6f299a97df3d79f45c347bbba6126b30068215a2a0e6af3edd17eec07eda32fd8dd352589deef67bedef9

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
110KB

MD5
3611831d414fd33de00ea4273234c38c

SHA1
e4fd600365cdfa692844e6843ea294e06896e86b

SHA256
2c6d6561e654a8bc0fcf36cb6736a46854a6b2532da2989b62703d0ecf9e3504

SHA512
71807222f8ada011c15c14d66d799743d172ad4fcddf74c977c7cdf5551f75cea54688fe35997911f656dd07a615bf268c45daa01597891b60f674983e8c8518

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
110KB

MD5
6360836126f75b1505dd0eafa5f149dc

SHA1
57c56414b37a0df43b0c41e04a34103f6a3c1a26

SHA256
76d145d14eb53f58bfdd6a954566dc6ececaeda60b2e667fe5d7e86a3692b532

SHA512
fa5c4d40db41348b889ac868e6b1621e6e99d4688079caa941f3623fe5481deafc2b7f96b2583d1f16337f29530cbb5f111f3b971c39be49df8502a55cdc16a0

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
110KB

MD5
377b9ef78947824165504149aabd8cd7

SHA1
59bd91887cf6312821878260ae5c2b01768df2f5

SHA256
7d4b142d4eef7d7f2f0bb585399d03e3f22ea460be07bba7966edc832cc0676f

SHA512
cbe3a65e9433c457d0b1d868b98b22e5a3c41ca3adb98c76ca64e8ac983d2188193780c3a36dcac4f43e515c6556cee9df904de05941bdb63b7c016d60cdae75

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
110KB

MD5
d7861160b3a803d04ef1c5a9eae15631

SHA1
033001b7495b50437c953c21f86e299a40def7e7

SHA256
31f3cf8067ceff1ce6b192bbab99d31ee90b8e07bff978e2a24fdc3223337bae

SHA512
30002c7aa04d1388722033c170f8afd9d23117e601939135e2d0df604ca85a8243a7f46dc8d605fe2b6cac5764cd3adbe7f666c605ae1f9f3c78bd0025f65b8a

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
110KB

MD5
090c16e741f9f1ec29168f134e21c955

SHA1
424130e4ae4f5dbaefa2d06a084d9ec8ac3bc02b

SHA256
3c1999bf80f3cc3df22d772fbe65ce7ddaf3fcfb37b2d20c6bf533e573ea8311

SHA512
0a1371f360f255edac71c086422d05fc1b2baecdcdb2d412885ec6de5081af344473d7102b5027340b5ff71e381663a3929e7f55ea8ae9b25bcc09035ca00adf

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
110KB

MD5
5bb7eac1e108e4c61ff575eb4919cb8d

SHA1
fb35a452389c9456d152b8536b3c10ca6f4d7715

SHA256
123d1e75cbb29542a785bdf9dcf0c908e4a529d79417a75765e058a286590eda

SHA512
2c05330f55ab8c183c11c540900e56a1c6429e8652723051e82de34ec6c72b8fcee401a8aa816ae2e392c54b2add1589ea0aed7572fc5631476f7576374b88fd

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
110KB

MD5
2abfa32ae1fa2ae79cf29c7f36d5b6ad

SHA1
3ff103eba0521b16307bc102363bdd6ac32cefba

SHA256
2a372a7b4f7712fa080da166c1621cfd13df3fc96bc810539dcc2f07bdb246e6

SHA512
9679bf6053a95f7519f63799010d63144c54ea4ad9fb073dced19a69ae071a6b42e80c167c2bf64a7ca66144cc841ba027afcff3582044b06d88cbd0c03062f1

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
110KB

MD5
bd28c124f665add8d84e04ec17574170

SHA1
0d7e355c7885e9aaab497721ab4af97bdcdb1dc2

SHA256
729f320143b64f0e60e2eef7ce24d2861f35d06c4fc79c4d96257de30c8a3549

SHA512
726c2bd71ea012298db731d4c86047f0303032632771a2699c84d521f6ca1f72c6bd591ee87d3fe9f865ffd898e5b98cfd7e4c8d19585598916ec65d3b09c690

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
110KB

MD5
402121fa292e14b5f6cc9dcc6d2ae804

SHA1
367013f88c919cd7dd57138379e00c96f3561d84

SHA256
33b164910c8b2509284207cda12dfa47f7aa061745736386db0cf1eed59933c0

SHA512
60014c6789e72b814d6dd0bbeceb1702a18ceb92e0cdfb7c8f4ea2b1fc1243c0a31f8b5f54533698c228cb3a601012de038573f4905cc7877d1783ff2ec4a3fe

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
110KB

MD5
6a5256c4f927347e899e0783a59c13d7

SHA1
75fdc13597ddbc7d703d694b66d90975786effbf

SHA256
3b0cb52c5990b2e91576b08c992437cc992e7c785f555782e7d0d2605dd21904

SHA512
93f537e90fc382a80d12a65a3add6755801f02b1442b8b4ac25998c9cbfd53e1342ebb6d810a9562818d79c78e3c9887747019fddcdfbb8244cb7294552b4255

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
110KB

MD5
cfb83fb23152967f71bbcf9ceab5d125

SHA1
9756163dfdfb32554a53b5ee765a189f43298bf1

SHA256
2e09293d6bacd3503abcb41dbc115f2f4e9c1a532299c0fd5f3a1635047096ae

SHA512
11e87045ec751ca1b85dad53a8b14078f18b054cc1ac31113e0c1ec7d04c8b5740dacf481e8aa6efb862c812957d08fed7937002d04af8d47411549602f65aff

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
110KB

MD5
0a1ee6655756aec5630597cccabff387

SHA1
0630600b27deb4a162f92edd27f13dbae8112721

SHA256
beed23054023eb11c727d657717ed9fe8c5c07d378ea2c0cdeb827ac829b9fc2

SHA512
ee1465d161613b60f216587a373d114948c599ac90b03f4897fcd607f47626c5c8ed9d5858126397710cc1ae1147f9d278e6578b66b12005fcbffedf32e57d3b

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
110KB

MD5
2b6d030c2d55efc676d33eef7bd78545

SHA1
f1d27f193d71904bc597bade3c9b5563d6dbe55c

SHA256
4a9341f7065ba6eedac7e632122ca8707a8f754e9717dccd5a8ad9b384e72eda

SHA512
a634503117e474571bf97fe87876a4e17e782f71bb83fc8a4a28fda8602eaf1cf567d8860d39e0a2fadc01109331b2a5c472ff96ae2434759a5d6205ef02ee8f

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
110KB

MD5
1751d8a56f78687966400c7d9b4794b3

SHA1
d5130189563736365a25267f61e8d3f83b7f0b4d

SHA256
a0d361a6615a5e35667c7d1942b4f3bac31226e0f770a90567b48459203bd871

SHA512
b9a2560f34b678718767c6271271fd0d1003ca2e212bdc6f96c3c5086a3a52962996094ffb6529b57a3e79f90ddee8c02ed5a04196eea2017907bc5bece32947

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
110KB

MD5
dc1235bcbfabff8c5a206ddc5fd7b531

SHA1
50814d2f6e401cdb10cb7b06b5f6a76089cea472

SHA256
f3df3e544b18dfe3884a29ff2a8f31d946e22ebceb41644a448bd6ddf54f6694

SHA512
613776a5da2e1accdf17a652e3985171a73f7b80ce3f58e9c97fc7cacf35a97746c238bf66b3c070c6bfb594daa44771286fc8cf051b9c89d104973adecc2c76

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
110KB

MD5
2fd26c7132537dd63c18cd54f46130cd

SHA1
65b3644a6bc3d06770b8757a4e31d8817c3d5025

SHA256
f98f6e780bf88c5524d9d102a082523318db12262b267af94364d1dc8a80f37a

SHA512
777e1da719be4d730ced87c4b09e464c724c2cd4f1d77dc68168ccc0d17027df7ca748d053f10fc0c79ff640c112984085ff94ed9e007581f935fbc7a98f3742

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
110KB

MD5
73637fd0fe2e7e7f1be6ad8021d25e85

SHA1
6bd67dbe23570911e37b66d3a94d65912e2e71c0

SHA256
af355fd4ef9e327545f7cc3df7dbff7ae8e06b46bf734b543f8754034546d670

SHA512
d3dcbefbbbcc7f4548f65f31c0b4f3e94c308358ffe0b0c83ef7ebb63ea8f6456ee7d4fc9d4042d022d74006e9ffd2797dd77a380bf0fcccabf7f1478fbd6262

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
110KB

MD5
ff7d153bdb532a752e111d09b40b0279

SHA1
0d59730aa323a7337d00e1c258ab0c913ea1b135

SHA256
9002d578c8e2364ea15c611401a59cc5d238fb1904c5fd9c2d905a04e578f4eb

SHA512
b8bd3352708d270e1c94c46b9ba2c478c766dc181ef2513687d90f5f5fdd6e1b4b1003fd620115332f72f0795b482c1ee158815c87b7b23241a59e374612b25d

Download Submit
C:\Windows\SysWOW64\Ohjlgefb.exe

Filesize
110KB

MD5
fbe4aa6775e317100b2a670882a6edec

SHA1
65464a4fecc19a1584d7b1c8e4f08bbf0d34773b

SHA256
b1d19330ed1d6b4c86d5ba147f27333e5aa16fd625df0c20e75dd5252761b07c

SHA512
326fef665075298f883706f5cba3a9b22a5402daa4212e761f209d64ab2436cb4b6fd4095269dd1e00249842457d54ae69c3f09fdf95b4ee446e01f370df59ed

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
110KB

MD5
b00101a473e10fba94f5d93361530701

SHA1
e744c3a5d9670059df78e11a8cb6a74fc99772c7

SHA256
987e7f8279ff5d0151bbf44098015e749525703889f5617bfbf2bfaf096baa44

SHA512
cf505a060a2428595484d4682275efd94c229db8c51f2a672176dd481f850f06658e49047bb658ec864690163d0c8dd52a74e0e7138028a73634fc802409196f

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
110KB

MD5
8a2fa4d5b92995fc805f11fb4e208b0a

SHA1
6d65b1512de41b68ec1847627cc9770263b995de

SHA256
fde58ea3f3a950f525ee61b8b10f708d901bba9e2a35e4af7eb99f1128a1e71c

SHA512
77019e03eae4fe86c7542615f34f892ccab1b4e5522232b6dd42075728910e895d281c9364cd7775a4b98a5607092a3e67e99f035db624755807befb524db5d4

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
110KB

MD5
77f517d7a23849961943ca074901e532

SHA1
ea734784865b5ce432c2fdc4036312e87513ca5e

SHA256
0e30321c27a1c45c68e86316cee1b2a0b56713852a61060824e4234fba85b488

SHA512
84e13679cc616088c617bfefbf288b26a501f708a5edd01d28139e483a674af50cb9b73f43a7b3833b272d3a6dc827bc36029f7fc7817341d3728dbecebda04e

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
110KB

MD5
68994bdb9ea82ea38a13e3d2aeab7fcd

SHA1
a9ac3b4f5c2b6592d5344c215f7dee973eb62b74

SHA256
937852fbb505ff53a61d87f396ce4e197fbd83bdb2e6fdc938cb79f0d1fb1768

SHA512
181296c4b06420d0e81d520e820abb27ec7d65016861d975c19630e6483d243c101a2bc194aa29b559e0cf58f049498eac4c29c7e769f05f3067a9c40a15b2dc

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
110KB

MD5
2cae6b341602c9de68ce1b81c68ee676

SHA1
ee159f8f94c15bf0342a9dc485a2ce508e3b91f8

SHA256
e9e916beee80be3c713cddce675c42acd4d31f4ccf2f3484fce16ebeb4163fb0

SHA512
8b9aaa26ded5fa7aac9b3c2c2e554f25944b04a749364808c083a365911f03b907f6a387bd966e8fae8dc79964f552e4e69f4bb9f94dcdf8bc9a32c289539d02

Download Submit
C:\Windows\SysWOW64\Pgflqkdd.exe

Filesize
110KB

MD5
1456dd588879506550da5965eb1e8c9b

SHA1
cfe4d99012e58f0a9efd14deb7ade2f4a35f44d3

SHA256
8b5ef3341b6bafb73f44051b4996ac0bdcf9eb8cb171a0992b4d3210a482e1ce

SHA512
ce94cc9b6d21d2120468f5dece5c27081f1e7ea6eb6a59ba213fc675f5fd48074148450289c85d8949743bebc811205500b3bfb05f0bf0563b918a03080771d1

Download Submit
C:\Windows\SysWOW64\Phjenbhp.exe

Filesize
110KB

MD5
41d3ba8b7b51cfc6827271b7dfc4c099

SHA1
44a3dabcc561f04efe5670830a18987d09f081f5

SHA256
46e3ea42934a8156077cf41a01f33f768c4e433ca6902a6913d7f647c1c808df

SHA512
e9e79552b8fe896268195705f4e67738c46fda3d57836d0c48ce7a3b395795c5190945b679ef8884885daff3e465dba92b6df2407aa6a95b8a837dc96c4b1bf3

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
110KB

MD5
e4b36bc3b6e7e0aef75ef829fdf09505

SHA1
6a94ec082727ff51961cb6f2c83985c64e2994ec

SHA256
1c4497f86ad3a0f0d51459f1f8f8985c890fcdd199fa636125ef67f6fce79472

SHA512
a1ae21488fe714c3577de862527fd7c19e37c37d527aab30e3000a1636ba233ff8c015b6f8e5ac631a6cd1f21c142d60dd59ee13073ce5fbb392eba01a8a879f

Download Submit
C:\Windows\SysWOW64\Qljjjqlc.exe

Filesize
110KB

MD5
ce2abd6f83acd8636f49a0a13292adc3

SHA1
0826d87fe616ce42fdcf00de976527c994618a7c

SHA256
c160cfb7878277dd38d80d68e9697359bf548c0726594ea0d81b1c8b3542ed05

SHA512
cbe46e42b7762f538b5d7adee5541f13398d6fdfba4d32c70c9a7cbd2dd0041033467dcbca813218d827460eac5e6fe67111acc2f9febcd0ac65a51019eb0a39

Download Submit
memory/440-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/928-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1216-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1320-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1404-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1428-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2088-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2396-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2512-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2616-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2688-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4012-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4208-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4296-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4376-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4600-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4620-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4632-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-94-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads