1a81fa3fa8765bc63e4b858bef193d7aa92d3133e7a241481fe3bdadec745542

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b76548a0fc284f34b2e8632f4917fa15.exe
Size

56KB
MD5

b76548a0fc284f34b2e8632f4917fa15
SHA1

ce6985821e6478dabb775b03daf62d086e9ca144
SHA256

1a81fa3fa8765bc63e4b858bef193d7aa92d3133e7a241481fe3bdadec745542
SHA512

8dd7cffe1a691e3546ef7291997d7e2a70d3120d10bb4e787765356349a474e71ca38a1f6001319e70fe948ca45bd6394e74936d9308113d5c8b81b677036abd
SSDEEP

768:T6KN0gggXtCs7CYR5PI3u9S4N/eFikNTLIgsAWS0qae1zIAXiaMCHI/1H5QfXdnh:T6wrC7b4N/uJLIXAS1eZI2MCi+

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odnnnnfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b76548a0fc284f34b2e8632f4917fa15.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adapgfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbgipldd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deanodkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qalnjkgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfedle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Majopeii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gicinj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaqgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cecbmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemlmgnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Helfik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppekj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqkdcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dohfbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcfhof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elbmlmml.exe

Executes dropped EXE 64 IoCs

pid	Process
5064	Giacca32.exe
3560	Gqikdn32.exe
4736	Gcggpj32.exe
1700	Gfedle32.exe
648	Gidphq32.exe
3108	Gmoliohh.exe
888	Gpnhekgl.exe
564	Gbldaffp.exe
1676	Gjclbc32.exe
4304	Gmaioo32.exe
368	Gppekj32.exe
4204	Hboagf32.exe
2164	Hjfihc32.exe
2356	Hmdedo32.exe
548	Hpbaqj32.exe
4376	Hfljmdjc.exe
64	Hikfip32.exe
1584	Hmfbjnbp.exe
3568	Hpenfjad.exe
1352	Himcoo32.exe
3480	Hadkpm32.exe
4468	Hccglh32.exe
2636	Hfachc32.exe
4380	Hippdo32.exe
2000	Hpihai32.exe
4696	Hbhdmd32.exe
408	Haidklda.exe
1636	Icgqggce.exe
1448	Iffmccbi.exe
4072	Iidipnal.exe
2140	Ipnalhii.exe
3580	Ibmmhdhm.exe
4788	Ijdeiaio.exe
4908	Imbaemhc.exe
2216	Iannfk32.exe
2864	Icljbg32.exe
2460	Ijfboafl.exe
4860	Iiibkn32.exe
4576	Iapjlk32.exe
4352	Idofhfmm.exe
1176	Ifmcdblq.exe
3576	Iikopmkd.exe
448	Ibccic32.exe
3992	Ijkljp32.exe
4676	Imihfl32.exe
2008	Jpgdbg32.exe
4964	Jdcpcf32.exe
2944	Jiphkm32.exe
5040	Jagqlj32.exe
4656	Jdemhe32.exe
1432	Jfdida32.exe
2688	Jjpeepnb.exe
4364	Jaimbj32.exe
3892	Jbkjjblm.exe
4060	Jfffjqdf.exe
1416	Jmpngk32.exe
2440	Jpojcf32.exe
4176	Jdjfcecp.exe
3016	Jkdnpo32.exe
904	Jmbklj32.exe
4740	Jpaghf32.exe
1384	Jdmcidam.exe
3024	Jbocea32.exe
5052	Jfkoeppq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Iicbehnq.exe	Ibjjhn32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Eelcja32.dll	Edkdkplj.exe
File created	C:\Windows\SysWOW64\Foabofnn.exe	Flceckoj.exe
File opened for modification	C:\Windows\SysWOW64\Iapjlk32.exe	Iiibkn32.exe
File created	C:\Windows\SysWOW64\Qecppkdm.exe	Pbddcoei.exe
File created	C:\Windows\SysWOW64\Cnkfcl32.dll	Gmjlcj32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Gidphq32.exe	Gfedle32.exe
File created	C:\Windows\SysWOW64\Kgphpo32.exe	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Echmafdm.dll	Occkojkm.exe
File created	C:\Windows\SysWOW64\Eegdfm32.dll	Alfkbc32.exe
File created	C:\Windows\SysWOW64\Qchnlc32.dll	Hccglh32.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ngbpidjh.exe	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Camphf32.exe	Conclk32.exe
File opened for modification	C:\Windows\SysWOW64\Oqkdcn32.exe	Onmhgb32.exe
File created	C:\Windows\SysWOW64\Pjffbc32.exe	Pghieg32.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jcgbco32.exe
File created	C:\Windows\SysWOW64\Gpkqnp32.dll	Gpnhekgl.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Pabkdmpi.exe	Pndohaqe.exe
File created	C:\Windows\SysWOW64\Cpjljp32.dll	Jkdnpo32.exe
File created	C:\Windows\SysWOW64\Kmlnbi32.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Npfkgjdn.exe
File opened for modification	C:\Windows\SysWOW64\Pfhfan32.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Ijnlbk32.dll	Cecbmf32.exe
File opened for modification	C:\Windows\SysWOW64\Flceckoj.exe	Fdlnbm32.exe
File opened for modification	C:\Windows\SysWOW64\Kefkme32.exe	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Pjjhbl32.exe	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Nqpego32.exe	Nnaikd32.exe
File created	C:\Windows\SysWOW64\Odnnnnfe.exe	Ondeac32.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Iiggphnk.dll	Ajiknpjj.exe
File created	C:\Windows\SysWOW64\Gcmdhh32.dll	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Aceghl32.dll	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Ddgkpp32.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Deblhkch.dll	Nnaikd32.exe
File created	C:\Windows\SysWOW64\Fbohan32.dll	Bahmfj32.exe
File created	C:\Windows\SysWOW64\Offdjb32.dll	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Ajdbcano.exe	Agffge32.exe
File created	C:\Windows\SysWOW64\Nphlemjl.dll	Gcggpj32.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Baocghgi.exe	Bjdkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Gjclbc32.exe	Gbldaffp.exe
File created	C:\Windows\SysWOW64\Ioeeep32.dll	Aealah32.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Bdkfmkdc.dll	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Fplmmdoj.dll	Ldoaklml.exe
File opened for modification	C:\Windows\SysWOW64\Mgkjhe32.exe	Mdmnlj32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Aaiapmca.dll	Njfmke32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Pndohaqe.exe	Pkfblfab.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13044	12968	WerFault.exe	625

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccgldidg.dll"	Ondeac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfoiqll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncmlocln.dll"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieolehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondeac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjeieojj.dll"	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehifldd.dll"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqmnp32.dll"	Pkjlge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Manffk32.dll"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphlemjl.dll"	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibadbaha.dll"	Hippdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcpopjlq.dll"	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keoakjca.dll"	Clkndpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qalnjkgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbefaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpppj32.dll"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocqnij32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 5064	3140	b76548a0fc284f34b2e8632f4917fa15.exe	89
PID 3140 wrote to memory of 5064	3140	b76548a0fc284f34b2e8632f4917fa15.exe	89
PID 3140 wrote to memory of 5064	3140	b76548a0fc284f34b2e8632f4917fa15.exe	89
PID 5064 wrote to memory of 3560	5064	Giacca32.exe	90
PID 5064 wrote to memory of 3560	5064	Giacca32.exe	90
PID 5064 wrote to memory of 3560	5064	Giacca32.exe	90
PID 3560 wrote to memory of 4736	3560	Gqikdn32.exe	91
PID 3560 wrote to memory of 4736	3560	Gqikdn32.exe	91
PID 3560 wrote to memory of 4736	3560	Gqikdn32.exe	91
PID 4736 wrote to memory of 1700	4736	Gcggpj32.exe	92
PID 4736 wrote to memory of 1700	4736	Gcggpj32.exe	92
PID 4736 wrote to memory of 1700	4736	Gcggpj32.exe	92
PID 1700 wrote to memory of 648	1700	Gfedle32.exe	93
PID 1700 wrote to memory of 648	1700	Gfedle32.exe	93
PID 1700 wrote to memory of 648	1700	Gfedle32.exe	93
PID 648 wrote to memory of 3108	648	Gidphq32.exe	94
PID 648 wrote to memory of 3108	648	Gidphq32.exe	94
PID 648 wrote to memory of 3108	648	Gidphq32.exe	94
PID 3108 wrote to memory of 888	3108	Gmoliohh.exe	95
PID 3108 wrote to memory of 888	3108	Gmoliohh.exe	95
PID 3108 wrote to memory of 888	3108	Gmoliohh.exe	95
PID 888 wrote to memory of 564	888	Gpnhekgl.exe	96
PID 888 wrote to memory of 564	888	Gpnhekgl.exe	96
PID 888 wrote to memory of 564	888	Gpnhekgl.exe	96
PID 564 wrote to memory of 1676	564	Gbldaffp.exe	97
PID 564 wrote to memory of 1676	564	Gbldaffp.exe	97
PID 564 wrote to memory of 1676	564	Gbldaffp.exe	97
PID 1676 wrote to memory of 4304	1676	Gjclbc32.exe	98
PID 1676 wrote to memory of 4304	1676	Gjclbc32.exe	98
PID 1676 wrote to memory of 4304	1676	Gjclbc32.exe	98
PID 4304 wrote to memory of 368	4304	Gmaioo32.exe	99
PID 4304 wrote to memory of 368	4304	Gmaioo32.exe	99
PID 4304 wrote to memory of 368	4304	Gmaioo32.exe	99
PID 368 wrote to memory of 4204	368	Gppekj32.exe	100
PID 368 wrote to memory of 4204	368	Gppekj32.exe	100
PID 368 wrote to memory of 4204	368	Gppekj32.exe	100
PID 4204 wrote to memory of 2164	4204	Hboagf32.exe	101
PID 4204 wrote to memory of 2164	4204	Hboagf32.exe	101
PID 4204 wrote to memory of 2164	4204	Hboagf32.exe	101
PID 2164 wrote to memory of 2356	2164	Hjfihc32.exe	102
PID 2164 wrote to memory of 2356	2164	Hjfihc32.exe	102
PID 2164 wrote to memory of 2356	2164	Hjfihc32.exe	102
PID 2356 wrote to memory of 548	2356	Hmdedo32.exe	103
PID 2356 wrote to memory of 548	2356	Hmdedo32.exe	103
PID 2356 wrote to memory of 548	2356	Hmdedo32.exe	103
PID 548 wrote to memory of 4376	548	Hpbaqj32.exe	104
PID 548 wrote to memory of 4376	548	Hpbaqj32.exe	104
PID 548 wrote to memory of 4376	548	Hpbaqj32.exe	104
PID 4376 wrote to memory of 64	4376	Hfljmdjc.exe	105
PID 4376 wrote to memory of 64	4376	Hfljmdjc.exe	105
PID 4376 wrote to memory of 64	4376	Hfljmdjc.exe	105
PID 64 wrote to memory of 1584	64	Hikfip32.exe	106
PID 64 wrote to memory of 1584	64	Hikfip32.exe	106
PID 64 wrote to memory of 1584	64	Hikfip32.exe	106
PID 1584 wrote to memory of 3568	1584	Hmfbjnbp.exe	107
PID 1584 wrote to memory of 3568	1584	Hmfbjnbp.exe	107
PID 1584 wrote to memory of 3568	1584	Hmfbjnbp.exe	107
PID 3568 wrote to memory of 1352	3568	Hpenfjad.exe	108
PID 3568 wrote to memory of 1352	3568	Hpenfjad.exe	108
PID 3568 wrote to memory of 1352	3568	Hpenfjad.exe	108
PID 1352 wrote to memory of 3480	1352	Himcoo32.exe	109
PID 1352 wrote to memory of 3480	1352	Himcoo32.exe	109
PID 1352 wrote to memory of 3480	1352	Himcoo32.exe	109
PID 3480 wrote to memory of 4468	3480	Hadkpm32.exe	110

C:\Users\Admin\AppData\Local\Temp\b76548a0fc284f34b2e8632f4917fa15.exe
"C:\Users\Admin\AppData\Local\Temp\b76548a0fc284f34b2e8632f4917fa15.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\Giacca32.exe
  C:\Windows\system32\Giacca32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\Gqikdn32.exe
    C:\Windows\system32\Gqikdn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\SysWOW64\Gcggpj32.exe
      C:\Windows\system32\Gcggpj32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1700
      - C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:648
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        24⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        26⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        27⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        28⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        29⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        30⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        31⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        34⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        35⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        36⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        40⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        41⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        42⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        43⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        45⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        46⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        49⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        50⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        51⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        52⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        55⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        56⤵
        Executes dropped EXE
        
        PID:4060
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        57⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        58⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        59⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        61⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        62⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        63⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        64⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        65⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        66⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        67⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        68⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        69⤵
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        70⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        71⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        72⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        73⤵
        Drops file in System32 directory
        
        PID:3544
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        74⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        75⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5104
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        77⤵
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        78⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        79⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        80⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        81⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2308
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2044
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        84⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        85⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        86⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        88⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        89⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        90⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        91⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        92⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        94⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        95⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        96⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        97⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        98⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        99⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        100⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        101⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        102⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        103⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        104⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        105⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        106⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        107⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        108⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        109⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        110⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        111⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        113⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        115⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        116⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        117⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        120⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        121⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        122⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        123⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        125⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        127⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        128⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        129⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        130⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        132⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        134⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        135⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        136⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        137⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        140⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        141⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        144⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        145⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        146⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        147⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        148⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        149⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        150⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        151⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        152⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        153⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        154⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        155⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        158⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        159⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        160⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        161⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        162⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        164⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        166⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        167⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        168⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        169⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        170⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        171⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        172⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        173⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        174⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        176⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        177⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        178⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        179⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        180⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        182⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        183⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        184⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        185⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        186⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        187⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        188⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        189⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        190⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        192⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        193⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        194⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        196⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        197⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        198⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        200⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        201⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        203⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        204⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        205⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        207⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        208⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        209⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        210⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        212⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        213⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        214⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        215⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7532
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        217⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7612
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        219⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        220⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        221⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        222⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        223⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        224⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        225⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        226⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        227⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        228⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        229⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        230⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        231⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        233⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        234⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        235⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        236⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        237⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        238⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        240⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        241⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        243⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        244⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        245⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        246⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        248⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        249⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        250⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        251⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        253⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        255⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        256⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        257⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7540
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        260⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        261⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        262⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        264⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        265⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        266⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        268⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        269⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        272⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        273⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        274⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        275⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        276⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        277⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        278⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        280⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        281⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        282⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        284⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        285⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        286⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        287⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        288⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        289⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        290⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        291⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        292⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        293⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        294⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        295⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        296⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        297⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        298⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        299⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        300⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        301⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        302⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        303⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        304⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        305⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        306⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        307⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        308⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        310⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        311⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        312⤵
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        315⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        316⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        317⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        318⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        319⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        321⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        322⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        323⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        324⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        326⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        327⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        328⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        329⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        330⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        331⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        332⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        333⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9268
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        337⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        338⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        339⤵
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        340⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        341⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        342⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        343⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        344⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        345⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        346⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        347⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        348⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        349⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        350⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        351⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        352⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        353⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        354⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        355⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        356⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9244
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        358⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        359⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        360⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        361⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        362⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        363⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        364⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        365⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        366⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        367⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        368⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        369⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        370⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        371⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        372⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        373⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        374⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        375⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        376⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        377⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        378⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        379⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        380⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        381⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        382⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        383⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        384⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        385⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        386⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        387⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        388⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        389⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        390⤵
        Drops file in System32 directory
        
        PID:9936
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        391⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        392⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        393⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        394⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        395⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        396⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        397⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        398⤵
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        399⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        400⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        401⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        402⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        403⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        404⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        405⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        406⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        407⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10884
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        409⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        410⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        411⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        412⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        413⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        414⤵
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        415⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        416⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        417⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10300
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        418⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        419⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10540
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        421⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        422⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        423⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        424⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        425⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        426⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        427⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        428⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11220
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        430⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        431⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        432⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        433⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        434⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        435⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        436⤵
        Modifies registry class
        
        PID:10956
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        437⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        438⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        439⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        440⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10800
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        442⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11180
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        444⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        445⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        446⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        447⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        448⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10920
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        450⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        451⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        452⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11412
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        454⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        455⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        456⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        457⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11636
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11672
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        460⤵
        Drops file in System32 directory
        
        PID:11712
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        461⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11752
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11796
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        463⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11876
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        465⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        466⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        467⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        468⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        469⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        470⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        471⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        472⤵
        Modifies registry class
        
        PID:12212
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12252
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        474⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        475⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        476⤵
        Drops file in System32 directory
        
        PID:11396
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11492
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11544
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        479⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        480⤵
        Modifies registry class
        
        PID:11680
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        481⤵
        Modifies registry class
        
        PID:11740
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        482⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        483⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        484⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        485⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        486⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12160
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        488⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        489⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        490⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        491⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        493⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        494⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        495⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        496⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        497⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        498⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        499⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        500⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        501⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        502⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        503⤵
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        504⤵
        Modifies registry class
        
        PID:11352
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        505⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        506⤵
        Modifies registry class
        
        PID:11904
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        507⤵
        Modifies registry class
        
        PID:12208
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        508⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        509⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11408
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        511⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        512⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12324
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        514⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        515⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12456
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        517⤵
        Modifies registry class
        
        PID:12492
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        518⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        519⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        520⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12644
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        522⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        523⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        524⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        525⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        526⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        527⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        528⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        529⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        530⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12968 -s 212
        531⤵
        Program crash
        
        PID:13044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12968 -ip 12968
1⤵
PID:13020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adapgfqj.exe

Filesize
56KB

MD5
69d91a0ed1c4032eb8e41f09a775bc16

SHA1
ad43c79d02637662f4350e7ab13b156ff6637b92

SHA256
4c7b9a628b4ee382d81445df7a91d117ea038dec4a56d0d77d7afcbefb2c6c6e

SHA512
a477b80eb1720e977d7c521351c1447f5072f4406d08ec87995230010941524d9b2095f8b3f82d6287fc96a33586491f174d149ff08b7fa5fc439e0a4b76a549

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
56KB

MD5
0dc8d0f82e8514ffbf8508d9a9fef881

SHA1
da46afd2f12afd84e16404a932d2c1de6c03dae7

SHA256
b2a2692a6ded485ec26677b23f5d09132e8a2383dedbbae7def8f5f9ce03eafa

SHA512
36f3b07a458f91467124fabd1b68205ce694d6d9d331f68ee9fdb60164c4933e9949dcfcb9d4ddcb7a7c1fb4d7e5b21c04f2d9aa65af010aecc16f8d89db411e

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
56KB

MD5
936e8f53c70347a6ce611980ffd00efb

SHA1
ca89afeaa2116a025839526c8f2ec5070b18cf06

SHA256
76544535e45b71d3c0866f00b235784c1c356b1c595bdae3ae4e034f7a39889a

SHA512
0a9f824759ae929b65d809fc3330f038caf842749adf3021b84b604cf6525fd9055c4e71eaf5f39f3d1204830a5df2afd74393509b9acfea61d48a6181498191

Download Submit
C:\Windows\SysWOW64\Cdfbibnb.exe

Filesize
56KB

MD5
bbc4c66e83eb7bed2d4c8bc2643bf502

SHA1
606b6ab4d423d9ef923ccbd68bb942543882b43c

SHA256
6bb84885d98360d831b15cd6b25f7fd909c5e4a588b4a961e1e2e590daa5b547

SHA512
87a6b8645f0cf377cc1234a27bc2dfad35ec1a1c7d78d1aa3f36a5db89089536259a962524d8ce41981bdf2c4bfea7a8912805cec9d480722b6a03a18b2f4a3b

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
56KB

MD5
fe8ffd76d9a0b1846bd29b77a6c65c63

SHA1
57fa52b1b53cb8e91a4c2428979beb77303e6084

SHA256
6ca6d83a258396e80d512e2967402ee8d7e889a91332820dbcb1b35c89fcfa6f

SHA512
595de22619569d0e2fab2c0fd6ac9e7e1a0efd58a45cda1357fb7159f5be37bb3e5f361780fd0ddfdb89a6b62667d87ed67ad8debb8341c2a164c2920a40636c

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
56KB

MD5
5e26bd428f6b987e7920fc752cd5f0a4

SHA1
50d99de48f8048cc01d667c8901bd521b16cdbfb

SHA256
39468e1237f008e5bc3b0cb59be2a11178bf96db43690b497aba5b87ae8da27b

SHA512
9a125ae4716683bfc3d9b425d7bf2d57389e3979c8d74322a2ba26881326aab5ea1a3f054aaea5aea92fecd1c0569f35495ebb05625078b85acf5527d68f8768

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
56KB

MD5
b23d3fcac0808ed1d699d2cc459ae6cb

SHA1
cec8c612f9b8764dc62761b19531d5e22aa9a4a1

SHA256
8059a8fa4fec797794cba8d6e1f257d8a46b5952e82cbb0a8b1321c59fc9d254

SHA512
887b921b7ec33acb3ec50ac50cb53fd6bdee568b94bd86364a26084cdd821d0d22f2c7b47fff021df3cf24c6313e4ba28c3912fa0a6a9474f8e0b7b8d2f1547d

Download Submit
C:\Windows\SysWOW64\Fcfhof32.exe

Filesize
56KB

MD5
22ed4919f9bf59e0c75041485cfc9bf1

SHA1
9becba1f07ac9743321365e5424453fdfd4248db

SHA256
ac19b7ff33a811f220bd708ed85db18837c5776e066b3579fd8b8e816d8f436a

SHA512
a9d95c12c472dbc988d27b8d2ccd3c2cc71f4cc5a93c439b69a2cd9a1373ceb0674076a015497846fd14c06791cdded6568d87f2b9025af350620489128d9617

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
56KB

MD5
4cf90c43399fe1b90585fa7844869403

SHA1
a2fe2ee8a2535d09e121d5d2889482294bd2964e

SHA256
58e2fe87e6a444c4bddd7711b7b32c9f526a6dc57e205b7d8a4bae1be0760d8f

SHA512
08f2d45587d7e865036e3a8689094893ed754c2bf9c45ddffb5cd2bcf2dfd79699c3f8339b853a39a2d29caaced002396c012c06c6cc25f217fdb8650164401f

Download Submit
C:\Windows\SysWOW64\Gbldaffp.exe

Filesize
56KB

MD5
8f1333d754e4a8aec9139686614f2213

SHA1
e15d889cda2d6abae2a0d27582c2ebbe96780ff9

SHA256
4d23af2c016f98a11a85c627dbea6c71334195ada403275edabf7e9b2705fb81

SHA512
5c177a2b925c9699aeff16306ba4192a1d76bdc4e1da8b18dd493b9c966f365e3523c1180916180a4839a4a403dbafbeaa5809a5198f5d25d8666dc8a2cc9367

Download Submit
C:\Windows\SysWOW64\Gcggpj32.exe

Filesize
56KB

MD5
e3b0350f25f2c8893e60835d65be2d2e

SHA1
6a5454303588f4e3f63ff77727300a3ba97d69f7

SHA256
2d21b9e8a0386198cebf4ca5026af1afa9b50008cb2ec868b8880d114ac26d69

SHA512
7893efef0a36494b4fcea63de371924bcd48997bbffcef8111b27e67bb77c2712e827d13496f77fff89bef4f1c887377e55e2024e547f583a92ab66383dc435f

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
56KB

MD5
c40d9a404758a7c94e86bc6f8a331942

SHA1
02fac12e8cb8feb6ea4b18aa6e0bd3d5b58b1f8b

SHA256
1be09c36ed28b7f8c3dfd9f1ff0bbb278737b24da14cf4d869eb84a095d2df59

SHA512
11b02ea30799356f7af735ea5df8eb225b7d478966c1643f2a6894d2e64a552a6b32f7e8178b9cf845b5373ec40d92a808eaf390f5009f06bee8d26c79088504

Download Submit
C:\Windows\SysWOW64\Giacca32.exe

Filesize
56KB

MD5
f952ef500f2a1e30a407fa71f1930335

SHA1
a270318cc5baac8f6f551ce0757b15555d7517f2

SHA256
bb5df23b4d329e8575bd13f8d21766f72eb3dda5177c739c5a36d3724502bb6a

SHA512
79eea5335021cb053c702bc518531c4340451d76c5d3ce0ea726fb13d5ab7d781c75ce18e20c3c15d4dc1654050355b8a85fc3d7bc3a5bee8dec665128395a40

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
56KB

MD5
7d8fe16508b79e8c392cf26e83c59478

SHA1
0ac43d539bd74bcbf71748157242b13c098122a6

SHA256
2c0dcf03600060c842e924f49bc99d26f122368756849fc1dd1d05497f763164

SHA512
488871e5ae1b6b0631da0f1c723678143dde3394e12f7fa689b9c8b1ad68d873a50a916d3e64e15a14749e7f40b1aad3e11845241983f13cde0d5a2ca04c1615

Download Submit
C:\Windows\SysWOW64\Gjclbc32.exe

Filesize
56KB

MD5
de410336284b7d768074a3276b7095b9

SHA1
acfc903162fd39374433ccd4008a5c1479021d9c

SHA256
6bfb0a2252a63d4b6d48534cf2035994fd284ee499c4f2cdc65555c86bd92f33

SHA512
6cf89699889352da07ae00efb79ea47ef8855b7ca953c22a70903ecab7410564e7443eb01077c7b4fd597d9da173cc9b0a9d43675d6207020bb5efe98f9f9b0d

Download Submit
C:\Windows\SysWOW64\Gmaioo32.exe

Filesize
56KB

MD5
d55138dd98280d330dc3442b5bb54fb4

SHA1
3ae8b25339b9dace44a74f1338f4a8fd08f854b5

SHA256
110a55bb3e935c042270eaa48fe5e7fee73844ed6b3758f76599e2a29969e9f9

SHA512
aeb8ecde3621d9c44e036ac836a34ebf8c18a4ca2ea323d72beaa8338fc9efe466ad137444d3463d8d20a3cf324ba39e067b4f042505e886dab86c50b9c847b9

Download Submit
C:\Windows\SysWOW64\Gmoliohh.exe

Filesize
56KB

MD5
6511de7594f09c01c02859d922c18b56

SHA1
52a31655967518e50aea42544d6c378c143ca316

SHA256
a80287526fe6c85c4c5bb59fbfe2fa32e8651b5c5e1e4c7c9dab2faf59138be8

SHA512
8ef3cb339b4f17b6cd7cce1ebe2dfbe9c601077da82b6d35a58197cc3c7f1d2fb289e15d35b4fd2ef34a2a396620f7969f513feb37d1c76851d85d681fef69f0

Download Submit
C:\Windows\SysWOW64\Gpnhekgl.exe

Filesize
56KB

MD5
33c2d8a28736bdc2dce352ea21e9706c

SHA1
6be33cbfcf3ead0b5bb352b6af24a1e7b03c80f2

SHA256
4a0fd7ca7d263b5c9f6c82c4c41bc38090022680ec86cca7adf5a2b4a56167d2

SHA512
7e9925b3d244bba2e0ae479d0137345a07f19a83b9e2ba3fd4c950c6a56a793824f6378350f8f69fd2c8dd6b8b183e0d8b65d537647cd6d62084b41233859c31

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
56KB

MD5
323f2e2fcce8daa506c7a603628c8ec9

SHA1
e5269c30d939ace8834a2c0df02aa58d53b4886f

SHA256
987e0a7fb011dc73908ed05831cc87a4d51fcc08f4081407804b458dcd4846b0

SHA512
ca8e86280b43f4b031f0a1acf446c80f0e7a0ce554bc2251db6d39d91d18a1ae6a84dc8ebe95b03928cb080d25c54c0f62af98203a7cb009445edd5f03ec5206

Download Submit
C:\Windows\SysWOW64\Gqikdn32.exe

Filesize
56KB

MD5
5607dad7789eb36b684fbbba23091c1d

SHA1
6bf6c9cdb618587fe7c03cdbf2ace5075a473290

SHA256
6604b4c8627dbe6d0613a34ccee292e3c869b43cee0cd9d51ae4af0ca0d4e977

SHA512
5f7cd00f1739d4fbcc248e16cb3f49d33dbbf234cf2162bf4ea6d6fb479e65eae483582f6757a6133cd1c1879a01355caebaf2068424548fbcc6b76bd5094d7e

Download Submit
C:\Windows\SysWOW64\Hadkpm32.exe

Filesize
56KB

MD5
00512737feaee99d6433e9435b25a61f

SHA1
4026914af5538545295424a2d9173b57de1e1b2f

SHA256
554d2b0fb27b040cc9372965e3acfac3d8392c731a493c8714fb0ee1bf9e7d2a

SHA512
d414dfcbe3e3579ca74f5d81fa4588fd25d232c77677d04f87e661118bfdf67146ae04e48c02159aef22de923f5be27734689df364e104a003081e4e65ee18ce

Download Submit
C:\Windows\SysWOW64\Haidklda.exe

Filesize
56KB

MD5
82a00b5eaf5a6fe7ea53925012d66eca

SHA1
01c529c7a92ee0de764f4bb44194cf0cc609bc4a

SHA256
659c2fd9d11f21cf88d6c08ab28fc3160b4f69bfd6214bb491658d3959e53d64

SHA512
b48f655cb12157384ceb552cc6a53cccab980e87743ab4f75cd5d4a5ebc6ffdfb839306238dd7ee993859850ca3ecfde3c0c9a7a7386bb8066793a732eeaa775

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
56KB

MD5
ba89443d22d2b6b31b8bfbef96132c56

SHA1
daafd835149ddb96e12abd0a8eed2971eec94f3d

SHA256
1e7be023cf7667c3e5f7ee88922adf962f63451d0455d7f1de1dfc0859b33a47

SHA512
76ecdd76ca3d9d3927fec8e9b5673c4a432a9db4a19f94762ac1b58ede1662517abc28d9bfe78f51da7f7170154b89188056e65b5f15afa3b7ed0ce928f4f700

Download Submit
C:\Windows\SysWOW64\Hboagf32.exe

Filesize
56KB

MD5
18cd120750005068cefd3f7b1e664bd6

SHA1
4cf5388a82cc33e855247956613839c8e3170881

SHA256
5ab8157aae5cb90f1a5ca8bd4838d3cf919c3cbd18810e4171b5de2c7793c26d

SHA512
335020888d210f93311b9db717ef68399639d71401c445207c4bb79a89e3dbdffd8ad0e3363f20a5517cef3907a6c7d21b9fa625c697fe19e2345f466e54eabc

Download Submit
C:\Windows\SysWOW64\Hccglh32.exe

Filesize
56KB

MD5
db04175bcfc4e3dd75307e8af97f65fa

SHA1
baa05f38c573445fbb44c1b0f9eef8a6353aa79c

SHA256
4b145e1fc174e0a17d4bf23cc7b4a392a767173e2ed9ae39bf6e01d92c62fd3c

SHA512
030775755f921937c22b4f2038ef7d06eadbb6e00fc64d1e6e3c06db90ace5200a4ca200f2ad379517bbdc6fa9c8486ad9c0c2ec6d779f223ee7eeb8241f49d6

Download Submit
C:\Windows\SysWOW64\Hfachc32.exe

Filesize
56KB

MD5
9fb24dcaa9307021b0c61fd5088b0fa4

SHA1
4ed022025a09d71834e31d3451bd21be0d2e9119

SHA256
c7f7c4bbb60becd3c955d37e5a1ed8d1063d9b852f58b0a4d32eca08409b6842

SHA512
977ffd9a5f5ad03c7b4e047a1481ba74e197172081a4ba22c49559c75b871e369b3815e1c25eb6a303896a8c2d01ba4f65151f40362b8e56ad18d3c3ce239fd2

Download Submit
C:\Windows\SysWOW64\Hfljmdjc.exe

Filesize
56KB

MD5
8359596e96b12232ba4bdcda9d96fd38

SHA1
b0b8bd97cdd5de6cc77d014fa7b910f46f61834b

SHA256
5fbcab981ce686b5cbeb6365f3b0801f8ac631d005f685f9a09a241469313aa8

SHA512
bc78938b6e38edf01206cde471c63815132fe90f11feb9f68fe38c4fd9e0e3c42dbcfcd4e1a3c37b4054ce385ce2e96186601dc864e1c1ad1bb636b7ab311340

Download Submit
C:\Windows\SysWOW64\Hikfip32.exe

Filesize
56KB

MD5
9f6e544b780db4534e9bfcbdc12e01ab

SHA1
44a6ade1ab9a5eb63c66ab385ca7acb755a4f64e

SHA256
a112c68d8a4750a5c8109857fee31d01a19af32977a6f5541022ef6939bf9f68

SHA512
2226207384a064625e89c78763b30cd7e7c9a0c356ee2363b62fe1494c9dc6248e4e3e609736170231174e98b53a523e4f2c55c484d78762af5cebe66d988aaa

Download Submit
C:\Windows\SysWOW64\Himcoo32.exe

Filesize
56KB

MD5
8cd7d55b9662b5cddf0105847d9575d3

SHA1
ef3ca52577871d81cf661fbb9ed52633592081c0

SHA256
caf01003b38120c138218f9bd4b1f776b554c01315157c523e547cb7ae81af85

SHA512
d11e21a9d1991e9192a78f8f73ff05a92b4fd357206bc353f3ba6276f47772d2053229e0a45d5843b4a9cc603a2b978b2e8d978986bb57f7e2b340a87cb3e406

Download Submit
C:\Windows\SysWOW64\Hippdo32.exe

Filesize
56KB

MD5
557cd45fb18afed49441e2601c2d8e14

SHA1
ef6dfb93f0710c5ed96baf0ee371a7bc37615e56

SHA256
8960e802cd7b20a37dc44909bc9b64db9bbc3c4e799b762caa6c5788c0e7bf27

SHA512
f535b3e0e8f389c3e262329d91a189979e00b03f01c2ee5e480f3a55a81c26aebb32f6d543504a44697cc326a262bcf36dbff07bef5b7b378ecdffb8147d42db

Download Submit
C:\Windows\SysWOW64\Hjfihc32.exe

Filesize
56KB

MD5
dce85de1f63969fae7c61fee9698b507

SHA1
52f53548d6d94f9c75e77c6d136ba3fcf9399844

SHA256
0421a469c95634061df8120312cb54b6c850770c553998dd4ef2780e0de9b337

SHA512
a4eedc0d5f51250dd82f155366cbfa9f92509aa4030e42935b4b7e1708fe6fe51556f0ed4ae7cfc969abc60dcab6699ea37e1ef922c29b0624ab66cdf1fe62bb

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
56KB

MD5
ce60f17b0fb4f8637748e0354068d2cd

SHA1
1f53256ed45b64e0e3c971f77c87bd9e08230886

SHA256
907677e5ed7b1276c32e53d1e7f0df9924ee332825d51934784052c39601348f

SHA512
b36172f34e4a3f9e86644ad5a3ffd4b985d285bc42eefd2df381cb84fb22e22d403f588aee33c0bfc22e2b6e5c49a9c1af97cd82a3c72392d9681170e4eb6891

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
56KB

MD5
7bbca190fa40562515b5c4f12665ef5c

SHA1
a820603e93daa7a2565997d08fef8691d5dadd5d

SHA256
423c22a4683d6dd9d84c1628daa53ed899712709100a3cc5f12ff7bbab4e39d7

SHA512
44a32e6e2e8d6e4fe0337636ba0c00f27371897e0eb905a504f604ba943c43816495e7420c2e9142f387c1b3515055f37a4129f76d9b39c0978d7dfaad02a7f2

Download Submit
C:\Windows\SysWOW64\Hpbaqj32.exe

Filesize
56KB

MD5
4511acf188b3e8e916d1cd5bb48f6960

SHA1
afcad558870920fad06827113cf159bdffc530aa

SHA256
43a6c5ff91443715e88c9625c66613ea9c63e8dc66eb69d957bfba18e73f4202

SHA512
f093822241f154848445251af25f00b9b781ec6d7809af6a529709b7a9c6957f27f244b0c90cb5a71782d5426de491bd8b9a93f2e2a9698ee8a9417350ea7b02

Download Submit
C:\Windows\SysWOW64\Hpenfjad.exe

Filesize
56KB

MD5
6904301b8847aca5038f0c180ff85608

SHA1
6344b64c551e73d66820b50e0992ff56d00ea1bb

SHA256
1f15726ce871712aee9ee82d05768b55c227a522a1771d98202f5045ead91a35

SHA512
edb4e0d44fa6b9466d1802681076e1c6ce26d110e7d1d78f6d41eb1bd3ce254d624db062178c99dd2a532c55262ed86d4aa9a30d4db405ef4d7ec69ef5b07fa4

Download Submit
C:\Windows\SysWOW64\Hpihai32.exe

Filesize
56KB

MD5
5fcb801609a540c8ca50c47ccbad6ba4

SHA1
1136bf25913d6d31a4eb65967e23db4808a26ddf

SHA256
5875803d8fcffd4f55841dd5d8fd8b3ec5420e7dc32b0b92d3ba3fb7740d83cd

SHA512
91b1db3e9d1a1d7bc920afe078953074b1fb2e7a59d8525a14604f08495b304fba035801bc568010aade19ab7acebcf4c65bf1606ecb8f545bd5b81af9106d5f

Download Submit
C:\Windows\SysWOW64\Ibmmhdhm.exe

Filesize
56KB

MD5
c462fe4baac7528dac81c27e755e2d50

SHA1
6e6f8d387892aed9b552c39cfb9a12fecdf75f51

SHA256
393415cd65e2121ade7b864c8c8151e0ca956b5d893a75ea7c9b2ef6d13c5dad

SHA512
776a8ed990d7b17c64c47ee97ebdf5a61073cb8f1c5b42fd384b7cdfef67f3d990c46d59de4aa25a26ed3af7fe61a82290b777fd7fd3ca642aae710933258ebd

Download Submit
C:\Windows\SysWOW64\Icgqggce.exe

Filesize
56KB

MD5
f9d418d89c7a7961ae2c924ffcf2bdb8

SHA1
384afa613443cb4174827786efa29b2bc8170c4c

SHA256
3a0b6f6a44a24792c4b2218b3ee3d91998425d1050c5d151db4315de4919767f

SHA512
5ad9b81a3fca336b86e873a319d5e97bb1b43e1992b9663fdc73fb6f837c14ec429f290a09c6490d237e2ec2272bebb820ae9b659cc8a39f08b9cd0bc90c5418

Download Submit
C:\Windows\SysWOW64\Iffmccbi.exe

Filesize
56KB

MD5
48b00a2b496a6f902225be1d95452af8

SHA1
d3dcb753a163191953870fcc2f6d86911b74c297

SHA256
d42c854f9bd364f073fbcc027f1a9b1de0c0b09d52898f3744edef703e37c249

SHA512
bd8ee17ac08b45da14003ae69d53614b2f96120c9b7be52c30206e20256ca9ef4159b1f2fc22083143f37aa77384d8d6625327c7619a76080cf120018484ffd5

Download Submit
C:\Windows\SysWOW64\Iidipnal.exe

Filesize
56KB

MD5
4035613b93ee6e6a41e9928698c54f73

SHA1
aac76e81254c5661c1a9dcc700e3513a6ba5b375

SHA256
050f60598b08f3ba82ba035cc79d57668b883dcd2e6f0ac558a1aefb8f52bfad

SHA512
0eee2336d0c9fad3dc3305bc890dca37df98def3bc72b45b3645094c3fc543c06fef6135a7979d073c9ffaeb51d670e89ab55d3fa77e355a556f538f57bd4357

Download Submit
C:\Windows\SysWOW64\Ipnalhii.exe

Filesize
56KB

MD5
ec777cd641cd3406fce39a5a6c24b99e

SHA1
fe33f14be35108253ed42e7a0880c0014ef3104f

SHA256
b05e4da938027874475cb25ddf4ff56a1b1fc30225a4de4e6f5e7c805c9f7192

SHA512
2ce14e2497704d261aff4bc211341bdd58fca789142d2a38a2bede40e598c02c646ff76133b05d66b1033e7ffe46ec5caaa32463f763daf62e8e861d0b2c6771

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
56KB

MD5
a18a291bb3b35170411fb0e0ccd6181d

SHA1
78d92904f37b064f9dcf9d82b030f677fd584840

SHA256
cfd4f57e2900f4c0974fe45fec64da76368484b0500409a54775cd088c451a97

SHA512
9d225b06f3bd38854ddeffe2938a6c6fe258d3f43529941089335ab8ba36f1f597bd55a0c2a537e856661d0e44c0b62cd27f9b3bac20b0a40fab805b36687ee9

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
56KB

MD5
9430d323c1d9918996042c06fd153d78

SHA1
a8993549902c567722e0417943e5fa6c731b7b22

SHA256
317bafbc7c7c3962b5c4d67f01d9d25ffd38faeefa7a52b5f5ecd7d75618e1a0

SHA512
dfbe9c90567ff0eeb2424b6cf92b96add5c056ae5fbb91df985027393e9c404c3b16099135a3a3211db01b0103a406e578235b8d577d987775d5e7249a380e8a

Download Submit
memory/64-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/368-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-218-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/448-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/564-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/648-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/888-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/904-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1176-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1352-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1416-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1432-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1636-225-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1700-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2000-202-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-250-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2216-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2356-113-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2440-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2636-190-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2688-378-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2944-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3016-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3108-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3560-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3568-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3580-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3892-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3992-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4072-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4176-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4204-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-82-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4352-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4364-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4468-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4576-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4656-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4676-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4736-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4740-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4964-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-360-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11308-3478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11352-3473-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11408-3467-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11580-3472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11696-3477-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11824-3476-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12208-3470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12376-3463-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12416-3462-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12456-3461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12492-3460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12528-3459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12568-3458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12608-3457-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12644-3456-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12680-3455-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12716-3454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12752-3453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12788-3452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12824-3451-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12860-3450-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12896-3449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12932-3448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12968-3447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads