792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe
Size

74KB
MD5

ade293a8c42e54482d352ee5d64f0905
SHA1

ffbe7f8b05885325af5015ea50254c7abd878725
SHA256

792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447
SHA512

aec3098451e7a756d84bb4a78f875a70fcd52008ed69867b8c18e1679804f118d8bbc0cfa0d4982fd41c88d03b05f9e68dbe5686664679c3f0eeb7eee433b2ae
SSDEEP

1536:Yw8cU85HTrVw84ccxP/gzLihbz9O5it0O:/8LWTJTcxP/getO5it0O

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfcqpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccgajfeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmepam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkaicd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phedhmhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekmhejao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnangaoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkmfolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odjeljhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbngllob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efepbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcejco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchppmij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojomcopk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbgbnkfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfbaonae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqhoeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aefjii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdqfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emmkiclm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqikmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nmjfodne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pocfpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imgicgca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqnjgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhokljge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmaamn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pekbga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aodogdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbndfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mminhceb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijbno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kifojnol.exe

Executes dropped EXE 64 IoCs

pid	Process
1520	Caghhk32.exe
2340	Cfcqpa32.exe
3616	Cibmlmeb.exe
1144	Ccgajfeh.exe
1716	Cjaifp32.exe
2264	Dakacjdb.exe
2456	Djdflp32.exe
412	Dannij32.exe
1140	Dhhfedil.exe
3508	Diicml32.exe
1752	Dcogje32.exe
4448	Dabhdinj.exe
948	Facqkg32.exe
1080	Fagjfflb.exe
4092	Ghpocngo.exe
3808	Ibobdqid.exe
4828	Jbiejoaj.exe
3048	Jkaicd32.exe
688	Kiejmi32.exe
4888	Knbbep32.exe
4124	Kelkaj32.exe
952	Kenggi32.exe
4664	Kkhpdcab.exe
1976	Kbbhqn32.exe
5028	Kgopidgf.exe
1480	Kkmioc32.exe
1524	Leenhhdn.exe
4036	Lgcjdd32.exe
1172	Lnnbqnjn.exe
2912	Lgffic32.exe
3580	Lnpofnhk.exe
4620	Lghcocol.exe
3680	Lbngllob.exe
4600	Lihpif32.exe
2368	Lbpdblmo.exe
4796	Plndcl32.exe
3488	Phedhmhi.exe
5036	Pidabppl.exe
980	Pekbga32.exe
1632	Pocfpf32.exe
4520	Pemomqcn.exe
4700	Aoabad32.exe
4468	Ahjgjj32.exe
1792	Aodogdmn.exe
1968	Bjicdmmd.exe
644	Bcahmb32.exe
3588	Bjlpjm32.exe
3092	Bohibc32.exe
944	Bfbaonae.exe
5108	Ciafbg32.exe
1428	Ccgjopal.exe
1708	Dpnkdq32.exe
4824	Djcoai32.exe
1356	Dmalne32.exe
4852	Dbndfl32.exe
4128	Dmdhcddh.exe
4000	Dpbdopck.exe
3520	Dfoiaj32.exe
2072	Dmhand32.exe
5076	Ebejfk32.exe
2412	Ecefqnel.exe
4656	Emmkiclm.exe
228	Efepbi32.exe
4868	Eidlnd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Inmabofh.dll	Knalji32.exe
File created	C:\Windows\SysWOW64\Hfaajnfb.exe	Gpgind32.exe
File created	C:\Windows\SysWOW64\Jmbhoeid.exe	Ilcldb32.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Kpqfid32.dll	Gpolbo32.exe
File opened for modification	C:\Windows\SysWOW64\Nijqcf32.exe	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Pcpnhl32.exe	Pqbala32.exe
File created	C:\Windows\SysWOW64\Djdflp32.exe	Dakacjdb.exe
File created	C:\Windows\SysWOW64\Dfdpad32.exe	Dnmhpg32.exe
File created	C:\Windows\SysWOW64\Jdgccn32.dll	Ebimgcfi.exe
File created	C:\Windows\SysWOW64\Geqnma32.dll	Amlogfel.exe
File created	C:\Windows\SysWOW64\Ckebcg32.exe	Cponen32.exe
File opened for modification	C:\Windows\SysWOW64\Dqbcbkab.exe	Dqpfmlce.exe
File created	C:\Windows\SysWOW64\Chkolm32.dll	Mmnhcb32.exe
File created	C:\Windows\SysWOW64\Dgeofeib.dll	Onnmdcjm.exe
File opened for modification	C:\Windows\SysWOW64\Aojefobm.exe	Qklmpalf.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Ilnbicff.exe
File created	C:\Windows\SysWOW64\Adfonlkp.dll	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Ebjjgd32.dll	Dakikoom.exe
File created	C:\Windows\SysWOW64\Bpfljc32.dll	Fqgedh32.exe
File created	C:\Windows\SysWOW64\Ohlemeao.dll	Jhifomdj.exe
File opened for modification	C:\Windows\SysWOW64\Fpggamqc.exe	Fimodc32.exe
File created	C:\Windows\SysWOW64\Gdgfnm32.dll	Jpbjfjci.exe
File created	C:\Windows\SysWOW64\Bmnogj32.dll	Odjeljhd.exe
File created	C:\Windows\SysWOW64\Njlmnj32.dll	Ilfennic.exe
File opened for modification	C:\Windows\SysWOW64\Iacngdgj.exe	Inebjihf.exe
File created	C:\Windows\SysWOW64\Kdpmbc32.exe	Kjjiej32.exe
File opened for modification	C:\Windows\SysWOW64\Fdqfll32.exe	Flinkojm.exe
File opened for modification	C:\Windows\SysWOW64\Mminhceb.exe	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Bldqfd32.dll	Onpjichj.exe
File created	C:\Windows\SysWOW64\Ebmenh32.dll	Dnbakghm.exe
File created	C:\Windows\SysWOW64\Lfipab32.dll	Eecphp32.exe
File created	C:\Windows\SysWOW64\Gncchb32.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Cnnbme32.dll	Gncchb32.exe
File created	C:\Windows\SysWOW64\Lgffic32.exe	Lnnbqnjn.exe
File created	C:\Windows\SysWOW64\Galdglpd.dll	Gpbpbecj.exe
File created	C:\Windows\SysWOW64\Fhhfif32.dll	Johnamkm.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Oghghb32.exe	Ogekbb32.exe
File created	C:\Windows\SysWOW64\Onapdl32.exe	Oghghb32.exe
File created	C:\Windows\SysWOW64\Ecpfpo32.dll	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Haaaaeim.exe	Hldiinke.exe
File opened for modification	C:\Windows\SysWOW64\Gbalopbn.exe	Gpbpbecj.exe
File created	C:\Windows\SysWOW64\Fjhacf32.exe	Ejfeng32.exe
File opened for modification	C:\Windows\SysWOW64\Lqikmc32.exe	Lnjnqh32.exe
File opened for modification	C:\Windows\SysWOW64\Oejbfmpg.exe	Onpjichj.exe
File opened for modification	C:\Windows\SysWOW64\Pccahbmn.exe	Ocaebc32.exe
File opened for modification	C:\Windows\SysWOW64\Dolmodpi.exe	Dgeenfog.exe
File opened for modification	C:\Windows\SysWOW64\Dkhgod32.exe	Dqbcbkab.exe
File created	C:\Windows\SysWOW64\Ekjded32.exe	Ehlhih32.exe
File opened for modification	C:\Windows\SysWOW64\Ebejfk32.exe	Dmhand32.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Ngndaccj.exe
File opened for modification	C:\Windows\SysWOW64\Paiogf32.exe	Pdenmbkk.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Aaldccip.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Ihbponja.exe	Ieccbbkn.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jhifomdj.exe
File created	C:\Windows\SysWOW64\Omdieb32.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Ficlfj32.dll	Gpgind32.exe
File opened for modification	C:\Windows\SysWOW64\Mkhapk32.exe	Lqbncb32.exe
File created	C:\Windows\SysWOW64\Ponfka32.exe	Phdnngdn.exe
File opened for modification	C:\Windows\SysWOW64\Fiodpl32.exe	Ffqhcq32.exe
File created	C:\Windows\SysWOW64\Famkjfqd.dll	Lopmii32.exe
File created	C:\Windows\SysWOW64\Cagdge32.dll	Eqlfhjig.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4828	4836	WerFault.exe	589

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjhhfnd.dll"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aaldccip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkhpfbce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fgcjfbed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkjmfeo.dll"	Pemomqcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gengje32.dll"	Pehngkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmimai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnangaoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojomcopk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gengjl32.dll"	Ibobdqid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfghnikc.dll"	Lnjnqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkopekaa.dll"	Eokqkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffqhcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgcjdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncofplba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnmoijje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpbflg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehlhih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgffic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oldjcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Poliea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgccelpk.dll"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eadpldgf.dll"	Kgopidgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfokn32.dll"	Gbalopbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdaia32.dll"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmncdk32.dll"	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pegopgia.dll"	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fechok32.dll"	Omgcpokp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdpjlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hibjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiapmnp.dll"	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinclj32.dll"	Dolmodpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqhoeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mminhceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmmncpmp.dll"	Ieccbbkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhldbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgeofeib.dll"	Onnmdcjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emmkiclm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lebijnak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nijqcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbbhqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kejocggj.dll"	Lghcocol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npkjmfie.dll"	Pocfpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbndfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fknofqcc.dll"	Piocecgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncofplba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnpdegjp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1520	1148	792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe	87
PID 1148 wrote to memory of 1520	1148	792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe	87
PID 1148 wrote to memory of 1520	1148	792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe	87
PID 1520 wrote to memory of 2340	1520	Caghhk32.exe	88
PID 1520 wrote to memory of 2340	1520	Caghhk32.exe	88
PID 1520 wrote to memory of 2340	1520	Caghhk32.exe	88
PID 2340 wrote to memory of 3616	2340	Cfcqpa32.exe	89
PID 2340 wrote to memory of 3616	2340	Cfcqpa32.exe	89
PID 2340 wrote to memory of 3616	2340	Cfcqpa32.exe	89
PID 3616 wrote to memory of 1144	3616	Cibmlmeb.exe	90
PID 3616 wrote to memory of 1144	3616	Cibmlmeb.exe	90
PID 3616 wrote to memory of 1144	3616	Cibmlmeb.exe	90
PID 1144 wrote to memory of 1716	1144	Ccgajfeh.exe	91
PID 1144 wrote to memory of 1716	1144	Ccgajfeh.exe	91
PID 1144 wrote to memory of 1716	1144	Ccgajfeh.exe	91
PID 1716 wrote to memory of 2264	1716	Cjaifp32.exe	92
PID 1716 wrote to memory of 2264	1716	Cjaifp32.exe	92
PID 1716 wrote to memory of 2264	1716	Cjaifp32.exe	92
PID 2264 wrote to memory of 2456	2264	Dakacjdb.exe	94
PID 2264 wrote to memory of 2456	2264	Dakacjdb.exe	94
PID 2264 wrote to memory of 2456	2264	Dakacjdb.exe	94
PID 2456 wrote to memory of 412	2456	Djdflp32.exe	95
PID 2456 wrote to memory of 412	2456	Djdflp32.exe	95
PID 2456 wrote to memory of 412	2456	Djdflp32.exe	95
PID 412 wrote to memory of 1140	412	Dannij32.exe	96
PID 412 wrote to memory of 1140	412	Dannij32.exe	96
PID 412 wrote to memory of 1140	412	Dannij32.exe	96
PID 1140 wrote to memory of 3508	1140	Dhhfedil.exe	97
PID 1140 wrote to memory of 3508	1140	Dhhfedil.exe	97
PID 1140 wrote to memory of 3508	1140	Dhhfedil.exe	97
PID 3508 wrote to memory of 1752	3508	Diicml32.exe	98
PID 3508 wrote to memory of 1752	3508	Diicml32.exe	98
PID 3508 wrote to memory of 1752	3508	Diicml32.exe	98
PID 1752 wrote to memory of 4448	1752	Dcogje32.exe	99
PID 1752 wrote to memory of 4448	1752	Dcogje32.exe	99
PID 1752 wrote to memory of 4448	1752	Dcogje32.exe	99
PID 4448 wrote to memory of 948	4448	Dabhdinj.exe	101
PID 4448 wrote to memory of 948	4448	Dabhdinj.exe	101
PID 4448 wrote to memory of 948	4448	Dabhdinj.exe	101
PID 948 wrote to memory of 1080	948	Facqkg32.exe	102
PID 948 wrote to memory of 1080	948	Facqkg32.exe	102
PID 948 wrote to memory of 1080	948	Facqkg32.exe	102
PID 1080 wrote to memory of 4092	1080	Fagjfflb.exe	103
PID 1080 wrote to memory of 4092	1080	Fagjfflb.exe	103
PID 1080 wrote to memory of 4092	1080	Fagjfflb.exe	103
PID 4092 wrote to memory of 3808	4092	Ghpocngo.exe	104
PID 4092 wrote to memory of 3808	4092	Ghpocngo.exe	104
PID 4092 wrote to memory of 3808	4092	Ghpocngo.exe	104
PID 3808 wrote to memory of 4828	3808	Ibobdqid.exe	106
PID 3808 wrote to memory of 4828	3808	Ibobdqid.exe	106
PID 3808 wrote to memory of 4828	3808	Ibobdqid.exe	106
PID 4828 wrote to memory of 3048	4828	Jbiejoaj.exe	107
PID 4828 wrote to memory of 3048	4828	Jbiejoaj.exe	107
PID 4828 wrote to memory of 3048	4828	Jbiejoaj.exe	107
PID 3048 wrote to memory of 688	3048	Jkaicd32.exe	108
PID 3048 wrote to memory of 688	3048	Jkaicd32.exe	108
PID 3048 wrote to memory of 688	3048	Jkaicd32.exe	108
PID 688 wrote to memory of 4888	688	Kiejmi32.exe	109
PID 688 wrote to memory of 4888	688	Kiejmi32.exe	109
PID 688 wrote to memory of 4888	688	Kiejmi32.exe	109
PID 4888 wrote to memory of 4124	4888	Knbbep32.exe	110
PID 4888 wrote to memory of 4124	4888	Knbbep32.exe	110
PID 4888 wrote to memory of 4124	4888	Knbbep32.exe	110
PID 4124 wrote to memory of 952	4124	Kelkaj32.exe	111

C:\Users\Admin\AppData\Local\Temp\792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe
"C:\Users\Admin\AppData\Local\Temp\792c34e663e8e6795fb99093801a5e4e173b8a085c4bb2d34d85bbbf3458d447.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\Caghhk32.exe
  C:\Windows\system32\Caghhk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\Cfcqpa32.exe
    C:\Windows\system32\Cfcqpa32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\Cibmlmeb.exe
      C:\Windows\system32\Cibmlmeb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
      - C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        23⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        24⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        27⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        28⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1172
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        32⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        35⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        36⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        37⤵
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        39⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:980
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        43⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        44⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        46⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:644
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        48⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        49⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:944
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        51⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        53⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        54⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        55⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        57⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        58⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        61⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        62⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        65⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        66⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        67⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        68⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        69⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        70⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        71⤵
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3012
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        73⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        74⤵
        Drops file in System32 directory
        
        PID:1332
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        75⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        76⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        77⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        78⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        79⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        80⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        81⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        83⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        84⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        85⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        87⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        91⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        92⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        93⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        94⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        95⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        96⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        100⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        102⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        103⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        105⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        106⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        107⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        108⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        109⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        110⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        111⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        112⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        113⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        114⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        115⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        117⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        118⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        121⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        122⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        123⤵
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        124⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        125⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        126⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        127⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        128⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        130⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        131⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        132⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        133⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        134⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        136⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        137⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        138⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        139⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        140⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        141⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        143⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        144⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        145⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        146⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        147⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        148⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        149⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        151⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        153⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        154⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        155⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        156⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        157⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        158⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        160⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        161⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        162⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        163⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        164⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        165⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        167⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        168⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        170⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        171⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        172⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        175⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        176⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        177⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        178⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        179⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        182⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        183⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        184⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1484
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        186⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        187⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        188⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        191⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        192⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        194⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        195⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        196⤵
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        198⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        199⤵
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        200⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        201⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        202⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        203⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        205⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        206⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        207⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        208⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        209⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        210⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        211⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        213⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        214⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        215⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        216⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        217⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        218⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        219⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        220⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        221⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        222⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        224⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        225⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        227⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        228⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        229⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        230⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        231⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        232⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        233⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        235⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3036
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        237⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        238⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        239⤵
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        240⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        241⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        242⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        243⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        244⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        245⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        246⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        247⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        248⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        249⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        250⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        251⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        252⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        254⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        255⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        256⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        257⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        258⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        260⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        261⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        262⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        265⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        266⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        268⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        269⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        270⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        271⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        272⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        273⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        274⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        275⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        276⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        277⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        278⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        279⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        280⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        281⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        282⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        283⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        284⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        285⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        286⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        287⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        288⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        289⤵
        Drops file in System32 directory
        
        PID:8812
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        291⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        294⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        295⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        296⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        297⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        298⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        299⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        300⤵
        Drops file in System32 directory
        
        PID:8284
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        301⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        302⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        305⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        306⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        307⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        308⤵
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        309⤵
        Drops file in System32 directory
        
        PID:8936
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        310⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        311⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        313⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        315⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        316⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        317⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        318⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        320⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        321⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        322⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        323⤵
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        324⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        325⤵
        Modifies registry class
        
        PID:8568
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        326⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        327⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        328⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        329⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        330⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        331⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        332⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        335⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        336⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        337⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        338⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        339⤵
        
        PID:704
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        340⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        341⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        342⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        343⤵
        Modifies registry class
        
        PID:9384
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        344⤵
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        346⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        347⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        348⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        349⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        350⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        351⤵
        Modifies registry class
        
        PID:9716
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        352⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        353⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        354⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        355⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        356⤵
        Modifies registry class
        
        PID:9916
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        357⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        358⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        359⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        361⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        362⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        363⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        364⤵
        Drops file in System32 directory
        
        PID:9220
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        365⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        366⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        367⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        368⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        369⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        370⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        372⤵
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        373⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        374⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        375⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9828
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        377⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        378⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        379⤵
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        380⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        381⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        382⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        383⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        384⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        385⤵
        Drops file in System32 directory
        
        PID:9380
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        386⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        387⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        388⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        389⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        390⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        391⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        392⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        393⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        394⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        395⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        396⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        397⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        398⤵
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        399⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        400⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        401⤵
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        402⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        403⤵
        Modifies registry class
        
        PID:9244
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        404⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        405⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        406⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        407⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        408⤵
        Modifies registry class
        
        PID:10204
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        409⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        410⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        411⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        412⤵
        Drops file in System32 directory
        
        PID:9328
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        413⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        414⤵
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        415⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        416⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        417⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        418⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        419⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        420⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        421⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        422⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10456
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        424⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10540
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        426⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        427⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        428⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        429⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        430⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        431⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        432⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        433⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        434⤵
        Modifies registry class
        
        PID:10916
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        435⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        436⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        437⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11088
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        439⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        440⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        441⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        442⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        443⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        444⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        445⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        446⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        447⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        448⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        449⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        450⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        451⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        452⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        453⤵
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        454⤵
        Modifies registry class
        
        PID:10816
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        455⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        456⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        457⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        458⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        459⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        460⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        461⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        462⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        463⤵
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1524
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        465⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2404
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10468
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        468⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        470⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        471⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        472⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        473⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        474⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        475⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        476⤵
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11196
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        478⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        479⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        480⤵
        Drops file in System32 directory
        
        PID:3692
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        481⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        482⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        483⤵
        Modifies registry class
        
        PID:10788
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        484⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        485⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2104
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        487⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        488⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        489⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        490⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        491⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        492⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        493⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 420
        494⤵
        Program crash
        
        PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4836 -ip 4836
1⤵
PID:10452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
74KB

MD5
a24f6632baf530980e0f8277f5076c24

SHA1
e072cc3191fc4f18fd52922eae018d6778747089

SHA256
8801ac76cd4a56481ebc3bae91281d0f55cb59f1846e1c624f4248c0c8e8f2fa

SHA512
e1202c93822eeebdc380e68a7b8d5fa4f12589324ac5f0d5375e7c8385542860f25adca7d2f83e572ff33ae86b6e6a1c2b089e0128ac2cecd98b2a91dc22cc2e

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
74KB

MD5
3638d102a9f08353789dbd243270ad6a

SHA1
a6c011556069a3c9a0a53c59c6846ae296b2185c

SHA256
f62601598804e0f50d3978abcc5ca97ca7b36429c7720b3782421aae40c8ad02

SHA512
0801fc4943dc90a314401b11816ad414b55d52538d6e894e16c77c8005203a8da05884f670437f9c17d538b0fe8510c06b42f6e46cc5dec864d277db8dc41fd6

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
74KB

MD5
db1fbc00fe593859c69cb0a5c8ab20e0

SHA1
ac18b70e0c8013fef56c9900d441cfef6b088aa8

SHA256
03acaef712c91ee6b6be9698c6805e2460e6c9767c8bde1feb71557f53a69274

SHA512
716521c3c3f3c0d299e5a90788fe201fa1b718fd3b490764fe62d75f7153532981e1a8b7e0b91197dfa86dbd7a6af08f75deb674cf34d8998eb3cfeeac2080d4

Download Submit
C:\Windows\SysWOW64\Caghhk32.exe

Filesize
74KB

MD5
cdca755024fab7b3ff557100c14e942b

SHA1
4da636de2668cc40789b6e285092d7ca3a8aa67f

SHA256
df2e0dce135ec6c0b05edc1263860247ea71ed939a01ead9acd33f10c11349e7

SHA512
132592a21183296352889655bb6671269a0e3839837555fad10d7f1a43af0993a6524684136ad9e8eddd919af5cb4423775405220c74d9f134859360e26357c5

Download Submit
C:\Windows\SysWOW64\Ccgajfeh.exe

Filesize
74KB

MD5
444f9137280e9221ebcb0666cc6bc2d3

SHA1
12084a45f5916dac60da947011322820dbe41a99

SHA256
f4ca29f1716a94b8485af54cb9216912ece8918f71c2ea1172179fbcb680ca63

SHA512
9b343bc0bd085e20ef196d132b262d8d542f3ef7ed3ccc0aeae077c1e97a43032e7dca8264612ad0c6f6fb192f77c70cc9f0c39784c75e5f9a2bf008ac1e9678

Download Submit
C:\Windows\SysWOW64\Cfcqpa32.exe

Filesize
74KB

MD5
c285137798552093a3b9726ac4c27a6f

SHA1
ce18d4f098aec00052e5e42e8e91de2def5d3434

SHA256
7c5c9a32cdd522e91dcb3d82ce5b3b14be7b89bdf1974407b89176ecf719d4d9

SHA512
74932ec16ea8ed5fe744354cb1b6be943e9c3a58bf55739555b1ef2fc6b5bce1ec687992e364c7d256a76953802a05a1f3019f6b9ecd067a2c7cae38eccc16a6

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
74KB

MD5
16d7e859685e1e6def708423d54176ba

SHA1
45d263162ce0422a30674108119dd687f28108fd

SHA256
c998911f9a88b0ee3e7e64f5f77d07d209c0549e0cdbc3b4b26547adb6109532

SHA512
f884813c9f044408979ed09e8a269ce53f6eca59b405b4d270006dc543232fad713da680b9803a30708025ac6dfc6ff9114c5b81a2541688f020cc8e8cb12edf

Download Submit
C:\Windows\SysWOW64\Cibmlmeb.exe

Filesize
74KB

MD5
af448a185b7f8e60b68efbe65241ea94

SHA1
b78792dd9969dcb4fcd61dde672f38141eeaba42

SHA256
1fea10171b05b2dfcf4467ac89229b3ca97a3cf5fa4f5c121a38a882aa01e940

SHA512
8db42812c49fbdc1bce0019fce61deda7420f651e18fb6096beae4ec8c4795cb87eeb54b7ec0d82c8275c1f392b0fca983694b99bfa82b45d91d7888bfc6a2b6

Download Submit
C:\Windows\SysWOW64\Cjaifp32.exe

Filesize
74KB

MD5
a5d4401513b000daa73327ba78781cca

SHA1
1bb902601b67e95fc154cd20f897efeee6d4f9fa

SHA256
291b2371a42f6e31f9f51ca3dd152c1c3bda4117e471e6b87ce96b135e5396d9

SHA512
069ae1a8e24656770ef368055ce161aeee5b45fe4344e316263bf94a1c4cbf8c3a815931f62652a725ec59f1fc6a665699ef4f6457fcca5d9d3453ead1282e77

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
74KB

MD5
141fdffab1dbaae3ecee25a501e8447c

SHA1
665a4561583f9897575c708f56f5842a7d304eb1

SHA256
fa849cc62409351243b111b393a39cb6b64ca8d9b28f91bf107aaaaae7a913fc

SHA512
5482959007dcf4320a435de0689e1d2f8ef2846d408eabac8c17d9cefeb66c8ef0b07cccc0facd36e19e1be2c7b62688cbd21c15a84e1ac0ba5e7ab67a72c37f

Download Submit
C:\Windows\SysWOW64\Dakacjdb.exe

Filesize
74KB

MD5
0b26ec4c1b2c273eadd09354fd134fd2

SHA1
23a98d115c48e40324001b3ededf1d20360de931

SHA256
3f69ec66414eb399736ec461ca91253b6ebde95e4aeb94e5582c1319dea27b0e

SHA512
06f370174d3f08640123c38ff06dc521f0042a0539227250225a2056f96697e9e4753782157fb87676c091936a6aee5d151d93201388df5b70e83e010ff2843e

Download Submit
C:\Windows\SysWOW64\Dannij32.exe

Filesize
74KB

MD5
4c11c08db8a8d2cfe7e6d65aa3165cb3

SHA1
5d401209c88097b977c39c5ee5a6fb662ac25f89

SHA256
4d60e752da4c3db9662bc73aff4e233466477bd4dcd7bff603fcb565378a36fa

SHA512
1d4f7e90590b1d09e316b66efc0e3f154e88652cdc0438cef4792f5064818398a3658a018e91a76c7e220c8f15652ac88732d912a281719bf961c052b2684cde

Download Submit
C:\Windows\SysWOW64\Dcogje32.exe

Filesize
74KB

MD5
69c5e96002376741f5c9941fdb17189f

SHA1
d984765e0528272c11692679ac82dc8826319325

SHA256
cb80decc864daebfb2735b675e16bf5c861190d7268ca2859c0ac1c4228f631a

SHA512
5c9a15ec0171ddfc311f786a8da6c30ab613bcb777d76e2ec96adb5678508b2b4be3b6c6906bb66c43ffa9ef911cbe47adde17ecd231dff4d886a47cf941a803

Download Submit
C:\Windows\SysWOW64\Dhhfedil.exe

Filesize
74KB

MD5
526eec4c2d6accdc1783083ab0c25881

SHA1
5441e15fb74465969769e73c9f097282828c4c6e

SHA256
d752aee090f7d31df5f0029b20c4a04fce08328c50187cdcda16b2854ecad030

SHA512
125ffa5740dfac429ffe78c853ba6de97883ca43cc829e30c2fe53ca084b62fc3f2d634f33cc07074ed7ddbc9bf0049846e668e516e596d74b03f692967f55b9

Download Submit
C:\Windows\SysWOW64\Diicml32.exe

Filesize
74KB

MD5
47e36888d8590f90fc800eb6cbbd041a

SHA1
7040e739d914ba967eefdc00880eeba534feae78

SHA256
e1af91bd79e3880b4c93430af7334be391c193327759dd0027ebaaddd5dbc77a

SHA512
e6baf4e0a6cd4397c3702c3a2ff8ee103aa589c1bd80b01f801244c99a3952261ba880077507ce7a98aa1694f7f4360875c0f7b5d1b8cb72af47e6264a48029d

Download Submit
C:\Windows\SysWOW64\Djdflp32.exe

Filesize
74KB

MD5
a81b452c78f35b2ae003e0e1f30fdfc4

SHA1
d75a6b370d08349aa0106c19207f631f8c64a5eb

SHA256
7b92e0963de3e6c22e585936bca3707466d697edc30b92a3f402c0829d24f17e

SHA512
083f2ae001ad4898ab27913d00f91d24e6c2bd8b08d1bb7ca17c79384c40366a23a9aaa6badd048b5712a2fc8cc35f791133b5ec7ceae35ddef45e429c1a656a

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
74KB

MD5
3596fa3dd31cb3d41adf3927baed58c0

SHA1
08aec4fffc74afdc194d59daa58d338bda5fd517

SHA256
a099a7921e73c87e91b61dfcf64d16453c85ff1c25e2fd911bb69b861ab9ac52

SHA512
72ff2fa367d0adc8b166e1c0d6eee391fab188c4f5a773ca783cab43f5b212ed06a5409ba7c942ab883a5e56a0071f7719c0caa87db0082ceae1ee1bbbdfcca4

Download Submit
C:\Windows\SysWOW64\Dnbakghm.exe

Filesize
74KB

MD5
cf491bab0ccbbf2b3c902c5724d288c3

SHA1
164907376b446d72c23788604f35eda895b05ff1

SHA256
59db3537eb026eb96960e80a5adf0afd219936961292796de28292ac82aff447

SHA512
6ad526bb0d839a0dabfcff37c07c4f0d66d15baa390ad15a35e505030c5ebbfcfc0d69ab3db074ba39c22d98b24563f40fdeb051a2cbd9f64e41dad2bfca9149

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
74KB

MD5
04ee7de21728b58be56095540257e884

SHA1
b92a8dc3bf654d553f31cd7e12cad662eb386cdd

SHA256
523dd06ed19f9bf5aec75bbf226366304c09673b96d496659bc4984568962ccc

SHA512
390ed913c23ce5b0996648197c6b8369786c235b259cadc2bc4ec252714fac2fd3950254855bca65a677e64254205d50d208451dae719ed95c496abba94f6f64

Download Submit
C:\Windows\SysWOW64\Ebejfk32.exe

Filesize
74KB

MD5
f720b6f386277232bed86d6e38a45b73

SHA1
6dcf9c9d916b208c52f12920a9343c13a2cb2ec6

SHA256
001f1b0a9ef900cad6a2eae7851bc21d7ccd3c4a2bc77661d42f74ed43bdc713

SHA512
5fd745f946e6fc877ac1d1c4875efac033ba3942425b21985a820e037006335bf160ee0828d58f717b234bf1c935a9b9874a31ba3b9300683e0edf57a5cd56aa

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
74KB

MD5
130c037bfe568f8495783399733ba261

SHA1
8e1559c4bbffc6210a9f67eecb4fea3347faf635

SHA256
8726f2fbe1611b1d25dbcb3cf9c00647d5b7b92fcbeafe2f980cdc46ff26b5af

SHA512
a338e41a1e6e135ed73e00a2f6720890095da337ad5f62efb6389ad6cbc7d78d8e088572f337681c83493dd51a46727d2ac964a2695e6ce898329431b244bd29

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
74KB

MD5
7499d7ac6b71954f4db49696bb51cb21

SHA1
0ea9acc16801ebb62b8bbb60acf2686398cc5417

SHA256
0ca2d9f2a96780f476faae1f6401098e9c532032668b0efb7bfb754f0a93e8b4

SHA512
798863906faaa7545da50b788fd1ddc7062f9b25ea17f2d1ce0599b7648450ea5bd5b3d6a2a039440844fe63a1b547f0237f05617c99e35238c6e65234be61f7

Download Submit
C:\Windows\SysWOW64\Fmhdkknd.exe

Filesize
74KB

MD5
e3e71ed8e006ec71840fcd18250ace9e

SHA1
a406408785f2d3ae6d34b4e01cf8e9e2caabbf2a

SHA256
f194339823d3fa4ec52650a2b6a292bec7aa8e2210d8ecde27d747e8da552003

SHA512
022b4b0e0581ed39276f0dc23b3d486f94f881ce418ba93fddb9507a3cba29adf55b3e799e846eccb8a0b2687e6bfa429d7344bd1c575fd83960c111d07034b5

Download Submit
C:\Windows\SysWOW64\Fqgedh32.exe

Filesize
74KB

MD5
ac9c37d0feeb05d491ed883f74acc7c1

SHA1
cf4729742ea32d489e0dd30ab86f985e46521f83

SHA256
f37dd73506c99d0dc08f820ddf3ba514ce9bf67deaab12c11b2e6ddf6f15da2a

SHA512
3b367c19de89a7fbafe577f7b5fd5a904c4bcdd4bd2b9d71a759997360d4ae139e7931f4b484a4917ed7544e7b2e38078c97b613884bb388c588388ce9222dff

Download Submit
C:\Windows\SysWOW64\Ghpocngo.exe

Filesize
74KB

MD5
06813674d3011833f8d0ee320a464d11

SHA1
84cf8ee6ea4dbc321789731ab019f1ca8eb1e49f

SHA256
bbf8ed70aa56e16dbfac4f3b93eb0cf6c88b9b76f2dccacb40b859b7317b32ed

SHA512
9fadc67ebd6cd1abaa61c00355a8bb773054cecd59ed192e68b4a3b1b1ad770541364f70fcc915f8ef11c283f5677cecf93fbc1b9a9b4044229977b50a8b892d

Download Submit
C:\Windows\SysWOW64\Hnphoj32.exe

Filesize
74KB

MD5
3fa7cbb4bb0f2a17b234bd945b76c0ab

SHA1
121c14c316a62032358b30604166fef1ee19a458

SHA256
b7288724c44040378c552cbc4c70075c59798a58a46cd2a5c3152d3da32d9820

SHA512
592015a0c5d2020d8c7f4f73addd07fd2ae184a5165c0516de973b7190fb79eaeec73dcfae9ae98ea05caa6e1a18189bd8aa4e3f48059fc5afe9c9cc2acb84ef

Download Submit
C:\Windows\SysWOW64\Ibobdqid.exe

Filesize
74KB

MD5
0d30f698227a5a9372e097c67fedd747

SHA1
b7af799b844a704bff9fcca2d24b43564898b151

SHA256
c6c73a6123cca4de83c09887004de1a596760835039d009857316977a5ef81f1

SHA512
b8d5d2cd5f15c4cc0e2aa532fd92fefa6b1784cfcac85e27b0e13552be4abf2ffdd0bcd15f5487c612385bbdbf5dde1f4a73b9916ae427a192dabee643137680

Download Submit
C:\Windows\SysWOW64\Ilcldb32.exe

Filesize
74KB

MD5
2c6a3db0c14f653f770651218c6785a1

SHA1
1924b3890b544dda89cff2d5a7d276abcd56201f

SHA256
e1a6cfadfaaa38a087d81dbda727f7d2dfa3d154b88a36d6d02fe414da580c32

SHA512
91ae1f5f0a2328d290a286243f99b7b09b916d69466c9ad5c995a3ec0b2bd6ea8795ec3a1e659e35eea23fabfbb64cf174ed84a1a79c370ed0cb8b1fd1c870e3

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
74KB

MD5
132334f9b0fef9a17c264ca5086f9afc

SHA1
2a2dafac4228b5d8f4465e616f82a1c18fa33533

SHA256
d66ec925fe42326a137de60626f8bcb63a56a52898944ac9a5cf724d98b1d247

SHA512
a52b039d18860113b9fa86e0a65b90868516c0f3af3081d88203ab000d5f6d05637fed328ad0db0a5423a4a61253fafccc6134999d0d427b8fe5ea0c8441151d

Download Submit
C:\Windows\SysWOW64\Jbiejoaj.exe

Filesize
74KB

MD5
2f2926bb4db3d3bb0ef06a7f01464a72

SHA1
8c92a10e680c6f2448059e2c9a002d5019b9a0e5

SHA256
35d67d174f38ede231472ee7fa96c4a89ee2876bda83ca3ec2a40a3e36cf955f

SHA512
f54143553a1d7f4705e3853aaf9f2c8a852184700bf10796181729c30b0331c8a93e999ae5f7fa5a2d4be6f044b5c3e72d8a4740ec529eb2ffc6d2c0da80da5f

Download Submit
C:\Windows\SysWOW64\Jedccfqg.exe

Filesize
74KB

MD5
8323bc516d742dd473ebca778a5f6da6

SHA1
63dddfa0de57ee0a59d085f82f48b830d286a32f

SHA256
44e670d8daf4baa742f1f9c82fa6ff1b86d4845c2e23bfa9e0736d8d6370379c

SHA512
ca76b092ad677e2400c08f2c3483e192d1a9c8fe05bd13771d6395be3ee4ff0aeba5cb512c60b3537179eb720e25c0ffd51c016244a6f067abb48e164ae4deba

Download Submit
C:\Windows\SysWOW64\Jkaicd32.exe

Filesize
74KB

MD5
a335c52159d2448148242e7b7a44f21f

SHA1
8189883f33f999cf1fa516ea18799a3f1ee5a6e0

SHA256
397d691bb628b8092342f3fe9db22b742fe79bb0041441413a5b06d7c26f49ab

SHA512
04d0a337d55d698b6ff0f67a8f1d9ab12f9d8a8b263567ec0ff34715eec66b54b6fa3dfb513a837ee3cc5860ba2fad3baa71b5dcce723110b2dc747f1123802a

Download Submit
C:\Windows\SysWOW64\Kbbhqn32.exe

Filesize
74KB

MD5
df5df5c11d2b2210abce19d415a0bc88

SHA1
441c09b04b8af36b84645e40d9aa8c5386dbba63

SHA256
d158893dd571e9a00113287ec10f8094a4c8450750725f4b6b68471b4c031549

SHA512
807ea1e976fed5b360dd2a9ae87406e8dc83a341c58c359191c2fad89ab3fd881955deafce1ad7cec5c09c20d9a4e6585663c073c4ccddb142b69ee6946bac2e

Download Submit
C:\Windows\SysWOW64\Kdpmbc32.exe

Filesize
74KB

MD5
3454397b135097ce121043a040ee1a1e

SHA1
1b373c2b1c037d34978a75f6f2b80d262640fae1

SHA256
740e1f224f62a3d220ac4f101d3c0c752cfbdc8c4e87033bc1cf389a3c142888

SHA512
2294fdc62e63ebea32910b9ba48e4f3e115206fca70c5fa6d046cda20a7edd89c60a5e2877e24cd81eea07a192a18cdbe47d301906fabea2ed887f34176ada5e

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
74KB

MD5
880ca0ade86c4e5434e6805cf743e121

SHA1
a297c916681fff38bb65b907debdd85c827a6d40

SHA256
736bc7496fb6e5dffb01392a0166fa9d9ce5957e6f6f2470b742c98856084507

SHA512
587e85e578c204238d0098ac8cb621dc1f76cd56a3089e4e6295205dc1a08b912752ad3ff8890dfe546958d1d4bcdb7c9547645392e71b9baa3d96dac129ee7c

Download Submit
C:\Windows\SysWOW64\Kenggi32.exe

Filesize
74KB

MD5
3efa6b09007f7b14069815212405e61c

SHA1
4c37d9c104da888be0ee05c89427cffe4d447677

SHA256
efb50d03f781532e2f06f47d03b74a88c270b2ddbce49423e3e1a57a611845ce

SHA512
691bb0a8a03366398c15d71a14cc03eecc6429fe9dba9f2c571d81cd3c42de8c29b89165306a53e271aaa193435a13a6a52023c529cfdd1437e768b63b75126a

Download Submit
C:\Windows\SysWOW64\Kgopidgf.exe

Filesize
74KB

MD5
c7454e0801fa9b4ff6b0e24ea744ccf3

SHA1
4f446681b5c3dafa07cbcac584f303d1f88658b4

SHA256
03d32bd2d42bd4bb018a4b8b74168cda193ee694556c73aa119d314b55e68089

SHA512
d969bb16df5002bcdea39d9e1f323fd1bde50128cd724cfa4de66e98fa32ee3a12a1b929006e2f63afa81336ea274107f4bd48dc57dd154a51c22f5a6ed70be4

Download Submit
C:\Windows\SysWOW64\Kiejmi32.exe

Filesize
74KB

MD5
96c532b2affa1d4f2756585a6b10e8b1

SHA1
921c7eb48ce63cd2439499b34ec5de2e5d3da16a

SHA256
28f23bd966b77512cf8e68faf25bb03a3ae375cd94367874fd44b79a58151238

SHA512
43e5e00dcf9b553dc8d5243438094d2b6ea8f09afab736a622229ca6d2a30f5517247535a4991649f421b10381014265cc1b613666d972fec380c0288787ab29

Download Submit
C:\Windows\SysWOW64\Kkhpdcab.exe

Filesize
74KB

MD5
9dca03265fdb6c78108769060f8a2e35

SHA1
fbaab953f7e65e7e103a8489ac822a32e164fc4d

SHA256
faf70f4b003024f354102e32d6bed563210fb86e15ab40017e57dd25d7e4f142

SHA512
71973e938355721102603c0f45328371ff7de727f57448722e7dbd85bd2378b3d7dc3bdb330cf5aae2699c0d3be98d52d9702347701de71a2fced1f7e1b9ff02

Download Submit
C:\Windows\SysWOW64\Kkmioc32.exe

Filesize
74KB

MD5
a452a2875cd56b456bb31b54c6aeb633

SHA1
f1176f4497e77c8686dd3a99cb0745935f459024

SHA256
522aab285c9a3f4edcfc4d4d3b8462482beab1cfd139cda8adc9fc942c6729ad

SHA512
cbb1afc4974f141bedc6cea4b871d80594e2eb55a9456deba9fa666f4d5991c483b25c29e3c780151d9f545a66c5c09645e3e91e9fac8691b2dcbfd76b913dac

Download Submit
C:\Windows\SysWOW64\Knbbep32.exe

Filesize
74KB

MD5
a7db27859692b08f29faff343f107f18

SHA1
2275185bf8fd87f19c493955f1a06ea73ea7f45a

SHA256
fc2467974a61ec61b82097ed597ea242e5acf2b6fcbf43042b321165d26e35d7

SHA512
d745ab551a381e0866ff7fa6ebc83187e924b9ab360a6eda7e47dce297a596ed3d4b485adb0a1586747600e5c58806a6fd2644c7a63d7ce7a9dc9d00d3c290fc

Download Submit
C:\Windows\SysWOW64\Lbpdblmo.exe

Filesize
64KB

MD5
7caaf9381da472af5134239d5e29c4e5

SHA1
a90487f7d9dc343f277d5091af02d4b28236f9b3

SHA256
ce42d4750264cc58abf9b969d0b7cd41d0a3b682b70dffde5d8e4c54245ff4ea

SHA512
08b08cb03199571f5c675f7ff56373a132db7a79a63ef00c3a96277d01c603af1223091abfe00d19278a3862c4258299b0be651dd44c75ff9f201bf5921580a7

Download Submit
C:\Windows\SysWOW64\Leenhhdn.exe

Filesize
74KB

MD5
14e5c65e9676ba5b40f696ba945781d3

SHA1
d6a767d78bb05fb6d1598c4d07c7686523e0bc1d

SHA256
8fb1191bcae4cf456d96cf14739a999a19028ccbf5e6b23e99b5afe2749b683f

SHA512
24fbc5a6123802be0b60435825f27803b0e8ec67687ce7009697b0e0006067dd1715250537f0aec740fc49af2b9bed4edc2d68304eef8023285b51276b4b1a7c

Download Submit
C:\Windows\SysWOW64\Lgcjdd32.exe

Filesize
64KB

MD5
9c6a149ae34344680401f8d98e36ea81

SHA1
fe0fe0d0c6f6e5f668e804082ce59e26d043c139

SHA256
bdf101494c1e63302459ced4277191527eb29d7d423cdd50a27267b0e9ddca24

SHA512
e7b973afb89d5f79dec70297a5be7ade2da1e296fbae38702a0e99094d5b602741b64966f9a39b5872dbc912dc3d175f5242e56e3fb965d21ba0bd6ee5e40491

Download Submit
C:\Windows\SysWOW64\Lgcjdd32.exe

Filesize
74KB

MD5
fbd933d6c2eab1533c3a768c74c223c3

SHA1
29bc183afdb500d4157026740675ef1cb1a76f5d

SHA256
de83432e8a95f6873ea94d96a5ed8bd64f848d3fb151ab390191514caa03a36c

SHA512
77d5f4219e250ed195bac1a413a07c6af38c840aee90d99e109b38ae568ece48ccc4f9df79fa8012b967626c0ff7c12e7a5dad4189efc58e40eb68e0654feb9a

Download Submit
C:\Windows\SysWOW64\Lgffic32.exe

Filesize
74KB

MD5
c347b6cddfdc87bc2fc6fe117f45941d

SHA1
8f0c2050d836d49164f4b9a21d75296fadfba863

SHA256
bd4d0a6da874753ba4ad09264b42ae56743b00b4034e887fceed013cb04cd3a0

SHA512
c24e63f704c33d21c90841735a14f113b11704457051a424ce62a945aba8c0e67a303124156141752fc0612997ccf77b852fdc227c279d624a42d554f0370930

Download Submit
C:\Windows\SysWOW64\Lghcocol.exe

Filesize
74KB

MD5
49c70adc2d7a3c638efeb9f0651994fc

SHA1
72e8205f8fe86c1e2eae91639238a60afa39a2f8

SHA256
08c631d2aaf9250bc606720cfc57057afe7353b04ffb0bc5e9af264430e36fbf

SHA512
63baacdd6d32cf625cf1370f1bf03b28e531b09bd1ba698a3d78d863c139c46ae33d3c6b49e1733c98f306b6ccc0f0f25ce3bbb1785f82b751bd356a04ed4b67

Download Submit
C:\Windows\SysWOW64\Lmhqnncg.dll

Filesize
7KB

MD5
b29f9e44a7a78f30e13f38b3fd563023

SHA1
4bd2084597f31c6df03acfa725758636e6cbcb64

SHA256
a95d55e6990f36333e6d548b4cdd5539197da7dcfebc8f5db0cd6105d744e762

SHA512
127d59ac5fd21f84b77d1bc710f5fc087ca35988c9cfcf18d2200ed6fb02b7e6ff299c0dc0437804c80628fc38765ef0ebdeb913c244598a694bad48bab0dceb

Download Submit
C:\Windows\SysWOW64\Lnnbqnjn.exe

Filesize
74KB

MD5
8c3534740465ab980f01d443ad0a638d

SHA1
e39bee982804bb5c3a5516b3e4263b3536ddcadb

SHA256
a72a004ce2f89bdd13cf9d7f9539eb34e9948a3c1a3cec20ce439df0124a486d

SHA512
6b96dd666c7374c5e65f1d9076e7d834160f1bb435186b1ba551ca55b76d3eaf38f328f0e2fcaefd8643e2604a59a2d15e7d89804839066335839c18d554c95c

Download Submit
C:\Windows\SysWOW64\Lnpofnhk.exe

Filesize
74KB

MD5
6121f2c1e5660847a811596a12133e07

SHA1
aae8c016c974cfdc378ec13077703b6735efbc51

SHA256
d4c9eded87f1215cadd132a510bc1e15b5c789c1a9fe176dfe7e42da82b4238e

SHA512
b12516029f636f77bbd54d3ad83b5f23bc466f323f90f62edb6827d01ed3b417d28f0187247d1eb7956c654f1da15b7330cd21d4e94d3d353501a6d4a14350e8

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
74KB

MD5
ce0b5147f6dd0fb715f4f72f999a7730

SHA1
a5b264924bf1db858fa3fcec9a31a00ce6e57f0b

SHA256
eb9f557ead005fb1bc419bd58253da8e110d6bc1a2c2a88cb02f09d339586c22

SHA512
b3912471585c11c1e0deced6962d7f155fba8c32ab6ec9d30b33648eb5aa31cb8adad368d9cc6a555d5006e4039199e0745971191246efd4d2e16917a3e5f541

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
74KB

MD5
f36ab00e75b83fd39c9eccd864f27d1c

SHA1
5e146c124d31a3dd0a4d976717ef6460ac6b3891

SHA256
374463a1eb5d88f78c03bbe3d77ab0bbe97e27d979729fb4c16f2afb5520d2d5

SHA512
a8d810a80e184a67c081f77a588b55b7e1713fe203c0f4feafc2094fbab7df2966475b8674c2d6c922cfb58d5d00e900f776cbd4276d49e8c38a3e7f24fdb663

Download Submit
C:\Windows\SysWOW64\Oaqbkn32.exe

Filesize
74KB

MD5
32eb7f3a08727c716f49ced69e13ff5d

SHA1
e0417ce2b7a1afdbf53dc8db69b6b031fe814eb0

SHA256
da3b98d01a5f4052b70e9e71177f9f315f1b129dad8c53a617e1dd66073d7e1f

SHA512
5e0675f970d7616acd427ddf0562f87157a0ba2c499eb99210fc1ec26e5d1ddedb8c863eb9a160b965461eb02af87afe7d42245aa3dc9c06c33a650f82d42c79

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
74KB

MD5
8390342a55ed79a5845935db43dc214d

SHA1
d7bd852d603388b5af71979f1ddfe4922e919edd

SHA256
6e7b3fc53095842bd212f9a87c0452fbb36220c75ee8d6e2d54c6f44bcaa5a01

SHA512
6b02a3cb584e4d97bdee6cae9e213ad1f487d67fb3a892fd86217108753d9969ad34b6c6600ed059a7077b153af4fab43a7037445ba19c37f724ded1d1c37ec3

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
74KB

MD5
3b3971e634aa69b01008e4aff0c78fa3

SHA1
b4029666077646ceadf06d854a71f4c85ce46d10

SHA256
f81e370351290e0e1a5cb5f32e3d330abcd3554aa95dccec05b551947dba5766

SHA512
cf1fb5a34e1f576983a80f4714c8828341089150540e61bf3b8fb36f5e70590f7acf3464b82fabde7401def6c915936acc6ba26e1076f99f301d12005aae159b

Download Submit
memory/228-446-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/412-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/644-340-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/688-152-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/944-358-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/948-103-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/952-176-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/980-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1080-112-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-72-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1144-36-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1148-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1172-232-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1356-388-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1428-370-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1480-214-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1520-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1524-216-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1632-304-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1708-376-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1716-40-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1752-88-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1792-328-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1968-334-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1976-191-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2072-418-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2264-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2340-20-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2368-274-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2412-430-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2456-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2912-240-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3048-143-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3092-352-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3488-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3508-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3520-412-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3580-248-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3588-346-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3616-24-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3680-262-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3808-128-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-406-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4036-224-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4092-119-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4124-167-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4128-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4448-95-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4468-326-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4520-310-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4600-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4620-256-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4656-436-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4664-183-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4700-316-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4796-280-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4824-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4828-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4852-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4888-159-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5028-199-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5036-292-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5076-424-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5108-368-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads