c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe
Size

56KB
MD5

367f0d6b97dd26ff148b02a08d40cfdc
SHA1

c0703cc4d94f0df8a69879f77306fd5b75948cd3
SHA256

c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb
SHA512

89891cbc55ceec3f5ec470442cf0fc76b96b6e232520049f8299eec08fb31474c659a87fa46cd74979d5fbce1dfa43e9fec3d56c7edc43b80afbbe2dffa84fba
SSDEEP

768:ZeqH/8e8HK0BoTDzvM9d+5AzfZt6lpzGwH6WeBrl+FlkVjhL4CNQ52p/1H5+Xdnh:go/8tK8o/zvM9isxmGwKAUV0F52Leh

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgeihcme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbognp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfjka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mngegmbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbadcpbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmpkqqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inainbcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimekgff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnagak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idjlpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ginnfgop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahchda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nognnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcfqfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiokfpph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oileggkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nliaao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphphj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbileede.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkmioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gingkqkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehdmlhcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgfdmlcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddligq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnmepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejnmncd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhlpqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lelchgne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phelcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndflak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pekbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikokan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppamophb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpihcgoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghpocngo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfngdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egnchd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loglacfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgihfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndflak32.exe

Executes dropped EXE 64 IoCs

pid	Process
2976	Faihkbci.exe
3724	Fhcpgmjf.exe
4764	Fakdpb32.exe
4996	Flqimk32.exe
4676	Fbnafb32.exe
3856	Fhgjblfq.exe
4080	Foabofnn.exe
4020	Fhjfhl32.exe
4448	Gododflk.exe
3980	Gdqgmmjb.exe
1276	Gkkojgao.exe
944	Gmjlcj32.exe
4184	Gdeqhl32.exe
4656	Gcfqfc32.exe
3744	Gdhmnlcj.exe
2716	Gomakdcp.exe
2100	Hkdbpe32.exe
3040	Hfifmnij.exe
3144	Hodgkc32.exe
4852	Hkkhqd32.exe
3964	Hbeqmoji.exe
5096	Hkmefd32.exe
3164	Hbgmcnhf.exe
2092	Iiaephpc.exe
2708	Iehfdi32.exe
1792	Ikbnacmd.exe
4552	Iejcji32.exe
960	Ickchq32.exe
4400	Imdgqfbd.exe
4520	Iikhfg32.exe
2828	Ibcmom32.exe
1228	Jimekgff.exe
5108	Jfcbjk32.exe
3320	Jcgbco32.exe
4376	Jfeopj32.exe
4596	Jmpgldhg.exe
3760	Jcioiood.exe
456	Jifhaenk.exe
3432	Kboljk32.exe
1408	Kemhff32.exe
4064	Klgqcqkl.exe
4980	Kbaipkbi.exe
4548	Kikame32.exe
4000	Kpeiioac.exe
3068	Kebbafoj.exe
2972	Klljnp32.exe
1852	Kfankifm.exe
2296	Kmkfhc32.exe
3096	Kdeoemeg.exe
64	Ldjhpl32.exe
3684	Lekehdgp.exe
4932	Llemdo32.exe
4668	Lfkaag32.exe
3188	Lpcfkm32.exe
4420	Lepncd32.exe
3976	Lmgfda32.exe
1536	Lgokmgjm.exe
1560	Lingibiq.exe
3896	Mdckfk32.exe
4836	Mipcob32.exe
3080	Mdehlk32.exe
4952	Megdccmb.exe
4484	Mlampmdo.exe
660	Mgfqmfde.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dmjhenbq.dll	Kfqgab32.exe
File created	C:\Windows\SysWOW64\Lblaabdp.exe	Llbidimc.exe
File created	C:\Windows\SysWOW64\Ipgiebei.dll	Fmlneg32.exe
File created	C:\Windows\SysWOW64\Cobkhb32.exe	Cmcolgbj.exe
File created	C:\Windows\SysWOW64\Lejnmncd.exe	Lblaabdp.exe
File created	C:\Windows\SysWOW64\Fgeihcme.exe	Fedmqk32.exe
File created	C:\Windows\SysWOW64\Hnkmnide.dll	Ppamophb.exe
File created	C:\Windows\SysWOW64\Lhhmmcaa.dll	Cmcolgbj.exe
File created	C:\Windows\SysWOW64\Plkcijka.dll	Plpqil32.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Lplhdc32.dll	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Neppokal.exe	Nbadcpbh.exe
File opened for modification	C:\Windows\SysWOW64\Nlmdbh32.exe	Ndflak32.exe
File opened for modification	C:\Windows\SysWOW64\Dbnmke32.exe	Ckhecmcf.exe
File created	C:\Windows\SysWOW64\Qmbekjjm.dll	Gkjhoq32.exe
File created	C:\Windows\SysWOW64\Bcodim32.dll	Nknobkje.exe
File created	C:\Windows\SysWOW64\Ejbdho32.dll	Neccpd32.exe
File opened for modification	C:\Windows\SysWOW64\Aaiimadl.exe	Qaflgago.exe
File created	C:\Windows\SysWOW64\Gahamgib.dll	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Mchqfb32.dll	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Pjcbbmif.exe	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Nnicid32.exe	Nmgjia32.exe
File created	C:\Windows\SysWOW64\Hkajlm32.dll	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Ophjiaql.exe	Ogpepl32.exe
File created	C:\Windows\SysWOW64\Dbmjgpgc.dll	Bclang32.exe
File created	C:\Windows\SysWOW64\Mcmabg32.exe	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Jimekgff.exe	Ibcmom32.exe
File created	C:\Windows\SysWOW64\Jmppfooc.dll	Opogbbig.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Oidhlb32.exe	Oondnini.exe
File created	C:\Windows\SysWOW64\Mipcob32.exe	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Mqjbok32.dll	Gempgj32.exe
File created	C:\Windows\SysWOW64\Ffqhcq32.exe	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Hppdbdbc.dll	Ojoign32.exe
File created	C:\Windows\SysWOW64\Mblkhq32.exe	Mlbbkfoq.exe
File created	C:\Windows\SysWOW64\Gidbch32.dll	Cgndoeag.exe
File opened for modification	C:\Windows\SysWOW64\Ghpocngo.exe	Gaefgd32.exe
File opened for modification	C:\Windows\SysWOW64\Gdeqhl32.exe	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Jcgbco32.exe	Jfcbjk32.exe
File opened for modification	C:\Windows\SysWOW64\Klljnp32.exe	Kebbafoj.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Kkfkkmmp.dll	Fkpool32.exe
File opened for modification	C:\Windows\SysWOW64\Loglacfo.exe	Lhncdi32.exe
File created	C:\Windows\SysWOW64\Hjlkge32.exe	Hhknpmma.exe
File created	C:\Windows\SysWOW64\Nefped32.exe	Nlnkmnah.exe
File opened for modification	C:\Windows\SysWOW64\Momcpa32.exe	Iialhaad.exe
File created	C:\Windows\SysWOW64\Hqdeld32.dll	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Cabomkll.exe	Cikglnkj.exe
File opened for modification	C:\Windows\SysWOW64\Fhdfbfdh.exe	Folaiqng.exe
File opened for modification	C:\Windows\SysWOW64\Hkhdqoac.exe	Hfklhhcl.exe
File opened for modification	C:\Windows\SysWOW64\Ncjginjn.exe	Nomncpcg.exe
File created	C:\Windows\SysWOW64\Lelchgne.exe	Lbngllob.exe
File created	C:\Windows\SysWOW64\Gbobfjdp.dll	Pakllc32.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Panhbfep.exe
File created	C:\Windows\SysWOW64\Jlineehd.dll	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Megdccmb.exe	Mdehlk32.exe
File opened for modification	C:\Windows\SysWOW64\Jkodhk32.exe	Jeekkafl.exe
File created	C:\Windows\SysWOW64\Jhijqj32.exe	Ihgnkkbd.exe
File created	C:\Windows\SysWOW64\Jabphdjm.dll	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Iohjlmeg.exe	Hhnbpb32.exe
File opened for modification	C:\Windows\SysWOW64\Jnpmjf32.exe	Jgfdmlcm.exe
File opened for modification	C:\Windows\SysWOW64\Lldfjh32.exe	Lejnmncd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5428	5312	WerFault.exe	637

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khbdikip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pibdmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bciehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocaikjof.dll"	Hgelek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igchfiof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aofcga32.dll"	Jnkcogno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elikfp32.dll"	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfbibikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdeld32.dll"	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alncgf32.dll"	Loglacfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdbhkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kniieo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Iejcji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olanmgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcklla32.dll"	Dfamapjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oendmdab.dll"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdpiid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iahlcaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pocfpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alnmjjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaflgago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phcebinc.dll"	Idebdcdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eddbpnlg.dll"	Ifleoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclang32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idbodn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjkpoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pikcfnkf.dll"	Gaopfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lplhdc32.dll"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miaajlho.dll"	Bidqko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omcjep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geaepk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neppokal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmookkn.dll"	Nhnlkfpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgndoeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palbkhoj.dll"	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbdggii.dll"	Gadqlkep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljcnd32.dll"	Cmniml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nliaao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbbhqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddgfdiop.dll"	Cadlbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiokfpph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbiamhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmklglpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ackhdo32.dll"	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lefekh32.dll"	Fdhcgaic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Aqkgpedc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2976	264	c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe	86
PID 264 wrote to memory of 2976	264	c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe	86
PID 264 wrote to memory of 2976	264	c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe	86
PID 2976 wrote to memory of 3724	2976	Faihkbci.exe	87
PID 2976 wrote to memory of 3724	2976	Faihkbci.exe	87
PID 2976 wrote to memory of 3724	2976	Faihkbci.exe	87
PID 3724 wrote to memory of 4764	3724	Fhcpgmjf.exe	88
PID 3724 wrote to memory of 4764	3724	Fhcpgmjf.exe	88
PID 3724 wrote to memory of 4764	3724	Fhcpgmjf.exe	88
PID 4764 wrote to memory of 4996	4764	Fakdpb32.exe	89
PID 4764 wrote to memory of 4996	4764	Fakdpb32.exe	89
PID 4764 wrote to memory of 4996	4764	Fakdpb32.exe	89
PID 4996 wrote to memory of 4676	4996	Flqimk32.exe	90
PID 4996 wrote to memory of 4676	4996	Flqimk32.exe	90
PID 4996 wrote to memory of 4676	4996	Flqimk32.exe	90
PID 4676 wrote to memory of 3856	4676	Fbnafb32.exe	91
PID 4676 wrote to memory of 3856	4676	Fbnafb32.exe	91
PID 4676 wrote to memory of 3856	4676	Fbnafb32.exe	91
PID 3856 wrote to memory of 4080	3856	Fhgjblfq.exe	92
PID 3856 wrote to memory of 4080	3856	Fhgjblfq.exe	92
PID 3856 wrote to memory of 4080	3856	Fhgjblfq.exe	92
PID 4080 wrote to memory of 4020	4080	Foabofnn.exe	93
PID 4080 wrote to memory of 4020	4080	Foabofnn.exe	93
PID 4080 wrote to memory of 4020	4080	Foabofnn.exe	93
PID 4020 wrote to memory of 4448	4020	Fhjfhl32.exe	94
PID 4020 wrote to memory of 4448	4020	Fhjfhl32.exe	94
PID 4020 wrote to memory of 4448	4020	Fhjfhl32.exe	94
PID 4448 wrote to memory of 3980	4448	Gododflk.exe	95
PID 4448 wrote to memory of 3980	4448	Gododflk.exe	95
PID 4448 wrote to memory of 3980	4448	Gododflk.exe	95
PID 3980 wrote to memory of 1276	3980	Gdqgmmjb.exe	96
PID 3980 wrote to memory of 1276	3980	Gdqgmmjb.exe	96
PID 3980 wrote to memory of 1276	3980	Gdqgmmjb.exe	96
PID 1276 wrote to memory of 944	1276	Gkkojgao.exe	98
PID 1276 wrote to memory of 944	1276	Gkkojgao.exe	98
PID 1276 wrote to memory of 944	1276	Gkkojgao.exe	98
PID 944 wrote to memory of 4184	944	Gmjlcj32.exe	99
PID 944 wrote to memory of 4184	944	Gmjlcj32.exe	99
PID 944 wrote to memory of 4184	944	Gmjlcj32.exe	99
PID 4184 wrote to memory of 4656	4184	Gdeqhl32.exe	100
PID 4184 wrote to memory of 4656	4184	Gdeqhl32.exe	100
PID 4184 wrote to memory of 4656	4184	Gdeqhl32.exe	100
PID 4656 wrote to memory of 3744	4656	Gcfqfc32.exe	101
PID 4656 wrote to memory of 3744	4656	Gcfqfc32.exe	101
PID 4656 wrote to memory of 3744	4656	Gcfqfc32.exe	101
PID 3744 wrote to memory of 2716	3744	Gdhmnlcj.exe	102
PID 3744 wrote to memory of 2716	3744	Gdhmnlcj.exe	102
PID 3744 wrote to memory of 2716	3744	Gdhmnlcj.exe	102
PID 2716 wrote to memory of 2100	2716	Gomakdcp.exe	103
PID 2716 wrote to memory of 2100	2716	Gomakdcp.exe	103
PID 2716 wrote to memory of 2100	2716	Gomakdcp.exe	103
PID 2100 wrote to memory of 3040	2100	Hkdbpe32.exe	104
PID 2100 wrote to memory of 3040	2100	Hkdbpe32.exe	104
PID 2100 wrote to memory of 3040	2100	Hkdbpe32.exe	104
PID 3040 wrote to memory of 3144	3040	Hfifmnij.exe	106
PID 3040 wrote to memory of 3144	3040	Hfifmnij.exe	106
PID 3040 wrote to memory of 3144	3040	Hfifmnij.exe	106
PID 3144 wrote to memory of 4852	3144	Hodgkc32.exe	107
PID 3144 wrote to memory of 4852	3144	Hodgkc32.exe	107
PID 3144 wrote to memory of 4852	3144	Hodgkc32.exe	107
PID 4852 wrote to memory of 3964	4852	Hkkhqd32.exe	108
PID 4852 wrote to memory of 3964	4852	Hkkhqd32.exe	108
PID 4852 wrote to memory of 3964	4852	Hkkhqd32.exe	108
PID 3964 wrote to memory of 5096	3964	Hbeqmoji.exe	109

C:\Users\Admin\AppData\Local\Temp\c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe
"C:\Users\Admin\AppData\Local\Temp\c8251b8d8f0a928492c4b312101e8dfa37b37d125f367a2cbfc2062d204a8efb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\Faihkbci.exe
  C:\Windows\system32\Faihkbci.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\Fhcpgmjf.exe
    C:\Windows\system32\Fhcpgmjf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\SysWOW64\Fakdpb32.exe
      C:\Windows\system32\Fakdpb32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
      - C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        23⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        24⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        25⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        26⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        29⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        31⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2828
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        35⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        38⤵
        Executes dropped EXE
        
        PID:3760
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        40⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        41⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        42⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        43⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        44⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        45⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        48⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3096
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        51⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        52⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        53⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        54⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        55⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        56⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        59⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3080
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        63⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        64⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        65⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        66⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        69⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        70⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        72⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        73⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        74⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        75⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        76⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:548
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        78⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        79⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        80⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        81⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        82⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        83⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        84⤵
        Drops file in System32 directory
        
        PID:4844
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        85⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        86⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        87⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        90⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        91⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        92⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        93⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        94⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        95⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        96⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        97⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        98⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        99⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5888
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        101⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        102⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        103⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        104⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        105⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        106⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        107⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        108⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        109⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        110⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        111⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        112⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        113⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        114⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        115⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        116⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        117⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        118⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        119⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        120⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        121⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        122⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        123⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        124⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        125⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        127⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        128⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        129⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        131⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        132⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        133⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        134⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4388
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        136⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        138⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        139⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        140⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        141⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        142⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        143⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        144⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        145⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        146⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        147⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        148⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        149⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        151⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        152⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        153⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        154⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        155⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        157⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        158⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        159⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        160⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        162⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        164⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        165⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        166⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        167⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        168⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        169⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        170⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        173⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        174⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        175⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        176⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        177⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        178⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        179⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6188
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        181⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        182⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        183⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        184⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        185⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        186⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        187⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        188⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        190⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        191⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        192⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        194⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        195⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        196⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        198⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        199⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        200⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        201⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        202⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        203⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        204⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        205⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        207⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        208⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        209⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        210⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        212⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        214⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        215⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        216⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        217⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        218⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        219⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        220⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        221⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        222⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        223⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        224⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        225⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        226⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        227⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        228⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        229⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        230⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        231⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        233⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        234⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        235⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        236⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        237⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        240⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        241⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        242⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        243⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        244⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        245⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        246⤵
        Drops file in System32 directory
        
        PID:7900
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        247⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        248⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        249⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        251⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        252⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7476
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        254⤵
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        255⤵
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        256⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        257⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        258⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        259⤵
        Drops file in System32 directory
        
        PID:8332
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        260⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        261⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        262⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        263⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        264⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        265⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        267⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        269⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        270⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        271⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        273⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        274⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        277⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        278⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        279⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        280⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        281⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        283⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        284⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        285⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        286⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        287⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        288⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        289⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        290⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        291⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        292⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        293⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        294⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        295⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        296⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        297⤵
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        298⤵
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        299⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        301⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        302⤵
        Drops file in System32 directory
        
        PID:8220
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        303⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        304⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        305⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        308⤵
        Modifies registry class
        
        PID:8284
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        310⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        311⤵
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        312⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        313⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        314⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        315⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        316⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        317⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4364
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        319⤵
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        320⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        321⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        322⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        323⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        324⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        325⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        326⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        327⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        328⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        330⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        331⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        332⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        333⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        334⤵
        Modifies registry class
        
        PID:9752
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        335⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        336⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        337⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        338⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        339⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        340⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        341⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        342⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        343⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        344⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        345⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9228
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9312
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        349⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        350⤵
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        351⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        352⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        353⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        354⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        355⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        356⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        357⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        358⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        359⤵
        Drops file in System32 directory
        
        PID:10168
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        360⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        361⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9444
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        363⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        364⤵
        Modifies registry class
        
        PID:9660
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        365⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        366⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        367⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        368⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        369⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        371⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        372⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        373⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        374⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        375⤵
        Modifies registry class
        
        PID:9948
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        376⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        377⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        378⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        379⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        380⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        381⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        382⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        383⤵
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        384⤵
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        385⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        386⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        387⤵
        Modifies registry class
        
        PID:10344
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        388⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10432
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        390⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        391⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        392⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        393⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        394⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10684
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        396⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        397⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10812
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        399⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        400⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        401⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        402⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        403⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        404⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        405⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        406⤵
        Modifies registry class
        
        PID:11168
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        407⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        410⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        411⤵
        Drops file in System32 directory
        
        PID:10396
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        412⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        413⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        414⤵
        Drops file in System32 directory
        
        PID:10604
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        415⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        416⤵
        Drops file in System32 directory
        
        PID:10748
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        417⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        418⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        419⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        420⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        421⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        422⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        423⤵
        Modifies registry class
        
        PID:11236
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        424⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        425⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        426⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        427⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        428⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        429⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        430⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        431⤵
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        432⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        433⤵
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        434⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        435⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        436⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        437⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10920
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        439⤵
        Modifies registry class
        
        PID:11116
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        440⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        441⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        442⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        443⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        444⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        445⤵
        Modifies registry class
        
        PID:10760
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        446⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        447⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        448⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        449⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        450⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        451⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        452⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        453⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11496
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11536
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        456⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        457⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        458⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        459⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        460⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        461⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        462⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        463⤵
        Drops file in System32 directory
        
        PID:11888
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        464⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        465⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        466⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        467⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        468⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        469⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        470⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        471⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        472⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        473⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        474⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        475⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        476⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        477⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        478⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        479⤵
        Modifies registry class
        
        PID:11740
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11880
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        482⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        483⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        484⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        485⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        486⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        487⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        488⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        489⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        490⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        491⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        492⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        493⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        494⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        495⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        496⤵
        Drops file in System32 directory
        
        PID:11852
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        497⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12100
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        499⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        500⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12108
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        502⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        503⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        504⤵
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        505⤵
        Modifies registry class
        
        PID:11292
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        507⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        508⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        509⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        510⤵
        Drops file in System32 directory
        
        PID:2016
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        511⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3052
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        513⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        514⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        515⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        516⤵
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        517⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5004
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        519⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        520⤵
        Modifies registry class
        
        PID:11600
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        521⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3992
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        523⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        524⤵
        Modifies registry class
        
        PID:3704
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2032
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        526⤵
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        527⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        529⤵
        Drops file in System32 directory
        
        PID:2788
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        530⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        531⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        532⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        533⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        534⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        535⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        537⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        538⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        539⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        540⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 400
        541⤵
        Program crash
        
        PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5312 -ip 5312
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agiamhdo.exe

Filesize
56KB

MD5
401e85e1ae4a633389d3eeb8fabe8c75

SHA1
1781c75bc22cbf54017534523333abbe2d17d3cf

SHA256
51409c99af0fc37163454a1bc159ded9ccfb9dfadb20a4a48474746d1549814d

SHA512
a8470b3fb0b47fa7ff6eb9744380bc98834da7c267c97e5a8b9276e2dc706c9afa6de370397c22be76369917d7289d62bdc45b25488b3aed38080d9541bda0e5

Download Submit
C:\Windows\SysWOW64\Cfnqklgh.exe

Filesize
56KB

MD5
d7ed99eb663e81b832ce18317d02ef20

SHA1
1b8f86b360bd0ab1cf37842d651ba3cfe7fa0bc4

SHA256
e842ae43b506e6383b34019a340a1d5e87f9509d55be8c336dde7959ebe965fd

SHA512
e8eee23a6a692afd19c7cff11cbc196505c6c884f8ff4be78d41fd5467c37071802385a4e975f35b3be4faa9347825f43fdcf0cd28f714cb7809771a9f95fb54

Download Submit
C:\Windows\SysWOW64\Dfamapjo.exe

Filesize
56KB

MD5
06b55f1724c5b05d4c3d2b32e4643497

SHA1
c0351ef913993b2faaecd1dda202563ed365b154

SHA256
95f42a46376abc1031b9cc69983d49e1c18228d1700f44684b6caed3a9029bc2

SHA512
6a1dc6b203ca12f0b4033becb11a17bc7bac082a2e3af1f8facf206d9a78bb18a6ac06b6640870c0e9b3763cd69d27b9f2afb8de644d940bef26e365b0f9a4cc

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
56KB

MD5
88e140a9d41723271c61750bba02fcfe

SHA1
a71140017e4f6d08dfdc459c2d283f15db55880d

SHA256
36018a6ccd7f6fac1ce83c348cea8063f45fdb4d3e79070e54d0c342822cdcad

SHA512
faedce92419f88dbc868925cad3f26a8ff694315665f946108cbd0530022a484ffbacaf86b71fe5b37e6614a579a823ffb7b1a8f7fc5ec6108376c277f8370fb

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
56KB

MD5
5e1f4f5d46d12a6492a2f33747cf6c9b

SHA1
b802e28d285c65872fc24218ae88bace6418aaad

SHA256
af0648360fdb84fa69096ae83a08e15a55d248924562734d522c7859f6d08d5d

SHA512
8fad3f0e1bc3615d1203aaaaddf31d5bb3e705449cbbb050103271e17220f9e7e3396c7d8667ccccadaa5d43636034e823d6befcbe02a21e944de70ec8557d3c

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
56KB

MD5
946546e9dbdb929399fd0d4745cbd5e2

SHA1
a197fd371a3194956895a326a84b360d05e4f1b0

SHA256
a62edcd73aa7680562db553acc1772c258832f084451c38ca602526958f063b0

SHA512
00520a6d924b78c15d9949298124c8f195b937757063d608a3d6edc113545773385c10c106e2c0875443b3f7ee6931173e028908497bdefc3d0a7cba427d6ce0

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
56KB

MD5
eca6af8fb2917f7e756bec756d37fa8e

SHA1
0b5c26136c4100eccff13eac2a8d0cf00680e9b5

SHA256
6c2ac36ed0ee201abc949a053adf439233c895e61a3328c14b970fb1d1d1d58b

SHA512
ae3c99006ae823084d5b8567f7d49d0f138dda2bed4181ea9950e5ebe06b6ef28f013c5bbdbdd27b23bee9912e2b90f1253ae868fe27933c1ee55330780063f5

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
56KB

MD5
6fe73f8f63f037c7c10945e02dba5fe5

SHA1
afc2401a745c451b3265989d256abc38961e509f

SHA256
423de3db74e3ed52bda6abaeb5827f2de93b9bf72db8df10c6621f4ad0fa514d

SHA512
9939212ae8df0a47acc01fd68097dc434cacc19f642dd70687be7c86380428b1a60d09de0231672e06fcf34a4ce5b5cab2941b29812c5b5ae32c0a16e68ca8f6

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
56KB

MD5
7e54763fe8ea788d90e11af505d881e9

SHA1
7a2b68e616e4a35b644ee35fda5a40557bb616f4

SHA256
91517faeede28969f27e583e0be53ca5a567a3c9437f11fac317003890d69f6b

SHA512
fca1812952a49cfd19ca25521a180a462d0163fa459b04787c0f6a042d545e71c098411b2f946035f9ed843fdd4490a373a84b18adb9a232845db0736100a60a

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
56KB

MD5
dcd98972fe8f85ec47dd81ec3f980d3a

SHA1
9c0829ee7dd2929c89072d6f809db400de17bc82

SHA256
3930593d648bf019eddeb56a9254c73f5df8994b627097da282d642d39b9f514

SHA512
a25dbba9a854fd488ada5099860063620c6eb2f84b4444769b2a9b002f9c95261a76dfcf708caa405723cee1ce3bcd9606a40fe70910603aa9528e15e9597d30

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
56KB

MD5
2d741cfde93a31882dc9dd563c37a4b0

SHA1
757c7e5a6b78026583e1d37ea7df9199e9f785cb

SHA256
336e434cb083618b35c31401019038f80f81e1351ec58e5fd9644f6907e3eb0e

SHA512
acbca408ed86ade5ee9b3c7f45ba8aaab1a46aaab9ced3d30c998ed68a7016e1e2258922a22a906f7e889366c58fb7ba1bd40c218115176ecb37c3d4a27236a4

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
56KB

MD5
c26e4671e02c36d205906d9ea47b6273

SHA1
2c81f4db141a266146f56da80e1d9be690a6f3d6

SHA256
f5123d5e72700c2b6f955e6924bea266b5fbc6a50f6926f066c129cdd5a33c84

SHA512
a09766d4f57361701cefc24e96b6b745d4134d7569f11157f8d862551c786df4262598b70679b1b2566763a2308ad90c4d1e0259447cc761f3377b6c40c7c4aa

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
56KB

MD5
cb661b8185625b10a3f9cdc14e7e39f4

SHA1
32823e8cb8ca7371c5c2594f18305c838890eb49

SHA256
bf3ab5f8cf4eba4f6b9f800532b64658c9815d0e42eb1f704787131afbf938de

SHA512
7e885a03f3fe26a4a5e37d8c6f98a2cdf116fb09aa2565da72f914c945aef4a667bc1d832a351660ff2399483b415056b7d74ec2c336cbc994370b15fac262fc

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
56KB

MD5
e0f06f962bc93c9ccdaf9ac60872facf

SHA1
e9e3042bcc04ac8e2f63fb81171bfc766e3b34a4

SHA256
ac92b8ea3fcdfd3ec9bd02d5b2ed7f9b3bd0c4b7657800ac24bca72ebd0b7831

SHA512
e615dafe9e7242f4c774e828095fc77e751d37c591049265f47e253a4b879b7111dc62bc7f9e665e7cb9c47062c8cdd709ab54bceb894524effed110dc5c121d

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
56KB

MD5
bb611f827790fc83309ed07b23b8dcca

SHA1
c43cd71b4300ee40f7d9ea0955a3955d51fc303e

SHA256
22d3f0b8a64f5106adadbdd1ae2ebe8e10e4a2094ab36f965c7c7ed25fe8ce00

SHA512
67addaed6f1e77be86346f2760512b49ca1e4d7d38f0d7c8266cd9ce395c835d9949ae76f236f06bacefd176329c0ced8aa151bd4f08374d8c3f7e71866543ae

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
56KB

MD5
5f5ab59d82ebd4ab87341e71e3c410c4

SHA1
23ab1e9e104c61845cb27c9dfcf5d488d8d37a56

SHA256
b22373af7b12055fbab24bbe98dcd60094b417a4b95316231b36801490a230b4

SHA512
eb8b229ba7851aa89e9d18372232dfb4486ce5989f3a17ca583700cdd77fad1a1f9fc52087aecd0680cc5ae32c68451d9b628fda305edbe827f39b1ee198d9e8

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
56KB

MD5
3cb0c437593191332511f739f51d0600

SHA1
142a2aee5fcae9b1ae25956228c2d09b32d835fa

SHA256
0614ea8fe48257dd0f3bf36eb185712ffbcfffdf536ea7e5b78471e7bbcdfcb5

SHA512
0b8888ea89e8cc6f2d81daa707c321221a5c5f2b0c0a093a6a2c56705cf04b3dd3a2aa6fd1f73c2bb2163289c19bf035c368721b6a365428ee4bd0fda0eb6d4d

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
56KB

MD5
337fb82b10fb23c1c3f22b9f1f3dfa12

SHA1
e307651ac9960cfd8d8a4794388c3b7cc1189851

SHA256
eda74201ddc521c490601d53841714ca6f0af3dd0fe791074110d7ea0bf7c3fb

SHA512
9e853ce610cc7003fc62b919a9c7fbbae6dd4c90dd5c630a5fa5fd075d8e94a27ddb0e1949917f7eb3229a840fdeb53f57e3d9b0e9455cd5bc64609c93c12a41

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
56KB

MD5
b30422787da3f48ac4ef3cd3d700596c

SHA1
2e1b512ccc47106c2f84afcebe8bd505470a3c06

SHA256
a0acefc985fcec4a34c19a6f4e47c6dc8686fae92e4527332a3945248e8165a6

SHA512
909f5d3e2f33859e98b6b0a739d67aec25f356a336247980d612915c7ddb2c220135274ffa2ee0dce4b7d8dd7fdffd12f6efb7a76db5d9b8b504589d9b0ffef8

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
56KB

MD5
adf1baec2968ef945ea18c0272bafaaa

SHA1
ee5e34fd71f6cc12123ac97a7844cbe708bec831

SHA256
10d9561493e2922664af28694d18399e0247c149aa0101b9865826cac558651a

SHA512
e0077af07c445633809e0bda71dd46a07ca740ebd8954dc26efe206a178fd27cce5bcd23557f9ea4c684c97f098abead4e61bae090d247034802b6ecd2f0d9d2

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
56KB

MD5
de8c67e9c466aca766657fbd93ad47c4

SHA1
48b1f5261ba17dd2b47035ebf95d0199322148d0

SHA256
a62ca6399821c84e5a24ecb6699b5c72535e025f99fd8f88ac6cf85da0cceffa

SHA512
638bec990d6451ec72f710e4aef1e2c6699d85689fcf5ae6db2b534484e8e14b3807690b9ec990a02aff8ba5714fb520713a712d1df2249187d524b9d79d44ef

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
56KB

MD5
f3da213c9b896b60345444ccb2b8791f

SHA1
7c1e6ca3ebc99beb9f9632ed1ff0a52abe2594ce

SHA256
1999ee584062bce009cf228cc366eedfb789ccc9dd07daab9ef3a2440fad2172

SHA512
d6a85577eb4874498ae718a8f52ac73cc850c3f2ed60ed9a0b4c0626c68c6690ef3e288c94d5a36b10d4a35b1597ebe674eef74b64bda01cc60f1818eb21f5c7

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
56KB

MD5
f7ea3d36a38a1b49248a6a26ec0d12b6

SHA1
ee8ff3240c4f237a8369eadafe0958d6bae16a2e

SHA256
3396343e471c1ad748b5089a5bd1959f335801c8806e833177c18517b189d640

SHA512
2e64f6c01fe44f6f92333856c93e60adb2eab63a39422e7c11ac3fd137a0fa027a576521668f69e8de89925afaac82f9888cd0f73ba83dae76f6082be68db530

Download Submit
C:\Windows\SysWOW64\Hkkhqd32.exe

Filesize
56KB

MD5
5b6e7854eae61579e20c701a2ae01570

SHA1
cd8a47703fddfe88b1193d2dba3d76432d9b3234

SHA256
54f10721f0e4e2ea6be0e77d0df07b4d8b42967cd3bb6df1c4e348ce502a9a76

SHA512
319c7aefb1d2a1fd3d41dca480ec0bca5b6615752cae2271b8852bf256cac5916340b9691b825aeddfd675f5eace707326704be810d91a6520ddb1ee98aadd3d

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
56KB

MD5
dd62c72d3ae41200bdb9fca38fa8dd3a

SHA1
455367ab99df628377f49afa4b871a055b467ec0

SHA256
12dd96634b2119b6eeb0f2c54adde9a1a8c97f22c84339f90db66794934b5727

SHA512
f1e71edb79e51d51cf1fdc95a1f070bcfccd7272646fd5f6c8ac14ebd6b1873fddaab5f2d0787a608190caab608df00b4d90527eae1cb392e3c76561d8b9b068

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
56KB

MD5
89ba272867087611331878ec7022cf65

SHA1
907b5cac28ffd2edf8051542a65d4d2fcf23bab7

SHA256
6cd7e9310bf652d35ee5d7504e664038ddacfa232a9f26e78a1fd65d6ebe2a07

SHA512
0224b8956616564f6f47ad7ca6d2d93b4ed21398b784eea9e2837a090c5090e646457699224376240e904d048d42089eb1e0de108056edb7241535a43bf62be3

Download Submit
C:\Windows\SysWOW64\Ibcmom32.exe

Filesize
56KB

MD5
c4a61c7db3d3fb05d421e6a9847438ba

SHA1
426fe2e003d6f96756534ac7bb9ebd56920b1719

SHA256
68cdab9e848664c816e8f9d64a6800efd8d4196c3a480a17a9d0451e264cefa6

SHA512
a3aa3c3e18f8a5f07068aa3bac1ca73f71cb0d0c6042d18678ebcce828419715877259783c6b7c55e58f9be50ce8ff2bb02c873546ec76bcb657612db74c1ac1

Download Submit
C:\Windows\SysWOW64\Ickchq32.exe

Filesize
56KB

MD5
12180f602b4232530ec2393448bcd419

SHA1
0f655877f26885cf1c6a590c19f2559fbc35c0f0

SHA256
9330812f490749e0cbebde97cf8e2c7aa3a3552adce080d0da1cb1950d9f16f9

SHA512
a4d80da0105f4c5e1b82a9832fcb6142ab17deba66228965d4dcc956e5e9dcf3973fae83202668d34ee829b72eede65d90aacfa81aae2e1f4a145350937e7a68

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
56KB

MD5
47f1af527b20de441fab82600f878622

SHA1
2cec12378f2b4f8bc101d492ffeebdd7c60b74e0

SHA256
10476c2b4da3665563dd8dd922c601c6a03a99d8071e2956e885a2e7a06c5342

SHA512
bd1a7a15be39d71ff1eb28eccccf371bf82ea5ba2007a64176d8fc20867ecdaf7463506cf7bbc7ae8af57e25963d82f01c732864362f0f8bea6402036c333935

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
56KB

MD5
e110c32447c9f01e57892216f7f185ec

SHA1
a4102069d00186df5ba39c0c7bdb8a25fdf3ad45

SHA256
5f54baa36ef1fff8f63b496914f04f11291708cacb75dc6ad5f979aa5dcf877a

SHA512
872f9a3b97d955cb2cea091db83d8b4ed4cdeee19986fbd364e1d2d2462496e21f1d0766ab20fc92a9b7bbd51fea7578ff741f4b66e82f8c93b766a0f7c44e57

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
56KB

MD5
9c183e674d02da86f8c4bdbeb75f1022

SHA1
c04924ad85b4b1ab8f6ce1fc84420f27288880d4

SHA256
8d4575ff5af7f0ddccbb1112142a59605c57c6f57c13ec8816a10256bafc1850

SHA512
4df2b75f61c77e8a9cfc4b30dbf5a8b0c290b8c84ba2bd50ff3662b09dc9cf1a725369889ed4cfca58fd99d2bb2747f1afc7f2bb2460c73a3c9e9066c8a4853c

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
56KB

MD5
51ed87ad30934a3cf946ecf998a4d574

SHA1
3e38f6d9f05c8b824e68e272b6b7863065caf78d

SHA256
c3381d66fc0d647a5dad7a1afa735d56887f1bca7daa71b5d5bc7505d083297a

SHA512
d6b9e030b7a1bfa7af9aa10ef7f3fd515105f1bb2468b53bcc661ec4134a75891b6d1fdf97611cf5f7af84282a0b2237336b4bd597ade9d9a31ad2b9ce3bd667

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
56KB

MD5
8d0d807d47a7eed84ef72dd1fbbcc524

SHA1
f9672c5fcb2336d6c768e349c6c5a785c238a98c

SHA256
e9916c50392a3d63f0b330bcc38bfb0145471d4024905b7a7da9e82af4d9f161

SHA512
53c18bbd9c6a727b0458041e1798a8f722a7893149e60e7ee2141f3bf22fc94639f7a0c87188050f6d31b0130548a0207b96a19f0e94a12a72b7fa5ca6e556a1

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
56KB

MD5
5c88f4ee429d12dad23f4aee8ee31c88

SHA1
a4ac396fd1d8588dce19723497811d6500dab1c7

SHA256
767aaf85a5a40fcdf254b903bd060f4ca51e430fbf78ee91723a4ceabe238207

SHA512
117b6c2dca5dfa5a9401f86d038bd59f671df0cf5d37dbb81e95e193baaa533d5ea875862e1c81bb4f59d1956a94d59f6a61e4e7f000fc339d320464994882f1

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
56KB

MD5
af6f81b894b45f64b113767c7acd8501

SHA1
53e7017592124c8f5eeda6f157c78620b8b9b7d7

SHA256
76588c586bfcc2b5c6ed6b38e740366f6760a9221e60734475ae7a02ccaf84a1

SHA512
5242bea91bbb72c60dc2ebd3743f8df6366c16e0a13a58cc391929c35b42419123920344cf3d00cfbc15c9c35262da28db27ef90968703e6fb9ff8b50a3283a2

Download Submit
C:\Windows\SysWOW64\Jnhpoamf.exe

Filesize
56KB

MD5
12becd13e2bfa39a7d3a946c2e2915cc

SHA1
0c996ab485b8e4012450e181a20115f46823d981

SHA256
617efd5bbe06135e3e93857aabc4aa0d05a1df6a4739190be5db440d13ae8360

SHA512
3acc12ddb8a017d6e89c8a5dc1efcc0b9d2fbbba8a61fa51d5a7879dd40cbd4335ff0edca8d342046d0e688dce3b132a5ec02d055f0fe4fb1c02fc4ff87858f5

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
56KB

MD5
f361052dda39f54585d1ba74e7b37071

SHA1
359ece569fcb1744d55dc76e2215a6e36cc69933

SHA256
cf54ee8a271707ceafd38d48c899ae67deeb71bcc172a87c3d0b08a9b6f746d4

SHA512
8511524918bcf9855557db0f759915f69cc4e0289e6457cf4453ece71325f4300e49c1534663c45b59eef0fa7a937a96a651989cba06ab955335cbe0841d8858

Download Submit
C:\Windows\SysWOW64\Kenggi32.exe

Filesize
56KB

MD5
f4f6c987cc4618e3fd66588709119978

SHA1
d27c8455418db7d2a5d24f38933beb7f615ee88d

SHA256
5a056162d8087b152a4c11e90dac2849d3db1c2837f842c29331ab7db8b79292

SHA512
3d7834964c7e725f09eb064f16bb5b159c163b3a8eab686d99d5260a490123f11d9dc633ad7cd6c70abddd9e416aefc176394f84c0e20a4eb3227be282d00f83

Download Submit
C:\Windows\SysWOW64\Lbgalmej.exe

Filesize
56KB

MD5
7ee9131056e3d9419af6157e44570aea

SHA1
f2a2470a5382205fce5da732666f7eb2b237c907

SHA256
26078c5d55e177bb35e8dd3355441cecc9fed235b206328c96ce4acaa8a68d49

SHA512
a04dd094c67b532e5a636a01263b03065c8ad7246bd4944680492bf73bd4209df00baf2e5733408685592a6da1e17fc59e5bb7db109bd680091e90d26503be5b

Download Submit
C:\Windows\SysWOW64\Lelchgne.exe

Filesize
56KB

MD5
7ecf2c505412dfe87feec122b5e9f754

SHA1
8e051223b357ffc2b7f5505d72b5dfdbf2f198a4

SHA256
df90b96238a8b37a1fc1e1e48d3e4705c442ce12bc8feae4f2846d32901a7153

SHA512
e288260f5f7149be37716227f97e88e1fe394879f3b6f39ff11f65ad56e1d4114a83a860beaca4c77de6b22518c87cdd8f852aa7f668ccc5ac1ee62c06802538

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
56KB

MD5
89f0c445895862032eb55d707d78e45a

SHA1
66e8cb3a339c80b40a55c03935aa5fe3d5042e8f

SHA256
e2216bb61bbd01c26bf46ed45e73dff82e76732be4662b859ccb74d1145b109b

SHA512
56da8cd9f25b4f25f84bb034e09dc5edd430b80434a3dfd45157fe88f6245030347727e93424308ea164b35b1456a6d73dde6d5a0e92471a3ed537d028b3f3e0

Download Submit
C:\Windows\SysWOW64\Llbidimc.exe

Filesize
56KB

MD5
81c5c87bec46b9e8efc45b1508dcc77b

SHA1
d08419a12a2fe30686d1af8b57d834985b46a192

SHA256
6ffaaa0ba108bc371a628a1e12752b64fcd237c0ee41697a49bef6775b3cee42

SHA512
aa08463a1443821cf59841f1b29e6495a145bdfec76e41868e5436a2a352a4d9bff78f943b3779a083c757e50a4e368d2820d5874fcc1439b70598b9f734e8de

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
56KB

MD5
f4bf2083281841a5d7b16785c3e1f271

SHA1
2d9d1d6fd72f5819a56e054270c6733240b99b46

SHA256
b4e2b9959472d4aebd14e7d5903cb669b1e897273e14b69dd89a55ba0e669ece

SHA512
7ec50acc30aa8bc6dfad352cf2e45f315ca1d92043cdb64d477dbdfb2723ee261abdbad15863c229fdab1561226b582845061fcdbef29d6543c2e23d9355df1e

Download Submit
C:\Windows\SysWOW64\Nlnkmnah.exe

Filesize
56KB

MD5
3f40c3107e613b3ab8e530e70bc913f1

SHA1
c451e3025c347b9e98046852eae2d61fbd72b025

SHA256
cf05f35a401c7087452556cc31018400ac1cf542e0c39a4d373a13f9cfc8b812

SHA512
0a2d1c7148f7f938dd4bdb7d9f5acb675eb99cc358f64cfb0ed05c1cbc92597cb0e265fe164cb428f8af527e2bbf60e3f56ab4a45e37aa56b97406fb62e025f3

Download Submit
C:\Windows\SysWOW64\Phganm32.exe

Filesize
56KB

MD5
fa1acd90edb46338acea519a85ef96ce

SHA1
88a8e080746b23e2a4fc62f8d91f60a8d7d49164

SHA256
914677d9fcded4ee1de644500cab9f5ff34a377b6a018d02286cd53c2217efb9

SHA512
ec433f69827281f2e0f7e406360cd44cb2278522c79c8aa29f80f45db148ae56fcb90a008b6b45609f9961c5a5d98b32d434859d0b069b1553fb1d20eb5ada76

Download Submit
C:\Windows\SysWOW64\Qaflgago.exe

Filesize
56KB

MD5
1fce1c023c42d24ab34bd2b2432ae386

SHA1
1da984e8f592c94d72a51f4da78a16a14f67ef72

SHA256
538618231e31f8a32b5f5b750bb441417add487c5fd98f975bfa50844bbd604e

SHA512
14e343e717fd5c0d4115c7c0138d671e722ad98ac612bc848611409e2800a31d5a9d82674339c920b7c4b945f567b216cb94eb4d4a607e56f6533f04fe2f6484

Download Submit
C:\Windows\SysWOW64\Qjlnnemp.exe

Filesize
56KB

MD5
f40659a2bc4ab0d4589b8943010ccdca

SHA1
8b9999425e25c7415f0c605f6def8fcf304842fb

SHA256
d637ca50b9155eddddd9c98b9d58fdb65be7b3355d99a11e3d0f6f432ba57331

SHA512
5a4419e5e17c253c64622c216164b8c1887d66fe0505d28a49c94ae42ac68abe87bfc61dec7f55be785f34a8623a1ae77201d86c4860e0c11b4413c211de7379

Download Submit
memory/64-366-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/264-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/264-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/264-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/456-294-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/944-98-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/960-226-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1228-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1276-89-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1408-306-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1536-408-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1560-414-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1792-210-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1852-348-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2092-193-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2100-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2296-354-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2708-201-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2716-129-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2828-250-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2972-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2976-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3040-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3068-336-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3080-432-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-360-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3144-154-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3164-190-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3188-390-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3320-270-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3432-300-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3684-372-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3724-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3744-121-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3760-288-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3856-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3896-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3964-169-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3976-402-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3980-86-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4000-330-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4064-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4080-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4184-106-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4376-276-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4400-233-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4420-396-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4448-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4520-242-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4548-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4552-218-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4596-282-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4656-114-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4668-384-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4676-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4764-24-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4836-426-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4852-162-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4932-378-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4980-318-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4996-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5096-178-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5108-264-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads