ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832

Analysis

max time kernel
104s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe
Size

335KB
MD5

31a513cf5daebb3bf1bf18cf6d25b50d
SHA1

7f3ca87072de00fe7ec3e4dd50f1d55f074c55fd
SHA256

ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832
SHA512

60d9cc94f64702f1f9d247c52171622c098e2f02d248f926a5301c55e99e78167069e4bdc8060ad5a5be041fc27d3aa9b3781391a031cc81cf4cba3f66275312
SSDEEP

6144:J6GWvRvLvwU/4qwvwU/4qvvwevwU/4q+vwk/4q7:J/q

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqdblmhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfcdojl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pekbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghklce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niipjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmbmkpie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplafeil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epikpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mffjcopi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fideeaco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdpkflfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dblgpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emcbio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiokfpph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npedmdab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpqodfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnfcia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehokgge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djjebh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiaoid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leadnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijadbdoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppopjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pomgjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knefeffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihgnkkbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmabggdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbcmakpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niipjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfbkpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehfcfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qljcoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gafmaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjlkge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llgcph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhknpmma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfjnjcni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lflgmqhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loglacfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmehb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmbmkpie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gingkqkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diicml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckkiccep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knefeffd.exe

Executes dropped EXE 64 IoCs

pid	Process
1224	Jcefno32.exe
5076	Jlpkba32.exe
1008	Jehokgge.exe
1132	Jcioiood.exe
3256	Jmbdbd32.exe
3432	Kiidgeki.exe
5104	Kbaipkbi.exe
3364	Klimip32.exe
4384	Kbceejpf.exe
3944	Kbfbkj32.exe
5012	Acnlgp32.exe
4488	Aepefb32.exe
3788	Bcebhoii.exe
3220	Bjokdipf.exe
4444	Bchomn32.exe
4156	Bjagjhnc.exe
5036	Balpgb32.exe
4596	Bjddphlq.exe
1348	Bhhdil32.exe
4216	Chjaol32.exe
2636	Cmgjgcgo.exe
3896	Cfpnph32.exe
852	Cmiflbel.exe
3316	Cdcoim32.exe
1596	Cmlcbbcj.exe
4884	Ehfjah32.exe
4928	Emcbio32.exe
2136	Eejjjl32.exe
2568	Eaakpm32.exe
1980	Ehkclgmb.exe
3280	Eachem32.exe
3180	Fdbdah32.exe
3192	Fhdfbfdh.exe
452	Famjkl32.exe
4560	Fnckpmql.exe
2200	Gaadfkgc.exe
4624	Ghklce32.exe
3304	Gdbmhf32.exe
4576	Ggqida32.exe
4628	Gafmaj32.exe
3352	Gojnko32.exe
364	Ghbbcd32.exe
3324	Hnoklk32.exe
3332	Hghoeqmp.exe
2860	Hnagak32.exe
4824	Hhgloc32.exe
116	Hoadkn32.exe
736	Hglipp32.exe
932	Idgojc32.exe
1144	Ibkpcg32.exe
4452	Ioopml32.exe
3260	Ifihif32.exe
548	Ikfabm32.exe
1888	Indmnh32.exe
220	Jeqbpb32.exe
4360	Jkkjmlan.exe
3292	Jiokfpph.exe
952	Jkmgblok.exe
1736	Jfbkpd32.exe
1196	Jfehed32.exe
3948	Jkaqnk32.exe
2304	Jejefqaf.exe
672	Kbnepe32.exe
1556	Kihnmohm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Indmnh32.exe	Ikfabm32.exe
File created	C:\Windows\SysWOW64\Egfdnejf.dll	Jjmcnbdm.exe
File opened for modification	C:\Windows\SysWOW64\Okkdic32.exe	Omegjomb.exe
File opened for modification	C:\Windows\SysWOW64\Eejjjl32.exe	Emcbio32.exe
File created	C:\Windows\SysWOW64\Mfhbga32.exe	Mgphpe32.exe
File opened for modification	C:\Windows\SysWOW64\Nagiji32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Fjiepeok.dll	Ejpfhnpe.exe
File created	C:\Windows\SysWOW64\Dccledea.dll	Cfcjfk32.exe
File created	C:\Windows\SysWOW64\Fmfnpa32.exe	Fjhacf32.exe
File opened for modification	C:\Windows\SysWOW64\Lblaabdp.exe	Lidmhmnp.exe
File created	C:\Windows\SysWOW64\Llgcph32.exe	Locbfd32.exe
File created	C:\Windows\SysWOW64\Bcpeei32.dll	Dpphjp32.exe
File created	C:\Windows\SysWOW64\Hegaehem.dll	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Omdppiif.exe
File opened for modification	C:\Windows\SysWOW64\Hnagak32.exe	Hghoeqmp.exe
File opened for modification	C:\Windows\SysWOW64\Mfhbga32.exe	Mgphpe32.exe
File opened for modification	C:\Windows\SysWOW64\Opclldhj.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Gpkonb32.dll	Gojnko32.exe
File created	C:\Windows\SysWOW64\Lnaoodjg.dll	Cibmlmeb.exe
File created	C:\Windows\SysWOW64\Apnpee32.dll	Jdpkflfe.exe
File created	C:\Windows\SysWOW64\Qlejfm32.dll	Dmdhcddh.exe
File created	C:\Windows\SysWOW64\Mblkhq32.exe	Mhgfkg32.exe
File opened for modification	C:\Windows\SysWOW64\Fjohde32.exe	Fdepgkgj.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Hnaggngj.dll	Emcbio32.exe
File opened for modification	C:\Windows\SysWOW64\Hnoklk32.exe	Ghbbcd32.exe
File created	C:\Windows\SysWOW64\Ifhahnbj.dll	Gmdjapgb.exe
File opened for modification	C:\Windows\SysWOW64\Imgicgca.exe	Hekgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Lggejg32.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Fboqkn32.dll	Lgibpf32.exe
File opened for modification	C:\Windows\SysWOW64\Pdjgha32.exe	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Bmeandma.exe	Amcehdod.exe
File opened for modification	C:\Windows\SysWOW64\Gaadfkgc.exe	Fnckpmql.exe
File opened for modification	C:\Windows\SysWOW64\Pjehmfch.exe	Poodpmca.exe
File created	C:\Windows\SysWOW64\Kicpplqn.dll	Fagjfflb.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Gnlgleef.exe
File opened for modification	C:\Windows\SysWOW64\Pakllc32.exe	Jdbhkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ajndioga.exe	Qaflgago.exe
File created	C:\Windows\SysWOW64\Nagiji32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Eaakpm32.exe	Ekgbccni.exe
File created	C:\Windows\SysWOW64\Hpfcdojl.exe	Hjlkge32.exe
File created	C:\Windows\SysWOW64\Lbkank32.dll	Ikejgf32.exe
File created	C:\Windows\SysWOW64\Lpmbai32.dll	Aamknj32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpfqcln.exe	Bafndi32.exe
File opened for modification	C:\Windows\SysWOW64\Eigonjcj.exe	Ehfcfb32.exe
File opened for modification	C:\Windows\SysWOW64\Gpfjma32.exe	Gilapgqb.exe
File opened for modification	C:\Windows\SysWOW64\Haafcb32.exe	Hkgnfhnh.exe
File opened for modification	C:\Windows\SysWOW64\Iahlcaol.exe	Ijadbdoj.exe
File opened for modification	C:\Windows\SysWOW64\Ccmgiaig.exe	Ckfphc32.exe
File opened for modification	C:\Windows\SysWOW64\Ehfjah32.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Fhdfbfdh.exe	Fdbdah32.exe
File created	C:\Windows\SysWOW64\Bclgdl32.dll	Mfjcnold.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Ioopml32.exe	Ibkpcg32.exe
File opened for modification	C:\Windows\SysWOW64\Ioopml32.exe	Ibkpcg32.exe
File created	C:\Windows\SysWOW64\Eigonjcj.exe	Ehfcfb32.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Pdhkcb32.exe	Paiogf32.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Hhgloc32.exe	Hnagak32.exe
File created	C:\Windows\SysWOW64\Gbbgpbmj.dll	Fhofmq32.exe
File created	C:\Windows\SysWOW64\Knqepc32.exe	Jphkkpbp.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bdagpnbk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5552	3064	WerFault.exe	493

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiofld32.dll"	Eidbij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihdafkdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enabbk32.dll"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkelgcfo.dll"	Ghbbcd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glcaambb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbgpbmj.dll"	Fhofmq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhghfqcd.dll"	Jiokfpph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilmfhhk.dll"	Bfqkddfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebggoi32.dll"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcllei32.dll"	Cpeohh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epikpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efffmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcemmf32.dll"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iqipio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihphkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccchof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omegjomb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmnagpbq.dll"	Jfbkpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epokedmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elgaeolp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lblaabdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djpphb32.dll"	Qkjgegae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emphocjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdgccn32.dll"	Ennqfenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fboqkn32.dll"	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogcggo32.dll"	Mlklkgei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aboncdme.dll"	Hhknpmma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dblgpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkmgblok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lejnmncd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Danihi32.dll"	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phajna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaldccip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epcdqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfgeigk.dll"	Odhifjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igbcbhgq.dll"	Fhdohp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmalne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehfcfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdamgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alelqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnagak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bafndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockkandf.dll"	Pehngkcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijagjini.dll"	Elgaeolp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1224	532	ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe	86
PID 532 wrote to memory of 1224	532	ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe	86
PID 532 wrote to memory of 1224	532	ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe	86
PID 1224 wrote to memory of 5076	1224	Jcefno32.exe	87
PID 1224 wrote to memory of 5076	1224	Jcefno32.exe	87
PID 1224 wrote to memory of 5076	1224	Jcefno32.exe	87
PID 5076 wrote to memory of 1008	5076	Jlpkba32.exe	89
PID 5076 wrote to memory of 1008	5076	Jlpkba32.exe	89
PID 5076 wrote to memory of 1008	5076	Jlpkba32.exe	89
PID 1008 wrote to memory of 1132	1008	Jehokgge.exe	90
PID 1008 wrote to memory of 1132	1008	Jehokgge.exe	90
PID 1008 wrote to memory of 1132	1008	Jehokgge.exe	90
PID 1132 wrote to memory of 3256	1132	Jcioiood.exe	91
PID 1132 wrote to memory of 3256	1132	Jcioiood.exe	91
PID 1132 wrote to memory of 3256	1132	Jcioiood.exe	91
PID 3256 wrote to memory of 3432	3256	Jmbdbd32.exe	92
PID 3256 wrote to memory of 3432	3256	Jmbdbd32.exe	92
PID 3256 wrote to memory of 3432	3256	Jmbdbd32.exe	92
PID 3432 wrote to memory of 5104	3432	Kiidgeki.exe	93
PID 3432 wrote to memory of 5104	3432	Kiidgeki.exe	93
PID 3432 wrote to memory of 5104	3432	Kiidgeki.exe	93
PID 5104 wrote to memory of 3364	5104	Kbaipkbi.exe	94
PID 5104 wrote to memory of 3364	5104	Kbaipkbi.exe	94
PID 5104 wrote to memory of 3364	5104	Kbaipkbi.exe	94
PID 3364 wrote to memory of 4384	3364	Klimip32.exe	95
PID 3364 wrote to memory of 4384	3364	Klimip32.exe	95
PID 3364 wrote to memory of 4384	3364	Klimip32.exe	95
PID 4384 wrote to memory of 3944	4384	Kbceejpf.exe	96
PID 4384 wrote to memory of 3944	4384	Kbceejpf.exe	96
PID 4384 wrote to memory of 3944	4384	Kbceejpf.exe	96
PID 3944 wrote to memory of 5012	3944	Kbfbkj32.exe	97
PID 3944 wrote to memory of 5012	3944	Kbfbkj32.exe	97
PID 3944 wrote to memory of 5012	3944	Kbfbkj32.exe	97
PID 5012 wrote to memory of 4488	5012	Acnlgp32.exe	98
PID 5012 wrote to memory of 4488	5012	Acnlgp32.exe	98
PID 5012 wrote to memory of 4488	5012	Acnlgp32.exe	98
PID 4488 wrote to memory of 3788	4488	Aepefb32.exe	99
PID 4488 wrote to memory of 3788	4488	Aepefb32.exe	99
PID 4488 wrote to memory of 3788	4488	Aepefb32.exe	99
PID 3788 wrote to memory of 3220	3788	Bcebhoii.exe	100
PID 3788 wrote to memory of 3220	3788	Bcebhoii.exe	100
PID 3788 wrote to memory of 3220	3788	Bcebhoii.exe	100
PID 3220 wrote to memory of 4444	3220	Bjokdipf.exe	101
PID 3220 wrote to memory of 4444	3220	Bjokdipf.exe	101
PID 3220 wrote to memory of 4444	3220	Bjokdipf.exe	101
PID 4444 wrote to memory of 4156	4444	Bchomn32.exe	102
PID 4444 wrote to memory of 4156	4444	Bchomn32.exe	102
PID 4444 wrote to memory of 4156	4444	Bchomn32.exe	102
PID 4156 wrote to memory of 5036	4156	Bjagjhnc.exe	104
PID 4156 wrote to memory of 5036	4156	Bjagjhnc.exe	104
PID 4156 wrote to memory of 5036	4156	Bjagjhnc.exe	104
PID 5036 wrote to memory of 4596	5036	Balpgb32.exe	105
PID 5036 wrote to memory of 4596	5036	Balpgb32.exe	105
PID 5036 wrote to memory of 4596	5036	Balpgb32.exe	105
PID 4596 wrote to memory of 1348	4596	Bjddphlq.exe	106
PID 4596 wrote to memory of 1348	4596	Bjddphlq.exe	106
PID 4596 wrote to memory of 1348	4596	Bjddphlq.exe	106
PID 1348 wrote to memory of 4216	1348	Bhhdil32.exe	107
PID 1348 wrote to memory of 4216	1348	Bhhdil32.exe	107
PID 1348 wrote to memory of 4216	1348	Bhhdil32.exe	107
PID 4216 wrote to memory of 2636	4216	Chjaol32.exe	108
PID 4216 wrote to memory of 2636	4216	Chjaol32.exe	108
PID 4216 wrote to memory of 2636	4216	Chjaol32.exe	108
PID 2636 wrote to memory of 3896	2636	Cmgjgcgo.exe	109

C:\Users\Admin\AppData\Local\Temp\ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe
"C:\Users\Admin\AppData\Local\Temp\ddab50f3b5fe4dac67eb5e721b41d487190f3f86dacf28bc07e2ac5c72a90832.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\Jcefno32.exe
  C:\Windows\system32\Jcefno32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\Jlpkba32.exe
    C:\Windows\system32\Jlpkba32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\Jehokgge.exe
      C:\Windows\system32\Jehokgge.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        24⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        25⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        27⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        29⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        30⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        31⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        32⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        33⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3180
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        35⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        36⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        38⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        40⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        41⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:364
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        45⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        48⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        49⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        50⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        51⤵
        Executes dropped EXE
        
        PID:932
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1144
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        53⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        54⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        56⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        57⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        58⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        62⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        63⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        64⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        65⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        66⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4896
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        68⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        69⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        70⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        71⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        72⤵
        Drops file in System32 directory
        
        PID:3136
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        73⤵
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        74⤵
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        78⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        81⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        82⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        83⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        84⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        85⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        86⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        90⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        91⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        92⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        94⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        95⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        96⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        98⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        99⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1656
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        101⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        102⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        103⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        104⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5580
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        107⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        108⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        109⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        110⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        111⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        112⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        113⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        114⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        115⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        116⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        118⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        119⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        120⤵
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        121⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        122⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        123⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        124⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        125⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        126⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        127⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        128⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        129⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        130⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        131⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5540
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        134⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        135⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        136⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        137⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        138⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        139⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        140⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        141⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        142⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        143⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        144⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        145⤵
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        146⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        147⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        149⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        150⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        151⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        152⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        153⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        154⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        155⤵
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        156⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        157⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        158⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        159⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        160⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        161⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        162⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        163⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        164⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        165⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        166⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        167⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        168⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        169⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        170⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        171⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        172⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        173⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        174⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        176⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        177⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        178⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        179⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        180⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        181⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3396
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        185⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        186⤵
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        187⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        189⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        190⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        191⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        192⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        193⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        194⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        195⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        198⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        199⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        200⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        203⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        204⤵
        Drops file in System32 directory
        
        PID:7728
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        206⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        207⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        208⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        209⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        210⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        212⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        213⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        214⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        215⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        216⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        218⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        219⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        220⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        223⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        224⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        225⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        226⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        227⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        229⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        230⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        232⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        233⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        234⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        236⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        237⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        239⤵
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        241⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        242⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        243⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        244⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8252
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        247⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        248⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        249⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        250⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        252⤵
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8524
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        254⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        255⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        256⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        257⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        258⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        259⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        260⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        261⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        262⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        263⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        264⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        265⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        266⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        267⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        268⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        269⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        270⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        271⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        272⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        273⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        274⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        275⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        276⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8672
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        278⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        280⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        282⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        283⤵
        Drops file in System32 directory
        
        PID:9076
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        284⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        285⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        286⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        288⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        289⤵
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        292⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        293⤵
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        294⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        295⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        296⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        297⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        298⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        299⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        300⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        301⤵
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        302⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        303⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        304⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        305⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        307⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        308⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        309⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        310⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        311⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        312⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        313⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        314⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        315⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        316⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        317⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        319⤵
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        320⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        321⤵
        Modifies registry class
        
        PID:3276
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        322⤵
        Modifies registry class
        
        PID:4288
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        323⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        324⤵
        Drops file in System32 directory
        
        PID:3540
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        325⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        327⤵
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        328⤵
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3332
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        330⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        331⤵
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        332⤵
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        333⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        334⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        335⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        336⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        337⤵
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        338⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        339⤵
        Drops file in System32 directory
        
        PID:4188
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        340⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        341⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        342⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        343⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4164
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        345⤵
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        346⤵
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        347⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        348⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        349⤵
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        350⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        351⤵
        
        PID:616
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        352⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        353⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        354⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        355⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        356⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        357⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        358⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        359⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        360⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        362⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        364⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        365⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        366⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        368⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        369⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        370⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        371⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        372⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        373⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        374⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        375⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        376⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        377⤵
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        378⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        379⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        381⤵
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        382⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        383⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        384⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        385⤵
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        386⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        387⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        388⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8716
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        390⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        391⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        392⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        393⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        394⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 400
        395⤵
        Program crash
        
        PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3064 -ip 3064
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
335KB

MD5
06f4e5f6d8f857eecbeabeaea7e7b07c

SHA1
21f3ae223fcdd88e1cbc6fd2f1735d23adfbb50b

SHA256
ae00ed7d60173b746800d6f3c5722fbd0c371c0c7a9f6fc51f9df87b5b40dd65

SHA512
183bef6ee660977c8476ebf1873ea1393a6ee3bf8726d1129db3cc92fffc5a0012b2c09c9a0057d821fd6fd9087ed8782fc999b168668d185fa4abf7ebcd8b8e

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
335KB

MD5
b859bed6a21bbcdfabeb38756abbbfc6

SHA1
bbb89f9768738e7df130dab145dcc4c0f32cb175

SHA256
3d25608c52b74d57edd8f2268f057c4eaa4d6f792fb7d9589723389cfefac6f9

SHA512
267254725c1e5110bc1ab5033af4ebbaff040d4cb1a6abcdbe7f510f428cbb7fe3f87b690e12d05e0de186de687606a9425c1b5aac9af701e2c6cd4527308c0f

Download Submit
C:\Windows\SysWOW64\Akqfkp32.exe

Filesize
335KB

MD5
d72aa631aa54ec7d783e094e43250687

SHA1
9cd8624690952a652c6d7d7e52f6c3b7b1a78a88

SHA256
7e8e702e161dad27f457bfb435febb87dce5cbd568bc497d180f7dbbc77c185e

SHA512
8bb623e0e00b400002484d99a8652c7a063750bf44b53141194a0402835d6655643e7f1a5c0a409be39b3f7447538e24824590621a8eff684dd590b14a398ddc

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
335KB

MD5
c6979d68b921bfd129ffb1f42e29e376

SHA1
8fa1027892314088ee28b15136f244d687feaa34

SHA256
e37c03b22f9b90e97f8703187d196a75e800a573450a6602b156499d78d301ac

SHA512
37e8520665eae3b0d0c0d4093a77214c7b55c293b3d6ca6f1dc30ad677fc19e501f4ff412a6cf8170fb24a8c0989f8e444a470e5fe548fe99a62af9aa35ab557

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
335KB

MD5
7afc7f657120b3b8af7f6d663a8f2bed

SHA1
b0b8e9a4c382512f06c0333b482d682917dffb87

SHA256
29cf328fe90b3118c2fa9d67f1ee3bd9d6f1b9f801a8ae99b75c5c3ae8fec982

SHA512
3580cf835057aa2f8e5a9fdeb8cbfa8db88dd54047501afa73ab9542b97099f2f0dcd846b367b59908f0f2e1abe45e1dd4def77580477b7b80180e67a50153e8

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
335KB

MD5
35a4992c275064d09c86a9a678b7e0ab

SHA1
186487299815ce65ff6c06f02e1623b95a0ee946

SHA256
e5811e6a5e6cd2d723a7c851c718f0b380b0a75a0a52ccd19759fc47cb464762

SHA512
52f8b16fd50572db70185bcbbe23e214d4a928237aa13c6467ce3a5f786ade7ae29690266e7d1d07257a9ebe7907885e84e3c0bf1f46af5c9acd9a376a007a92

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
335KB

MD5
93c08af1623432b11ba3ea913be545bd

SHA1
6642915c9a7c9dce23cdd2e6aacdbd45f76dc09c

SHA256
6074a0142608dbf53a2d1417b69327ca1a00effa0096db08161e6396f432e63e

SHA512
93476f0f164356acf9560eff4ddd9d19b5825ef1b625e18b4664d1de36f804c65e88495734c5504c3a249709da5d798987be2d42e375f5c92d36ec85a19b7a51

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
256KB

MD5
e0d5a9e4514ddba4c4fcd90e40aab882

SHA1
7d189705a015fe2f291c051a2b7dbcc77c35a7d6

SHA256
3e321f28ebbc16ac948d3a10f1447ca564c81512fc2bd03eddecbbe158d602cc

SHA512
99cf466086537c16e8a727142391909ef1545696dd93ea54c390bc6a818dfdcb770fe59fe7f4cd9bd09517f4555dd5e1a0e8b2dc082f07b939b5e35e3b8c759b

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
335KB

MD5
f47f6998733fdd51e8b8c744c2021040

SHA1
b59d73a989feb9114aaf4f62c08cdfd3c9ee2e1e

SHA256
cbf8b695bbed044738281c5242b52f2dc4220be22392238990b980ef0468e6e0

SHA512
c228df565da804f04bab39bd7da018c9db65fbf524bd1c87fdcb293acdb0a4c54594bbc285884ca85359f94936e912f146a42ea03997add72201ff0f8abf43f1

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
335KB

MD5
c3434e565345484a42802cf0c4abd3e6

SHA1
0556bfd990b3c4f5ec25d87197bc52b229b356c5

SHA256
8b79fa9d8191c5b7d5e0a6dd83db9425268acc18ad17b9d87f3e36e631b404e2

SHA512
7f84a66eff15b525b90fccab8170734acdaaeee0268a4163a4089600324e73378562db5a5bf97df210bfb931db740cc77112f0a80bbb76584ee2c5473344c7e4

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
335KB

MD5
c966582c47408feb401e1c65880b1ba4

SHA1
8f9ea4bd32c7e0756e47d0dd16506e08b67600fa

SHA256
e314bbdc43f0e0385a640d3b06ca9cc41a0acceee7c457c5d607f1590e0fbc74

SHA512
3c220ef7d6906f290cf2415ce3fc41281d06cc70fc36840c456812a0f72a2c4de17ba0c653892f43d3fcba1a690a2dd3cdde1a24169022af56dc4035e8487184

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
335KB

MD5
a271f86d66b23396d339544ea54fcf12

SHA1
ba812d5c3923530e99c278f811e60d68869f621f

SHA256
65c48e58b167cd3be27a71746303f7568de4d21f62105728cdae509ea6aee176

SHA512
b799057296d825f90ce8af2422a06fd7468009635fd6f0ca3b395af528191e07abc1df78f611e1de956e272efd30ba50e9637a07f4a8cae956a805411b6026e9

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
335KB

MD5
3aa858dacd15f26557638976ddb54b5f

SHA1
53fff9513cfb59133860abcd3fb63b9e3077abfa

SHA256
036376c1694df248756eb964d7128eca0a2b8cb062b0e7d46b237af4b5cd8597

SHA512
88b2bb2ba8c53e1c821547018d437ff325845ed1fc3d830aca433065c98a792d4e0ac174e564eb0cff016d1191ae15a23f34094f83b8b95cf727947046f64c37

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
335KB

MD5
768537689a1c83a97fd003c7e065521b

SHA1
a6ac16b5f353ab4a31692a3886229dd093acfd77

SHA256
305289d25c6ae79334a17811b7f3cc669cfd33904b48c1bfc687496336efa933

SHA512
75f5ea2c93a8481300bc8f66d579b056239c2de84428123897c1fce6369acaa7677ac7615d7c4f7f59ea75153f6543a59f4568291c4a29e79299f2fcbc498bce

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
192KB

MD5
53450a7afb8259635238f528813c1d77

SHA1
a5c9d08d9f330052f7ccd107c6a613154cef1914

SHA256
b208df19af7c4aa5dae4e826fe7859ec7a158f50fc3abc5487b4f06f2f3bb399

SHA512
495a64dac3057d323a24b2162f30ef9414b7a7c1d96f3eb1e380ee50d71921646a7612352aa2d8b69d0fe7967a42ee00413e71a43941d5cdf720a72050fe0f84

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
335KB

MD5
2eaf496a3dc3972c04dcccac2b21b80a

SHA1
04ab16bf671c854de0b0ce2cd17c364110b99e05

SHA256
3d05a61de10238361064e245ded8d9dfe35de6a7550002403a7c857f82126fb2

SHA512
96e8a5c57668a659e9b9efaa4a7675636b031fa4ff47030f1b03f2a0cf2418bee73389cfa36b5b3a0dfe1fa70c5d2839310dcb3eff6bf032725f37dba7aec41e

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
335KB

MD5
2126017b428df0eff14c422a76fc6ab4

SHA1
b6a2e867415354b68b0cfced7321097e99e8cb77

SHA256
210832643dab50bd05e4aebafd87375389cbdede1e7983bbdc8fce9858c74944

SHA512
fcce405332e358db9fbb35f3ec3e1b8ca466427238b3a0a60871610c230fd1e2013620b2a6e4759947856dad3c75813fdafe4b252792a2e35ecedaf6df3c9d6e

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
335KB

MD5
d6d40f2818c0b18e41903f7181cb4063

SHA1
79305b39b5b43fbaad00e29e06bdce3b1b258a0e

SHA256
a9519974c9a8ba5784908b2dfcdfe6519ba9f8b2d77be8798d7ecc62e5277d82

SHA512
5988be9201ce4590bb5e973f48e8f33773622776d2eb9005e548d95d45c1a25b79051205376dac70f7a5bb3db00c96763d7b1d603b933f285b696fecbf2ae696

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
335KB

MD5
e107d53a1a00cdddc87bb5ad775d7b47

SHA1
706e23af2980a7707c40cfe404227b36744591ad

SHA256
72237310800ad885190c6523045bd15db750329b736dfbca70d7c2e4247b3546

SHA512
47a648a663cc3f12ba1cf78771a03398fedbd59352ed3cceced5779b49e308b537d5cd4f1797b2ee4e9d560647ba201029ed340cc9af7c0b4cc145997963ad1c

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
335KB

MD5
4d3a1d8076a7242a6434bff2d7012b76

SHA1
34cd5dcb4829515bfa0f9fb23d11c849d96bf937

SHA256
f59fecb7bbf8adc949bec42fe321528ef910785d4601d284d82976deab66f114

SHA512
1f0f2f59a3985144babd3fb774a95223ca632a5606597ce19f2a65e6f9b0088731e399477d93068efee1b2ffc1c795a7e9c5802aade8c18adee4a06b7112c7cb

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
335KB

MD5
5880da90a5a8e5faea67757836d5cc43

SHA1
3aef205e84a41af59135e7195a4a20a5d62c77ee

SHA256
9a99759a8e705d9a0f19f417907d2e9e0985885858cbaaff44ccec98fa3efc48

SHA512
a1132f9409e058660974cef6a4372527a8cb5b668d037474a4ca3fada0ab93cb570ea450e836158c2262c1a31547b9da4f9fb9ff9bfc3274ba369ef783533084

Download Submit
C:\Windows\SysWOW64\Eachem32.exe

Filesize
335KB

MD5
61f13e9a859cd128d26c4dde02bd358c

SHA1
e784ed4b88fd3bdcaca4005d367be4d351de4e6c

SHA256
c202121d44bc7e2d32d653bc3817daa09d671880037ddc798458dd0c5c123f04

SHA512
e6d48be8cc21a0939bc5ea531be4183ba0c19368ea958fc05edbbe382f00aedc2ca6859544313ee9712095145ff05d3f9cbca03443551b9457ee765993ba6bea

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
335KB

MD5
4a90e9445bcc7cf5d6bb200eef20e8e1

SHA1
e57765d264035379005d2109c43116ec6487480d

SHA256
f91a45fa102c3abaf7bce91e242ff3f7d08cf47959ab88035071c21a49bbc2d6

SHA512
db04c76556204a19661f4dc2d86eb665070e0ac78d47efecc30ac7f20140b7ba729f287689b2a1a062381b8c1b48cf89b773880f3886f5f5e6cb80155c23a2ca

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
335KB

MD5
d0630a8fa10d9c6267fe439859ba9d5b

SHA1
864a546e956f725762f619886173c577cd528824

SHA256
a09249817b2ca0891781e63e25ef85833df23bb54b3d8d715a5e98e5a4be4058

SHA512
d05a51e1373d5268fd3fcae219009c86cd9b77d98fe0affeec7394cc061b30ceaa21ff5d1a69a32d2f1d5b1812f8c465dc5c80eb232604df0723a261c269a6a3

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
335KB

MD5
bac3bc1a06ff988cf415ab7e96b97923

SHA1
7801bfac330194856ade5797a97088daf4ac6893

SHA256
cb6c6905c29ad085b96945c58bc443998380237629d7acf477bb84260b12c1f7

SHA512
96aff0f7d82819d4059a25ee68196641bdf32d7547092fe3a431d5d4948f0693cb8538a56779b440efa907bb19bbf5b839754b0546ab55bece659a8ccff67584

Download Submit
C:\Windows\SysWOW64\Ehkclgmb.exe

Filesize
335KB

MD5
a3b5de1b427ef27525eb4d7afb1f92e2

SHA1
e1ad82f28a4c5447a8a0844a5d427739fab636b8

SHA256
5425213d4ca5060e856caa0d26adbf899669bf1562dcf1f3b5d1258355a258db

SHA512
b10d60c5cf3d18768d8d6d3a355ef2c04d702c8f5f3e8338a45969f06d5cae2b096ff27f4b69fdbcc409c6f5e53968e3e1809aae7b0956d088a20992cbb94aff

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
335KB

MD5
fd72445d6435e25d1ee4c3eefd65effa

SHA1
70c4607a974b2dacc759000b21af3e08d166d72c

SHA256
8c216014ccab525d9010216299341c7ca4d89a63e9ab9df36302d4cef99a2e9c

SHA512
96d818d18791a6df4863c958009f1fb85db35aab6decca783ca4bacf503aa9449d4d80b5ae873b0441396eb3e471dcef4249f0cec44073e96a54118a29d2bd52

Download Submit
C:\Windows\SysWOW64\Fdbdah32.exe

Filesize
335KB

MD5
750ac988f3bca462dcd5346b358eaa8f

SHA1
de7d7546cca3c6fe5850a59bd1a50f2c954c9103

SHA256
759029c8d3578b34e81b9a45f6c29ca3a65b91203c03baf101abb6bb44e5c2c5

SHA512
c589a54ad38b3abe50b795a7a5f425e1088625ac76d6b92e2577ff351a5d8943af3353218ccf11bcfa36643c797e28f072f25d0f1ad5157b3c898db26214eb9f

Download Submit
C:\Windows\SysWOW64\Fhdfbfdh.exe

Filesize
130KB

MD5
5d26dd66a3ae86dd80965681a41452b7

SHA1
6ad9623c0b6de796df1e12104cc2c6c9190c108e

SHA256
1f6b4c7a6e48c555d038c712549a8e650043022c72d3da11c7bc8e21cbad2aa7

SHA512
854c8de9667f1c71bad6e311e70b9d8ab19e6d364c3ecd6f20a84b7893448594af97b42ba348be86f11e90adcf6cccc3c5c3e775f7834bfab07e61747b50bd8d

Download Submit
C:\Windows\SysWOW64\Hkbdki32.exe

Filesize
335KB

MD5
e0ae3e8c73c85f13b0385f332ba1ec30

SHA1
4154a2586a3d9d274f11eae7d7b833dd63619553

SHA256
90d57703a06c6c1b9eea06855ba6f73bf61ea0ba4d68b91266c7e925e8a41cef

SHA512
e823112c2c658fdd8b4e14a3e0a2c51e79547eae20d9bfb9912dcc27ac0b2da552d442f5ed62f7afd1a3e82c2dc9e2faa342b46c118d268b6f8907958313d3df

Download Submit
C:\Windows\SysWOW64\Iakiia32.exe

Filesize
335KB

MD5
a1bf3f18970dce6bf956099ce7742eba

SHA1
8571949b6b87a84f008a2056945c51c1a409b111

SHA256
d758dc56e78b1aa1c87cd6fb40239ab96f3e312a37f71b474fc273ef54ee50d5

SHA512
39b765f5a6e834b623bfa05db9aaae403592603fede10143241993b35b0b0a8654a2bbd4c2b7b5b57776bb8b6b45ca4ad74890015763bcbe88fb5ce625dbb056

Download Submit
C:\Windows\SysWOW64\Ioopml32.exe

Filesize
335KB

MD5
69a99cf85e54985d6260ca8a185d5a8b

SHA1
3fc8f1960d6433b58d049f252ef8bd0e4197c407

SHA256
1a2a9685e2761e5d9d85085db0cdc2e07fdc9bba9644ab9acfa4d5f42007c79e

SHA512
92b7c0eac86f1e1a356529c774da3a45341a427d0f03093faf3a1373c47a525833e04c5168dd42808881529278fa5400b6ed89c874e5236d84bd2ed2e1cb418f

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
335KB

MD5
f0e42e4f72b4bf48b568c52da8214d31

SHA1
15220c05a0c4e4c89c8dbe3a9386bfd4126c7fb3

SHA256
2d95abd0b151fc58ec2fb18a436ccf93051ef28d3abff5b3f1ace7429553d706

SHA512
7e7b00ca11c1b9108b338b50b682f20e651fffc54164fbeb1065dc21bfbacf2f497f57f57e8be588e948decff588e5e259473816b8268026f0d22a8573672d4a

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
335KB

MD5
c2bde35108b7ad69db98c20b1f0034a5

SHA1
1bc31bc79f43cbea6a2f60d116e78e9fdeb3d43e

SHA256
8300b37f23b38574f222699d2f1b0c88723295830165d5f19dd67a94da51f7c1

SHA512
4084067a02e27fba69a8ac8400b7e5df1dd44c0410dde83099d4e8f69b59ed89a9cff6ee33cc7c8880700194d46fc60fc9e06c393808b3174635ec2ae1efea89

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
335KB

MD5
a3d71938957a77956eeb5669dab7e1fc

SHA1
4d5bf022c98ceb31d6d2b438a60a7d8a4e1373e0

SHA256
1b32686cdab32a60da4df06361427f7d240bdcae45f5b731c7df9a4ce98e310b

SHA512
073b405b4e1daff8c587658763dd851243ee429cc001f547ba4831f955d51a880035eb1fe5b162974a8f6f64b3cc5cd928f154a2fedbfa2056a257d13f4a867b

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
335KB

MD5
5ba0b3afb56838a83874c584ec45b214

SHA1
c8834f6bd16b6b206ecaeb21dad08e27c8ef6559

SHA256
8569690a2b9c5728d2fcf722185b8060131b4678e52273be3d29e7e7e3d9bdef

SHA512
62688e63dd39bd939a893c6fd95e74a941580472ca3f0b5e362d1d7d7a80c80197fcfcf59d8da5800267c8a6ff0d0f3d0ec21ee295845dc8609e7fece6d4e1cd

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
335KB

MD5
7062efe16c8708e272abe0184c5602b3

SHA1
332b9055070d8eec598c7d1e96357d7bc075859b

SHA256
b0a02af01b77005f37e0899d90e1b2b3b42200a725be51bcf23fc38196a5bf08

SHA512
6ae8a24a2372e8ff7642645a9ecaa7acd16919c66b857a03149524fd2b613a7fd5d40214199fbcba111b09421f6d14b3f7481d73a1441974b1922dd99b10ab75

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
335KB

MD5
370ceb4462e2ef99657881243570cc10

SHA1
86ca91f89b067627bc4a793923d92660ca567ea3

SHA256
91bb3c35c9d774aa7fb9028f7c4a64deb6d90b49c44c72c3016756f541384888

SHA512
3cfec426a49bb25566a7c11175f1e2735edbce92e6677c80162701ea5011dfa49afbd967bc935762e433fb7425da2a520f30a413cc5186085cdbdc5e08807e15

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
335KB

MD5
160fe99b2777044783fcf027763254b4

SHA1
d64cd2f0290f87199a00023a9c9fc6c27e91fba8

SHA256
1ef6b3d45176c06550c0f77b24227a6e7348be1abda92b1e61fba4b5cd195ab8

SHA512
1cea48b60ecb9c3cbc5c6226b89270af327c0cd75bb29c31f2b2a59b38ed8182cc83fef2afa53935be69e85d0120ec238d663f3b9122b636c095433654f1d6e2

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
335KB

MD5
825c2676efcd2e16a38e3352cd311613

SHA1
13a37aafa88d48a34dea0e0fd71184ce23cbdb9b

SHA256
7ca74c52642ca3a8f6de385efac7ff2dc8b9a3ea0862fd0bf0a40e2e4fd9ee41

SHA512
0c71f31eba3e90c4aa0d670364207534b976a8b190fccdca6591819b4d23178d49f20ec707dfe42ffceaaab9ffdaef85439632f738b1470118f69feceeda46f0

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
335KB

MD5
112512ce7db0c6740a7bb18fc0dc541b

SHA1
b485406e3d2ad3ea7d369836b0f4bc0b034e3ffb

SHA256
f6adccfe92beac3de4c1f5f8842bf40f419ffa3f1bec8f9f385d1bd6c6cc9623

SHA512
2fd64cf4d25d2432c86b44cf4f70ea1c7ffd87ec795f1719573c84a515b3fb03845cd01709ffdcbe7771dcef725906c45ba721b0b947135955c5caa12f1b108d

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
335KB

MD5
5605787d372cf908a0412a87e1861213

SHA1
05b2f0daeece0ce92a08564d3c431a3bd3c1893f

SHA256
8b7fa9b7fa0fdc1dd6fdf5441900d682df8b236b33b3f4c5ca71489f2f81af19

SHA512
16f6123e99359af3a2d639ce44c8542aa331c208a893927e9bff834f69fe18c873c3f43a8cc806fbe1554e56512628f970350e0f50bfb79bdde40a6970c38932

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
335KB

MD5
2eb0844a68155fc1bdd24aa45b52d181

SHA1
f38a2dc7fbbcaedca53c0acf3f17d85b768aceb0

SHA256
f348dc4ffb4befefab227247354862e9a4c09b9e22def9af8166d3820b3812f8

SHA512
873cf94d72c4a985ed6367df3dbc27a9c4559b03acdb5e83beba3874c32da7bb12bb3b23d622508b4d9af83121bf2f218f20d881c1fadc48340c923a193b15fa

Download Submit
C:\Windows\SysWOW64\Knefeffd.exe

Filesize
335KB

MD5
8c1904a6acb3b0253b2f5d2452bd9cdc

SHA1
1c5c9f6a9875c99bb830680379af4fd0e0c7df56

SHA256
4d878b7ab5c78ff9da51b3cb8f9644141dd23a06b3e508de04616b0422f698dc

SHA512
32e51ca3b22bfd50b87a9e7f2211007226831bd526af2561b76547d25ebc1d4ccf6ad1f492e85c20e6c72b7504edb2ce7ba68ef69c76091eb574c12ba838bced

Download Submit
C:\Windows\SysWOW64\Qcaofebg.exe

Filesize
335KB

MD5
fbba355561a174187514d2e97629ab7e

SHA1
c45d730e8f09a803029a9004a5a4624c652a01d4

SHA256
5bc0c69ab962b3808fa6ba3bd3d7b2118b6482602da3da671a14ab09d839806e

SHA512
a625697d0c83a7b427c91e7f847f12a559f4ad1b39aaac7a4f95acb77d8180f815ad95b36e403bd3e9fbcc2c24d6469c5d70282e22a49942f27781009b045b69

Download Submit
memory/116-339-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/220-389-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/364-310-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/452-264-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/532-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/548-379-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/672-445-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/736-349-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/932-351-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/952-406-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1008-24-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1132-36-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1144-357-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1196-420-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1224-12-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1348-163-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1556-449-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1596-196-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1736-419-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1740-242-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1888-382-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1980-243-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2136-227-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2168-471-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2200-280-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2304-440-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3092-494-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3180-250-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3192-258-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3220-112-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3256-40-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3260-374-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3292-404-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3304-291-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3316-191-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3324-320-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3332-324-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3364-64-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3432-52-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3788-107-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3896-192-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3944-80-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3948-427-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4156-132-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4216-158-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4384-72-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4452-364-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4488-95-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4560-270-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4576-293-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4596-143-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4612-480-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4628-299-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4652-478-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4732-497-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4824-333-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-473-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4884-205-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4896-466-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4928-214-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5012-88-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5036-134-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5076-16-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5104-63-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads