ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80

Analysis

max time kernel
164s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe
Size

55KB
MD5

bba7f829f61aa5909c9264f326f520fe
SHA1

3f20cc991df4cb14b70d6bf2ce855df3e49c4ae6
SHA256

ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80
SHA512

e239cccf92d06471dd2a9b0922ab85e2b774a95448d759060b069ee127a9ad5b005aab593583bd4a1cbadb76c4c1d1d559a8a7a8830644f1b4bd92213a276919
SSDEEP

768:AlKN5u5l9yTK3pX0CofQwvB/XvXKkYbCFjf3UJrCqhki3jT92p/1H5cNXdnh:ksUZ09Jv9Swl3UJrCqhl3jh2Lw

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljkifn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcgndf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mplhjabe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfoebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kklbop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clfdcgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlpgiebo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjfpjjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjapphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdjapphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedceddg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldqfddml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aiapjecl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abqjci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjmojl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neqoidmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkfno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblcda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mikjmhaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflpfcbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miofjepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malgcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cimmggfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnbifmla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kklbop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klnkoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blakhgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dooaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnbhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehlcikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Embdofop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgfqgkib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agqekeeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nenjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niihlkdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdeghfhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blkkaohc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnlkllcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abjmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhpeelnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmkkgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklomh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcoioabf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jahnkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngmggj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllkcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igbalblk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khlinedh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipcakd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apkhfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbecnipp.exe

Executes dropped EXE 64 IoCs

pid	Process
2524	Leopnglc.exe
4364	Ljkifn32.exe
960	Meamcg32.exe
4340	Mlkepaam.exe
2708	Miofjepg.exe
1004	Mbgjbkfg.exe
3420	Meefofek.exe
4868	Mjbogmdb.exe
4584	Malgcg32.exe
3712	Mlbkap32.exe
4812	Maodigil.exe
1704	Nobdbkhf.exe
4236	Objpoh32.exe
3880	Olbdhn32.exe
1220	Oblmdhdo.exe
4688	Ohiemobf.exe
4140	Oboijgbl.exe
3340	Ohkbbn32.exe
1084	Obafpg32.exe
1308	Ohnohn32.exe
2092	Pllgnl32.exe
2232	Pcepkfld.exe
3224	Plndcl32.exe
4604	Pakllc32.exe
1668	Phedhmhi.exe
3568	Pcjiff32.exe
1364	Plbmokop.exe
4020	Bcahmb32.exe
3768	Bombmcec.exe
1352	Cihclh32.exe
4896	Cobkhb32.exe
3488	Cijpahho.exe
3428	Ckilmcgb.exe
524	Cimmggfl.exe
380	Cofecami.exe
2412	Cioilg32.exe
3028	Coiaiakf.exe
4308	Ciafbg32.exe
3300	Hibafp32.exe
3336	Hplicjok.exe
1448	Hkbmqb32.exe
4928	Hmpjmn32.exe
4432	Hpofii32.exe
1200	Hmbfbn32.exe
2688	Hpabni32.exe
2836	Hgkkkcbc.exe
4984	Ikkpgafg.exe
1444	Iphioh32.exe
3412	Igbalblk.exe
5116	Iloidijb.exe
3016	Iciaqc32.exe
5028	Ilafiihp.exe
2272	Iggjga32.exe
5056	Inqbclob.exe
1160	Igigla32.exe
1640	Jpaleglc.exe
2456	Mmnhcb32.exe
2692	Nnbnhedj.exe
3884	Ncofplba.exe
5132	Nlfnaicd.exe
5172	Nmgjia32.exe
5208	Nlhkgi32.exe
5248	Nnfgcd32.exe
5292	Neqopnhb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Plbhknkl.dll	Hmpjmn32.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Hkbgll32.dll	Jafaem32.exe
File created	C:\Windows\SysWOW64\Lfdflk32.dll	Qnlkllcf.exe
File created	C:\Windows\SysWOW64\Omfajq32.dll	Mbgjbkfg.exe
File opened for modification	C:\Windows\SysWOW64\Biaiqb32.exe	Befmpdmq.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkma32.exe	Nqioqf32.exe
File created	C:\Windows\SysWOW64\Pckfdh32.exe	Pqmjhm32.exe
File created	C:\Windows\SysWOW64\Amplmpme.dll	Odhipp32.exe
File created	C:\Windows\SysWOW64\Bpmobi32.exe	Ppccemjk.exe
File created	C:\Windows\SysWOW64\Laacmbkm.exe	Lnfgmc32.exe
File created	C:\Windows\SysWOW64\Ognpoheh.exe	Odocbmfd.exe
File created	C:\Windows\SysWOW64\Ncofplba.exe	Nnbnhedj.exe
File created	C:\Windows\SysWOW64\Omdieb32.exe	Objkmkjj.exe
File created	C:\Windows\SysWOW64\Mnedig32.dll	Geklckkd.exe
File opened for modification	C:\Windows\SysWOW64\Ekeacmel.exe	Eelifc32.exe
File created	C:\Windows\SysWOW64\Ieoapl32.exe	Ikjmcc32.exe
File created	C:\Windows\SysWOW64\Ncihbaie.exe	Nqklfe32.exe
File opened for modification	C:\Windows\SysWOW64\Odpjmcjp.exe	Onfbpi32.exe
File opened for modification	C:\Windows\SysWOW64\Geklckkd.exe	Dhdmfljb.exe
File created	C:\Windows\SysWOW64\Bppnjc32.dll	Lilbdcfe.exe
File opened for modification	C:\Windows\SysWOW64\Loqjlg32.exe	Lgibjj32.exe
File created	C:\Windows\SysWOW64\Bagphg32.dll	Mhenpk32.exe
File opened for modification	C:\Windows\SysWOW64\Npcokpln.exe	Nneboemj.exe
File created	C:\Windows\SysWOW64\Nlfnaicd.exe	Ncofplba.exe
File created	C:\Windows\SysWOW64\Bdlfgpeg.dll	Eclmlpfl.exe
File created	C:\Windows\SysWOW64\Mepfbflb.exe	Mjkbemll.exe
File created	C:\Windows\SysWOW64\Cijpahho.exe	Cobkhb32.exe
File created	C:\Windows\SysWOW64\Npdpachh.dll	Dfnbgc32.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Gbfdbdgk.dll	Qlmopqdc.exe
File opened for modification	C:\Windows\SysWOW64\Dcaefo32.exe	Dkjmea32.exe
File opened for modification	C:\Windows\SysWOW64\Lnikmjdm.exe	Lmhnea32.exe
File created	C:\Windows\SysWOW64\Ceppfbef.exe	Blenhmph.exe
File opened for modification	C:\Windows\SysWOW64\Dampal32.exe	Dkbgeb32.exe
File opened for modification	C:\Windows\SysWOW64\Iggjga32.exe	Ilafiihp.exe
File opened for modification	C:\Windows\SysWOW64\Ahdpea32.exe	Aiapjecl.exe
File opened for modification	C:\Windows\SysWOW64\Dokgdkeh.exe	Ohcegi32.exe
File created	C:\Windows\SysWOW64\Pgnnkfll.dll	Mikjmhaq.exe
File opened for modification	C:\Windows\SysWOW64\Nemchn32.exe	Lhdqml32.exe
File opened for modification	C:\Windows\SysWOW64\Ngbgmpcq.exe	Ncgkma32.exe
File created	C:\Windows\SysWOW64\Aekecn32.dll	Ogjmnomi.exe
File created	C:\Windows\SysWOW64\Mjbogmdb.exe	Meefofek.exe
File opened for modification	C:\Windows\SysWOW64\Kpanmb32.exe	Jdkmgali.exe
File created	C:\Windows\SysWOW64\Phkioc32.dll	Mqpcdn32.exe
File created	C:\Windows\SysWOW64\Ndifai32.dll	Oiojmgcb.exe
File created	C:\Windows\SysWOW64\Olaqbelh.dll	Cimmggfl.exe
File created	C:\Windows\SysWOW64\Addcbd32.dll	Lkcaeige.exe
File created	C:\Windows\SysWOW64\Ahnkoaah.dll	Anjngp32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhofnpp.exe	Aecialmb.exe
File opened for modification	C:\Windows\SysWOW64\Dgcoaock.exe	Dedceddg.exe
File created	C:\Windows\SysWOW64\Cldojg32.dll	Alioloje.exe
File opened for modification	C:\Windows\SysWOW64\Bpkllo32.exe	Mpdkol32.exe
File created	C:\Windows\SysWOW64\Aqdolf32.dll	Nnbnaj32.exe
File opened for modification	C:\Windows\SysWOW64\Miofjepg.exe	Mlkepaam.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bklomh32.exe
File opened for modification	C:\Windows\SysWOW64\Mikjmhaq.exe	Lgmnqmam.exe
File created	C:\Windows\SysWOW64\Jdlcde32.dll	Nkqpcnig.exe
File created	C:\Windows\SysWOW64\Lmgnid32.dll	Eofgpikj.exe
File created	C:\Windows\SysWOW64\Mnpice32.exe	Midmcgif.exe
File opened for modification	C:\Windows\SysWOW64\Mnpice32.exe	Midmcgif.exe
File created	C:\Windows\SysWOW64\Badipiae.exe	Bnfmcn32.exe
File created	C:\Windows\SysWOW64\Blkkaohc.exe	Bimoecio.exe
File created	C:\Windows\SysWOW64\Bfdcaj32.dll	Pnlafaio.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adpfmmcl.dll"	Dkbgeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igmjhnej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfcnicjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djoohk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klibdcjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgkicol.dll"	Pnbifmla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogqcon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmiccf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plbhknkl.dll"	Hmpjmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Minbgdmm.dll"	Lhgiic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bblcda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nljopa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifdaage.dll"	Maodigil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miepkipc.dll"	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnefdf32.dll"	Lpgalc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckilmcgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekeacmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhfceklb.dll"	Clfdcgkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njdeklca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjbogmdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilafiihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjkbemll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmncbodd.dll"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhoind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaaaak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afjlgafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icachjbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agqekeeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooaiflce.dll"	Lkjhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbjmih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obombeqb.dll"	Ncfdbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlnbhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlibpihh.dll"	Njdeklca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbokheno.dll"	Ceppfbef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdjapphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogifci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abcgii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqpeaeel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blakhgoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niihlkdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihbaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogmapb32.dll"	Djmbbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phkmoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioclnblj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onkbenbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpagfnc.dll"	Biolkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbohjk32.dll"	Bmngjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeedjegm.dll"	Jpaleglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofncde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkmmkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadkoa32.dll"	Phkmoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peajhk32.dll"	Liimgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbnjqmcp.dll"	Qjjhla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqgjoenq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhleghg.dll"	Jahnkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncenga32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2524	2184	ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe	87
PID 2184 wrote to memory of 2524	2184	ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe	87
PID 2184 wrote to memory of 2524	2184	ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe	87
PID 2524 wrote to memory of 4364	2524	Leopnglc.exe	88
PID 2524 wrote to memory of 4364	2524	Leopnglc.exe	88
PID 2524 wrote to memory of 4364	2524	Leopnglc.exe	88
PID 4364 wrote to memory of 960	4364	Ljkifn32.exe	89
PID 4364 wrote to memory of 960	4364	Ljkifn32.exe	89
PID 4364 wrote to memory of 960	4364	Ljkifn32.exe	89
PID 960 wrote to memory of 4340	960	Meamcg32.exe	90
PID 960 wrote to memory of 4340	960	Meamcg32.exe	90
PID 960 wrote to memory of 4340	960	Meamcg32.exe	90
PID 4340 wrote to memory of 2708	4340	Mlkepaam.exe	91
PID 4340 wrote to memory of 2708	4340	Mlkepaam.exe	91
PID 4340 wrote to memory of 2708	4340	Mlkepaam.exe	91
PID 2708 wrote to memory of 1004	2708	Miofjepg.exe	92
PID 2708 wrote to memory of 1004	2708	Miofjepg.exe	92
PID 2708 wrote to memory of 1004	2708	Miofjepg.exe	92
PID 1004 wrote to memory of 3420	1004	Mbgjbkfg.exe	93
PID 1004 wrote to memory of 3420	1004	Mbgjbkfg.exe	93
PID 1004 wrote to memory of 3420	1004	Mbgjbkfg.exe	93
PID 3420 wrote to memory of 4868	3420	Meefofek.exe	94
PID 3420 wrote to memory of 4868	3420	Meefofek.exe	94
PID 3420 wrote to memory of 4868	3420	Meefofek.exe	94
PID 4868 wrote to memory of 4584	4868	Mjbogmdb.exe	95
PID 4868 wrote to memory of 4584	4868	Mjbogmdb.exe	95
PID 4868 wrote to memory of 4584	4868	Mjbogmdb.exe	95
PID 4584 wrote to memory of 3712	4584	Malgcg32.exe	96
PID 4584 wrote to memory of 3712	4584	Malgcg32.exe	96
PID 4584 wrote to memory of 3712	4584	Malgcg32.exe	96
PID 3712 wrote to memory of 4812	3712	Mlbkap32.exe	97
PID 3712 wrote to memory of 4812	3712	Mlbkap32.exe	97
PID 3712 wrote to memory of 4812	3712	Mlbkap32.exe	97
PID 4812 wrote to memory of 1704	4812	Maodigil.exe	99
PID 4812 wrote to memory of 1704	4812	Maodigil.exe	99
PID 4812 wrote to memory of 1704	4812	Maodigil.exe	99
PID 1704 wrote to memory of 4236	1704	Nobdbkhf.exe	100
PID 1704 wrote to memory of 4236	1704	Nobdbkhf.exe	100
PID 1704 wrote to memory of 4236	1704	Nobdbkhf.exe	100
PID 4236 wrote to memory of 3880	4236	Objpoh32.exe	102
PID 4236 wrote to memory of 3880	4236	Objpoh32.exe	102
PID 4236 wrote to memory of 3880	4236	Objpoh32.exe	102
PID 3880 wrote to memory of 1220	3880	Olbdhn32.exe	103
PID 3880 wrote to memory of 1220	3880	Olbdhn32.exe	103
PID 3880 wrote to memory of 1220	3880	Olbdhn32.exe	103
PID 1220 wrote to memory of 4688	1220	Oblmdhdo.exe	104
PID 1220 wrote to memory of 4688	1220	Oblmdhdo.exe	104
PID 1220 wrote to memory of 4688	1220	Oblmdhdo.exe	104
PID 4688 wrote to memory of 4140	4688	Ohiemobf.exe	105
PID 4688 wrote to memory of 4140	4688	Ohiemobf.exe	105
PID 4688 wrote to memory of 4140	4688	Ohiemobf.exe	105
PID 4140 wrote to memory of 3340	4140	Oboijgbl.exe	106
PID 4140 wrote to memory of 3340	4140	Oboijgbl.exe	106
PID 4140 wrote to memory of 3340	4140	Oboijgbl.exe	106
PID 3340 wrote to memory of 1084	3340	Ohkbbn32.exe	107
PID 3340 wrote to memory of 1084	3340	Ohkbbn32.exe	107
PID 3340 wrote to memory of 1084	3340	Ohkbbn32.exe	107
PID 1084 wrote to memory of 1308	1084	Obafpg32.exe	108
PID 1084 wrote to memory of 1308	1084	Obafpg32.exe	108
PID 1084 wrote to memory of 1308	1084	Obafpg32.exe	108
PID 1308 wrote to memory of 2092	1308	Ohnohn32.exe	109
PID 1308 wrote to memory of 2092	1308	Ohnohn32.exe	109
PID 1308 wrote to memory of 2092	1308	Ohnohn32.exe	109
PID 2092 wrote to memory of 2232	2092	Pllgnl32.exe	110

C:\Users\Admin\AppData\Local\Temp\ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe
"C:\Users\Admin\AppData\Local\Temp\ccc7dfe2458e349e4f7367428b32c2bbf1f6b92903c8dea3033e5e55b25b1f80.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\Leopnglc.exe
  C:\Windows\system32\Leopnglc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\Ljkifn32.exe
    C:\Windows\system32\Ljkifn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\Meamcg32.exe
      C:\Windows\system32\Meamcg32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4340
      - C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        23⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        24⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        25⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        26⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        27⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        28⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        29⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        30⤵
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        31⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        33⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:524
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        36⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        37⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        38⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        39⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        40⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        41⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        42⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        44⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        45⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        46⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        47⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        48⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        49⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        51⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        52⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        54⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        55⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        56⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        58⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        61⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        62⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        63⤵
        Executes dropped EXE
        
        PID:5208
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        64⤵
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        65⤵
        Executes dropped EXE
        
        PID:5292
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        66⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        67⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        68⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        69⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        70⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        71⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        72⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        73⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        75⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        76⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        78⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        79⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        80⤵
        Drops file in System32 directory
        
        PID:3136
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        81⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        82⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        84⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        85⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        86⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        87⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        88⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        89⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        90⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        91⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        92⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        93⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        94⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        95⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        96⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        97⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        98⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        99⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        100⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        101⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        103⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        104⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:972
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        106⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        107⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        108⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        109⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3804
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        113⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        114⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        115⤵
        Drops file in System32 directory
        
        PID:3828
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        116⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        117⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        118⤵
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        119⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        120⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        121⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        122⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        123⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        124⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        125⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        126⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        127⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        128⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        129⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        130⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        132⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        133⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        135⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        137⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        138⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        139⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        140⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        141⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        142⤵
        Modifies registry class
        
        PID:1112
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        143⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        144⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        145⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        147⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        148⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        149⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        150⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        151⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        152⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        153⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        154⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        155⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        156⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        157⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        159⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        160⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        161⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        162⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:440
        
        C:\Windows\SysWOW64\Lhdqml32.exe
        
        C:\Windows\system32\Lhdqml32.exe
        164⤵
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        165⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Aoapcood.exe
        
        C:\Windows\system32\Aoapcood.exe
        166⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        167⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        168⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        169⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        170⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        171⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Qpkppbho.exe
        
        C:\Windows\system32\Qpkppbho.exe
        173⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        174⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Folkjnbc.exe
        
        C:\Windows\system32\Folkjnbc.exe
        175⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        176⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        177⤵
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        178⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Ppccemjk.exe
        
        C:\Windows\system32\Ppccemjk.exe
        179⤵
        Drops file in System32 directory
        
        PID:1348
        
        C:\Windows\SysWOW64\Bpmobi32.exe
        
        C:\Windows\system32\Bpmobi32.exe
        180⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Bcpdidol.exe
        
        C:\Windows\system32\Bcpdidol.exe
        181⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Bqdechnf.exe
        
        C:\Windows\system32\Bqdechnf.exe
        182⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Ccldebeo.exe
        
        C:\Windows\system32\Ccldebeo.exe
        183⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Djjemlhf.exe
        
        C:\Windows\system32\Djjemlhf.exe
        184⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Dqdnjfpc.exe
        
        C:\Windows\system32\Dqdnjfpc.exe
        185⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Dccjfaog.exe
        
        C:\Windows\system32\Dccjfaog.exe
        186⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Djmbbk32.exe
        
        C:\Windows\system32\Djmbbk32.exe
        187⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Dqgjoenq.exe
        
        C:\Windows\system32\Dqgjoenq.exe
        188⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Djoohk32.exe
        
        C:\Windows\system32\Djoohk32.exe
        189⤵
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Dedceddg.exe
        
        C:\Windows\system32\Dedceddg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Dgcoaock.exe
        
        C:\Windows\system32\Dgcoaock.exe
        191⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Egelgoah.exe
        
        C:\Windows\system32\Egelgoah.exe
        192⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Embdofop.exe
        
        C:\Windows\system32\Embdofop.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2536
        
        C:\Windows\SysWOW64\Eclmlpfl.exe
        
        C:\Windows\system32\Eclmlpfl.exe
        194⤵
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Ekcemmgo.exe
        
        C:\Windows\system32\Ekcemmgo.exe
        195⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Enaaiifb.exe
        
        C:\Windows\system32\Enaaiifb.exe
        196⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Eelifc32.exe
        
        C:\Windows\system32\Eelifc32.exe
        197⤵
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Ekeacmel.exe
        
        C:\Windows\system32\Ekeacmel.exe
        198⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Iaokdn32.exe
        
        C:\Windows\system32\Iaokdn32.exe
        199⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Ioclnblj.exe
        
        C:\Windows\system32\Ioclnblj.exe
        200⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Idpdfija.exe
        
        C:\Windows\system32\Idpdfija.exe
        201⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Ikjmcc32.exe
        
        C:\Windows\system32\Ikjmcc32.exe
        202⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Ieoapl32.exe
        
        C:\Windows\system32\Ieoapl32.exe
        203⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Ihnmlg32.exe
        
        C:\Windows\system32\Ihnmlg32.exe
        204⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Jogeia32.exe
        
        C:\Windows\system32\Jogeia32.exe
        205⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Jafaem32.exe
        
        C:\Windows\system32\Jafaem32.exe
        206⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Jknfnbmi.exe
        
        C:\Windows\system32\Jknfnbmi.exe
        207⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Jahnkl32.exe
        
        C:\Windows\system32\Jahnkl32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Jlnbhe32.exe
        
        C:\Windows\system32\Jlnbhe32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        210⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Jefgak32.exe
        
        C:\Windows\system32\Jefgak32.exe
        211⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Jekpljgg.exe
        
        C:\Windows\system32\Jekpljgg.exe
        212⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Kaaaak32.exe
        
        C:\Windows\system32\Kaaaak32.exe
        213⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Khlinedh.exe
        
        C:\Windows\system32\Khlinedh.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Kkjejqcl.exe
        
        C:\Windows\system32\Kkjejqcl.exe
        215⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Kfpjgi32.exe
        
        C:\Windows\system32\Kfpjgi32.exe
        216⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Klibdcjo.exe
        
        C:\Windows\system32\Klibdcjo.exe
        217⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Kklbop32.exe
        
        C:\Windows\system32\Kklbop32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Kbfjljhf.exe
        
        C:\Windows\system32\Kbfjljhf.exe
        219⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Kdeghfhj.exe
        
        C:\Windows\system32\Kdeghfhj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Khpcid32.exe
        
        C:\Windows\system32\Khpcid32.exe
        221⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Klnkoc32.exe
        
        C:\Windows\system32\Klnkoc32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Knphfklg.exe
        
        C:\Windows\system32\Knphfklg.exe
        223⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Lkchpoka.exe
        
        C:\Windows\system32\Lkchpoka.exe
        224⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Lhgiic32.exe
        
        C:\Windows\system32\Lhgiic32.exe
        225⤵
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Loaafnah.exe
        
        C:\Windows\system32\Loaafnah.exe
        226⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Lhjeoc32.exe
        
        C:\Windows\system32\Lhjeoc32.exe
        227⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Lmeapbpa.exe
        
        C:\Windows\system32\Lmeapbpa.exe
        228⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        229⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Lbbjhini.exe
        
        C:\Windows\system32\Lbbjhini.exe
        230⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ldqfddml.exe
        
        C:\Windows\system32\Ldqfddml.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4552
        
        C:\Windows\SysWOW64\Lilbdcfe.exe
        
        C:\Windows\system32\Lilbdcfe.exe
        232⤵
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Lmhnea32.exe
        
        C:\Windows\system32\Lmhnea32.exe
        233⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Lnikmjdm.exe
        
        C:\Windows\system32\Lnikmjdm.exe
        234⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Lbdgmh32.exe
        
        C:\Windows\system32\Lbdgmh32.exe
        235⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Ldccid32.exe
        
        C:\Windows\system32\Ldccid32.exe
        236⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Amdiei32.exe
        
        C:\Windows\system32\Amdiei32.exe
        237⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        238⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Fnmjkahi.exe
        
        C:\Windows\system32\Fnmjkahi.exe
        239⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Gcgndf32.exe
        
        C:\Windows\system32\Gcgndf32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Imeeohoi.exe
        
        C:\Windows\system32\Imeeohoi.exe
        241⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ipcakd32.exe
        
        C:\Windows\system32\Ipcakd32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3100
        
        C:\Windows\SysWOW64\Igmjhnej.exe
        
        C:\Windows\system32\Igmjhnej.exe
        243⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Imgbdh32.exe
        
        C:\Windows\system32\Imgbdh32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4948
        
        C:\Windows\SysWOW64\Jdajabdc.exe
        
        C:\Windows\system32\Jdajabdc.exe
        245⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Jphkfc32.exe
        
        C:\Windows\system32\Jphkfc32.exe
        246⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Jhocgqjj.exe
        
        C:\Windows\system32\Jhocgqjj.exe
        247⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        248⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jdfcla32.exe
        
        C:\Windows\system32\Jdfcla32.exe
        249⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Jkplilgk.exe
        
        C:\Windows\system32\Jkplilgk.exe
        250⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Jalakeme.exe
        
        C:\Windows\system32\Jalakeme.exe
        251⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Jdkmgali.exe
        
        C:\Windows\system32\Jdkmgali.exe
        252⤵
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        253⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lggeej32.exe
        
        C:\Windows\system32\Lggeej32.exe
        254⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        255⤵
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\Lonnfg32.exe
        
        C:\Windows\system32\Lonnfg32.exe
        256⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Ldkfno32.exe
        
        C:\Windows\system32\Ldkfno32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Lgibjj32.exe
        
        C:\Windows\system32\Lgibjj32.exe
        258⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        259⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Ldnbdnlc.exe
        
        C:\Windows\system32\Ldnbdnlc.exe
        260⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        261⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Lnfgmc32.exe
        
        C:\Windows\system32\Lnfgmc32.exe
        262⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Laacmbkm.exe
        
        C:\Windows\system32\Laacmbkm.exe
        263⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ldpoinjq.exe
        
        C:\Windows\system32\Ldpoinjq.exe
        264⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        265⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Ladpcb32.exe
        
        C:\Windows\system32\Ladpcb32.exe
        266⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ldblon32.exe
        
        C:\Windows\system32\Ldblon32.exe
        267⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        268⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mqimdomb.exe
        
        C:\Windows\system32\Mqimdomb.exe
        269⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4852
        
        C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        271⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Mbhina32.exe
        
        C:\Windows\system32\Mbhina32.exe
        272⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        273⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        274⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Mhenpk32.exe
        
        C:\Windows\system32\Mhenpk32.exe
        275⤵
        Drops file in System32 directory
        
        PID:6212
        
        C:\Windows\SysWOW64\Moofmeal.exe
        
        C:\Windows\system32\Moofmeal.exe
        276⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        277⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Oiojmgcb.exe
        
        C:\Windows\system32\Oiojmgcb.exe
        278⤵
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        279⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        280⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Oiagcg32.exe
        
        C:\Windows\system32\Oiagcg32.exe
        281⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ppkopail.exe
        
        C:\Windows\system32\Ppkopail.exe
        282⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Pbiklmhp.exe
        
        C:\Windows\system32\Pbiklmhp.exe
        283⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Picchg32.exe
        
        C:\Windows\system32\Picchg32.exe
        284⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Phfcdcfg.exe
        
        C:\Windows\system32\Phfcdcfg.exe
        285⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Ppmleagi.exe
        
        C:\Windows\system32\Ppmleagi.exe
        286⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Pblhalfm.exe
        
        C:\Windows\system32\Pblhalfm.exe
        287⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pejdmh32.exe
        
        C:\Windows\system32\Pejdmh32.exe
        288⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Pnbifmla.exe
        
        C:\Windows\system32\Pnbifmla.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Phkmoc32.exe
        
        C:\Windows\system32\Phkmoc32.exe
        290⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Pneelmjo.exe
        
        C:\Windows\system32\Pneelmjo.exe
        291⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        292⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Plifea32.exe
        
        C:\Windows\system32\Plifea32.exe
        293⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Pngbam32.exe
        
        C:\Windows\system32\Pngbam32.exe
        294⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Qlkbka32.exe
        
        C:\Windows\system32\Qlkbka32.exe
        295⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Qbekgknb.exe
        
        C:\Windows\system32\Qbekgknb.exe
        296⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Qiocde32.exe
        
        C:\Windows\system32\Qiocde32.exe
        297⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Qlmopqdc.exe
        
        C:\Windows\system32\Qlmopqdc.exe
        298⤵
        Drops file in System32 directory
        
        PID:1008
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Qajhigcj.exe
        
        C:\Windows\system32\Qajhigcj.exe
        300⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Aiapjecl.exe
        
        C:\Windows\system32\Aiapjecl.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Ahdpea32.exe
        
        C:\Windows\system32\Ahdpea32.exe
        302⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Apkhfo32.exe
        
        C:\Windows\system32\Apkhfo32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5004
        
        C:\Windows\SysWOW64\Abjdbj32.exe
        
        C:\Windows\system32\Abjdbj32.exe
        304⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        305⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Apndloif.exe
        
        C:\Windows\system32\Apndloif.exe
        306⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        307⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Aaoadg32.exe
        
        C:\Windows\system32\Aaoadg32.exe
        308⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        309⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Aemjjeek.exe
        
        C:\Windows\system32\Aemjjeek.exe
        310⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Algbfo32.exe
        
        C:\Windows\system32\Algbfo32.exe
        311⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Abqjci32.exe
        
        C:\Windows\system32\Abqjci32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2836
        
        C:\Windows\SysWOW64\Aeofoe32.exe
        
        C:\Windows\system32\Aeofoe32.exe
        313⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Aikbpckb.exe
        
        C:\Windows\system32\Aikbpckb.exe
        314⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        315⤵
        Drops file in System32 directory
        
        PID:832
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        316⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Bimoecio.exe
        
        C:\Windows\system32\Bimoecio.exe
        317⤵
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Blkkaohc.exe
        
        C:\Windows\system32\Blkkaohc.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4836
        
        C:\Windows\SysWOW64\Bpggbm32.exe
        
        C:\Windows\system32\Bpggbm32.exe
        319⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Bbecnipp.exe
        
        C:\Windows\system32\Bbecnipp.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5112
        
        C:\Windows\SysWOW64\Biolkc32.exe
        
        C:\Windows\system32\Biolkc32.exe
        321⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Blnhgn32.exe
        
        C:\Windows\system32\Blnhgn32.exe
        322⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bbhqdhnm.exe
        
        C:\Windows\system32\Bbhqdhnm.exe
        323⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Befmpdmq.exe
        
        C:\Windows\system32\Befmpdmq.exe
        324⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Biaiqb32.exe
        
        C:\Windows\system32\Biaiqb32.exe
        325⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Blpemn32.exe
        
        C:\Windows\system32\Blpemn32.exe
        326⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        327⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Behiec32.exe
        
        C:\Windows\system32\Behiec32.exe
        328⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bhgeao32.exe
        
        C:\Windows\system32\Bhgeao32.exe
        329⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bpnncl32.exe
        
        C:\Windows\system32\Bpnncl32.exe
        330⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Bbljoh32.exe
        
        C:\Windows\system32\Bbljoh32.exe
        331⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Bekfkc32.exe
        
        C:\Windows\system32\Bekfkc32.exe
        332⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        333⤵
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Ceppfbef.exe
        
        C:\Windows\system32\Ceppfbef.exe
        334⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        335⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        336⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        337⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Nqfbkf32.exe
        
        C:\Windows\system32\Nqfbkf32.exe
        338⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Ncenga32.exe
        
        C:\Windows\system32\Ncenga32.exe
        339⤵
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        340⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Nqioqf32.exe
        
        C:\Windows\system32\Nqioqf32.exe
        341⤵
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        342⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Ngbgmpcq.exe
        
        C:\Windows\system32\Ngbgmpcq.exe
        343⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Njacikbd.exe
        
        C:\Windows\system32\Njacikbd.exe
        344⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        345⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        346⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        347⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Nnolojhk.exe
        
        C:\Windows\system32\Nnolojhk.exe
        348⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        349⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        350⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        351⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        352⤵
        Drops file in System32 directory
        
        PID:3376
        
        C:\Windows\SysWOW64\Ojhijjll.exe
        
        C:\Windows\system32\Ojhijjll.exe
        353⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Oboakhmo.exe
        
        C:\Windows\system32\Oboakhmo.exe
        354⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        355⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Ojjfpjjj.exe
        
        C:\Windows\system32\Ojjfpjjj.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        357⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Odpjmcjp.exe
        
        C:\Windows\system32\Odpjmcjp.exe
        358⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        359⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        360⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        361⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Odbgbb32.exe
        
        C:\Windows\system32\Odbgbb32.exe
        362⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Ogqcon32.exe
        
        C:\Windows\system32\Ogqcon32.exe
        363⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Onklkhnn.exe
        
        C:\Windows\system32\Onklkhnn.exe
        364⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Blakhgoo.exe
        
        C:\Windows\system32\Blakhgoo.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Bdmpljlj.exe
        
        C:\Windows\system32\Bdmpljlj.exe
        367⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Cobciblp.exe
        
        C:\Windows\system32\Cobciblp.exe
        368⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        369⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        371⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Cddemi32.exe
        
        C:\Windows\system32\Cddemi32.exe
        372⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        373⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        374⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Chbncg32.exe
        
        C:\Windows\system32\Chbncg32.exe
        375⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Colfpace.exe
        
        C:\Windows\system32\Colfpace.exe
        376⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Cefolk32.exe
        
        C:\Windows\system32\Cefolk32.exe
        377⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Dlpgiebo.exe
        
        C:\Windows\system32\Dlpgiebo.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Dkbgeb32.exe
        
        C:\Windows\system32\Dkbgeb32.exe
        379⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Dampal32.exe
        
        C:\Windows\system32\Dampal32.exe
        380⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Doqpkq32.exe
        
        C:\Windows\system32\Doqpkq32.exe
        381⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Dejhgkgm.exe
        
        C:\Windows\system32\Dejhgkgm.exe
        382⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Dhidcffq.exe
        
        C:\Windows\system32\Dhidcffq.exe
        383⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Dkgqpaed.exe
        
        C:\Windows\system32\Dkgqpaed.exe
        384⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Dboiaoff.exe
        
        C:\Windows\system32\Dboiaoff.exe
        385⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Ddpeigle.exe
        
        C:\Windows\system32\Ddpeigle.exe
        386⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Dkjmea32.exe
        
        C:\Windows\system32\Dkjmea32.exe
        387⤵
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        388⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Deoabj32.exe
        
        C:\Windows\system32\Deoabj32.exe
        389⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        390⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Echkgnnl.exe
        
        C:\Windows\system32\Echkgnnl.exe
        391⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        392⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        393⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Lemagjjj.exe
        
        C:\Windows\system32\Lemagjjj.exe
        394⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        395⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        396⤵
        Drops file in System32 directory
        
        PID:8096
        
        C:\Windows\SysWOW64\Mikjmhaq.exe
        
        C:\Windows\system32\Mikjmhaq.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        398⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Mpebjb32.exe
        
        C:\Windows\system32\Mpebjb32.exe
        399⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        400⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mmiccf32.exe
        
        C:\Windows\system32\Mmiccf32.exe
        401⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Mgagll32.exe
        
        C:\Windows\system32\Mgagll32.exe
        402⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7360
        
        C:\Windows\SysWOW64\Mgfqgkib.exe
        
        C:\Windows\system32\Mgfqgkib.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Midmcgif.exe
        
        C:\Windows\system32\Midmcgif.exe
        405⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        406⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Meknhh32.exe
        
        C:\Windows\system32\Meknhh32.exe
        408⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        409⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        410⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        411⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        413⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Npcokpln.exe
        
        C:\Windows\system32\Npcokpln.exe
        414⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Ndokko32.exe
        
        C:\Windows\system32\Ndokko32.exe
        415⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        417⤵
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Ndagao32.exe
        
        C:\Windows\system32\Ndagao32.exe
        418⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        419⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Nebdighb.exe
        
        C:\Windows\system32\Nebdighb.exe
        420⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        421⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Nphhfp32.exe
        
        C:\Windows\system32\Nphhfp32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Ncfdbk32.exe
        
        C:\Windows\system32\Ncfdbk32.exe
        423⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        424⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        425⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        426⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Npjelo32.exe
        
        C:\Windows\system32\Npjelo32.exe
        427⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ofgmdf32.exe
        
        C:\Windows\system32\Ofgmdf32.exe
        428⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ogifci32.exe
        
        C:\Windows\system32\Ogifci32.exe
        429⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        430⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        431⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        432⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        433⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ofncde32.exe
        
        C:\Windows\system32\Ofncde32.exe
        434⤵
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Onekeb32.exe
        
        C:\Windows\system32\Onekeb32.exe
        435⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        436⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        437⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ojllkcdk.exe
        
        C:\Windows\system32\Ojllkcdk.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4468
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        439⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Pnlafaio.exe
        
        C:\Windows\system32\Pnlafaio.exe
        440⤵
        Drops file in System32 directory
        
        PID:7612
        
        C:\Windows\SysWOW64\Pqknbmhc.exe
        
        C:\Windows\system32\Pqknbmhc.exe
        441⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        442⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Pjcbkbnc.exe
        
        C:\Windows\system32\Pjcbkbnc.exe
        443⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        444⤵
        Drops file in System32 directory
        
        PID:4188
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        445⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        446⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        447⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1112
        
        C:\Windows\SysWOW64\Pncggqbg.exe
        
        C:\Windows\system32\Pncggqbg.exe
        449⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        450⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        451⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Qgllpf32.exe
        
        C:\Windows\system32\Qgllpf32.exe
        452⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        453⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Qqdqilph.exe
        
        C:\Windows\system32\Qqdqilph.exe
        454⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Qjmeaafi.exe
        
        C:\Windows\system32\Qjmeaafi.exe
        455⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Qmkanmel.exe
        
        C:\Windows\system32\Qmkanmel.exe
        456⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Adbiojfo.exe
        
        C:\Windows\system32\Adbiojfo.exe
        457⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Aceijg32.exe
        
        C:\Windows\system32\Aceijg32.exe
        458⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Agqekeeb.exe
        
        C:\Windows\system32\Agqekeeb.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Anjngp32.exe
        
        C:\Windows\system32\Anjngp32.exe
        460⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Aedfdjdl.exe
        
        C:\Windows\system32\Aedfdjdl.exe
        461⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Acgfpf32.exe
        
        C:\Windows\system32\Acgfpf32.exe
        462⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ajanmqbc.exe
        
        C:\Windows\system32\Ajanmqbc.exe
        463⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Anmjmojl.exe
        
        C:\Windows\system32\Anmjmojl.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Aqkgikip.exe
        
        C:\Windows\system32\Aqkgikip.exe
        465⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Acicefid.exe
        
        C:\Windows\system32\Acicefid.exe
        466⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ageofe32.exe
        
        C:\Windows\system32\Ageofe32.exe
        467⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Aancojgn.exe
        
        C:\Windows\system32\Aancojgn.exe
        468⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Aclpkffa.exe
        
        C:\Windows\system32\Aclpkffa.exe
        469⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Afjlgafe.exe
        
        C:\Windows\system32\Afjlgafe.exe
        470⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        471⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Aekleind.exe
        
        C:\Windows\system32\Aekleind.exe
        472⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Agjhadmh.exe
        
        C:\Windows\system32\Agjhadmh.exe
        473⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        474⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Amfqikko.exe
        
        C:\Windows\system32\Amfqikko.exe
        475⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Babmjj32.exe
        
        C:\Windows\system32\Babmjj32.exe
        476⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Benijhla.exe
        
        C:\Windows\system32\Benijhla.exe
        477⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Bglefdke.exe
        
        C:\Windows\system32\Bglefdke.exe
        478⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Bfoebq32.exe
        
        C:\Windows\system32\Bfoebq32.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Bnfmcn32.exe
        
        C:\Windows\system32\Bnfmcn32.exe
        480⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Badipiae.exe
        
        C:\Windows\system32\Badipiae.exe
        481⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Bfabhppm.exe
        
        C:\Windows\system32\Bfabhppm.exe
        482⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bnhjinpo.exe
        
        C:\Windows\system32\Bnhjinpo.exe
        483⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Bebbeh32.exe
        
        C:\Windows\system32\Bebbeh32.exe
        484⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Bganac32.exe
        
        C:\Windows\system32\Bganac32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Bmngjj32.exe
        
        C:\Windows\system32\Bmngjj32.exe
        486⤵
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Mpdkol32.exe
        
        C:\Windows\system32\Mpdkol32.exe
        487⤵
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Bpkllo32.exe
        
        C:\Windows\system32\Bpkllo32.exe
        488⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Diicfa32.exe
        
        C:\Windows\system32\Diicfa32.exe
        489⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Obafim32.exe
        
        C:\Windows\system32\Obafim32.exe
        490⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        491⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Bjlpcbqo.exe
        
        C:\Windows\system32\Bjlpcbqo.exe
        492⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        493⤵
        Modifies registry class
        
        PID:1416
        
        C:\Windows\SysWOW64\Bohiliof.exe
        
        C:\Windows\system32\Bohiliof.exe
        494⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Fjmkhkff.exe
        
        C:\Windows\system32\Fjmkhkff.exe
        495⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Kkbohc32.exe
        
        C:\Windows\system32\Kkbohc32.exe
        496⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Lgccccec.exe
        
        C:\Windows\system32\Lgccccec.exe
        497⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Ldgclgcl.exe
        
        C:\Windows\system32\Ldgclgcl.exe
        498⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Leipbg32.exe
        
        C:\Windows\system32\Leipbg32.exe
        499⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Lgglnb32.exe
        
        C:\Windows\system32\Lgglnb32.exe
        500⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ljfhjn32.exe
        
        C:\Windows\system32\Ljfhjn32.exe
        501⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        502⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        503⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Mabnlh32.exe
        
        C:\Windows\system32\Mabnlh32.exe
        504⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Mglfibmh.exe
        
        C:\Windows\system32\Mglfibmh.exe
        505⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Mjkbemll.exe
        
        C:\Windows\system32\Mjkbemll.exe
        506⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Mepfbflb.exe
        
        C:\Windows\system32\Mepfbflb.exe
        507⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Mmkkgh32.exe
        
        C:\Windows\system32\Mmkkgh32.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Mnkgakpp.exe
        
        C:\Windows\system32\Mnkgakpp.exe
        509⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Meepne32.exe
        
        C:\Windows\system32\Meepne32.exe
        510⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Neglceej.exe
        
        C:\Windows\system32\Neglceej.exe
        511⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Njdeklca.exe
        
        C:\Windows\system32\Njdeklca.exe
        512⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Nmbaggce.exe
        
        C:\Windows\system32\Nmbaggce.exe
        513⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Neiiiecg.exe
        
        C:\Windows\system32\Neiiiecg.exe
        514⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Nhheepbk.exe
        
        C:\Windows\system32\Nhheepbk.exe
        515⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Nnbnaj32.exe
        
        C:\Windows\system32\Nnbnaj32.exe
        516⤵
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Nabfcegi.exe
        
        C:\Windows\system32\Nabfcegi.exe
        517⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2288
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        519⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        520⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Ohhnln32.exe
        
        C:\Windows\system32\Ohhnln32.exe
        521⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Flkdpnjl.exe
        
        C:\Windows\system32\Flkdpnjl.exe
        522⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hpiemj32.exe
        
        C:\Windows\system32\Hpiemj32.exe
        523⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Hfcnicjl.exe
        
        C:\Windows\system32\Hfcnicjl.exe
        524⤵
        Modifies registry class
        
        PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcja32.exe

Filesize
55KB

MD5
867a090c81611aa178d179b37eca7c5b

SHA1
8ed9eaf285894fc36272384f5d88ca3d542b0c0e

SHA256
17a9d23e1b799f7bdd0b64fbe87f3eb12b14e4984ad876b2dc5c4a1d27793854

SHA512
975f807409c74ff416fb60a50a1b63f6d7f60754b1073588114faf164abbd631fb09fc1453531f5dccfc947fde0d3f5b94a84bec9b697c1a135a91ceca73177f

Download Submit
C:\Windows\SysWOW64\Acaanp32.exe

Filesize
55KB

MD5
839e4ee1a0f1fa5e4880ac606423dc31

SHA1
1b5320dadd196944387e0c00860c28f3bae74295

SHA256
13b5afce30585b3eb20ffa3a17c46b2f63c46c32c07bd3b60b84cce57044aeaf

SHA512
9e3bd110c8214d720731d0c3362ad9ceef9d12a1c8c70342e3e028cb8841a3351597b38999a30ec3e0332192b9f3b82cf00a3c1b471968b441be2d7af63f6800

Download Submit
C:\Windows\SysWOW64\Ampaho32.exe

Filesize
55KB

MD5
4c5981bd219ee277698ddf42c2005574

SHA1
8edc73b570fb16d4811105defa47397189985325

SHA256
4bdbdea4c7d2cd2ae8882ec4ead6e296f13f050f7fc9b43a692374d5b55e86ac

SHA512
3a0f39d99e005e1cd150cce7f6485567f566a26aaffc33da40200cbd80f70c24dd5d2d353876eab4711f0989ce2c630317676ee2e884a4cefbc8ad5e19a75de5

Download Submit
C:\Windows\SysWOW64\Bcahmb32.exe

Filesize
55KB

MD5
c132cf09ae23a02a3cf667bd5a362259

SHA1
8a72263abf046345f3f2b8dfe00e5a835a984947

SHA256
5d12bc3ad1070e3cf01a764c5c9b35a84d349df9a90b9b03ccb6d0ca432dce08

SHA512
59d830a3bc0d7082a4b650169e957d6935faf599ecb8bddb15bc3fa6c670f7fca72c081b6ea618094ad7f5486ca199a784b64b539bb72e089db12410338e4843

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
55KB

MD5
aa5b30a84536cc3fd5ba89d6ac495f3b

SHA1
dfd574ae363c6e1fb201bc3dc12001bbf43967d0

SHA256
0d181f1d94ad8efe4430e33841c8b05aa2d37d2a7a8ba2c7e0352e135cb0f4bf

SHA512
786e25553038d50e230825f6cb28637654aca41891b240365cbbc574200be87101ec461fc974640bfda87bea6edb89bf6096007b0aa7dbc1575e5309fff755b5

Download Submit
C:\Windows\SysWOW64\Bfhofnpp.exe

Filesize
55KB

MD5
a72395ba0a884f81837af70404481822

SHA1
cd71b8a0ee76e2ee079d652436d96c5d285c9cac

SHA256
5f5c64b9e2dcc8b5ee39c364b253904df72f04b4fa6f2ef1470787a1f9e8bed0

SHA512
cc7489b12625e4f8cf806866591f117de136a4e929384b79b6bda4696d5c3a35bdcad110f32671e47f0363ab1495a51105e83d99ae3711432abed11d9867f58a

Download Submit
C:\Windows\SysWOW64\Bombmcec.exe

Filesize
55KB

MD5
0039e6ec79e069401db05d370c4557f0

SHA1
64b68d690475bc0f5ee59d05b9c231aa397bb906

SHA256
b1ec929091a332d32cdaaa93a51d58f8f334d5dca9c10469833b0d7477c4b01f

SHA512
8997ea6fba2367086144f8062911a542ca317784a47a2e68b06e7ba632097894ba1abbda46e9ab392ec3e0f0b408c53f516b186a88ca5cb32bf7e9ce6b5ce190

Download Submit
C:\Windows\SysWOW64\Bqdechnf.exe

Filesize
55KB

MD5
b58177f743b303f8c0c02a7ad0b65b23

SHA1
d50c88d585f54c367808f39ebff56ce2247dbc0a

SHA256
a07eb1f23ffde7aaea34e055997c192386c9a0d13ee2bbc0f6616ef00c6770a4

SHA512
915a2cd172e06ee527444bd508962a60724af8738f96d9b493204589cd54b3b7a9837ba1239619b41ddab7d7ea389a1718d603015d1fcd17f7c0cd88ab43e1b0

Download Submit
C:\Windows\SysWOW64\Cancekeo.exe

Filesize
55KB

MD5
b25e8ad6fee7d1aa87922a723c02dca4

SHA1
c890f088ad40cdf0780eb5d6d4f11356b1ff5701

SHA256
58db4441428cc606e916c1d8c968074bf7fc1155e43d75ca32c6c6a5843db39a

SHA512
eadba63ff72cd5ef1991d7601f6739139a54d30a55d5fa4d287f09a01c9ef950f5c0a228cce079803da18316897a54442c290950439fcf914a5c6646237c785c

Download Submit
C:\Windows\SysWOW64\Cgqlcg32.exe

Filesize
55KB

MD5
70342f2315f1d8ffb4fd3f3cac208991

SHA1
2ddddf7ae5c1f937c74e008234184f4826aa9d67

SHA256
73e4ecc7ce722c8c4273f24bd11d6ccfacaa5712368ede614528c75eae5c6f5e

SHA512
573c0e6bb8aeb5ac8e36775bf91b82dea8d4e09da475bef043d11c1e70d2db1cf4eea8eb06d6f36d5a523b435c24502ce8db9afe60ab4d5a19390cf965d17b90

Download Submit
C:\Windows\SysWOW64\Cihclh32.exe

Filesize
55KB

MD5
c0d8f18cbd711e6a689e4da0b9e43cbf

SHA1
e1e7740231fc82e6acc5891ae5426c0722069938

SHA256
f4cb3b95d1786648b698a94d903125a80a71ac06309f75daad06707679018a72

SHA512
8af37363f35dec3955d094cca3e0b726c65de8ed0c226156795d4320c8d85e25e6f522dd33e27f842acc2c6786e60b52599727e01ebe23f652458dbb920ff5e4

Download Submit
C:\Windows\SysWOW64\Cijpahho.exe

Filesize
55KB

MD5
015e10331d9d44cd947e6445cdd5d3bc

SHA1
7b486b9fb4892c863f13262d803a0b216e3676d0

SHA256
afc2516244b00d0c1137af025db6a44d2514462d803a23a2f9461bd9e4c4d613

SHA512
4bea6216b1939f52d6cd6719752a784cd077234490b77178dc4167f5391e798b2140857749c0a68d9e3054dcc649514050bbdaa4439b22f7478af750f992e951

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
55KB

MD5
946799b1d4f782f9973096b7623b23ac

SHA1
79bc406b62a29371394dc6a9b9951d3c6dd10b74

SHA256
7743d36548ae29b9b1c331285bae423792f6e9d1924ac6039b262096109dbea0

SHA512
9cc815618968b67a3c51cd4e820ff664ad0044a336c1af40c164f9ff96744aefa1af9484e5916e814e27ec37607a2d854d47e5d3b428bb3df723ff6fe26fb790

Download Submit
C:\Windows\SysWOW64\Diicfa32.exe

Filesize
55KB

MD5
13c08ccf454860753af3b32cb1d64b03

SHA1
f329afa729344318e834a00f84587e44ce31f2db

SHA256
f8966d3d0d35b4e0a69c8a06a16549342227f85efaf6709ae46e021b54faa83d

SHA512
6c12ef6ff887e9f39e64a39248b96eb1084d6fcdbb9f2e85980b9a8b307e1d786f19de8316f6bceefc5bfb918b72ad878a2d020d6537a7156ba8a250342aede4

Download Submit
C:\Windows\SysWOW64\Djmbbk32.exe

Filesize
55KB

MD5
89e5b26132e75b2b295bd4a8b7c37b1d

SHA1
55e971aa8cc3145794f20de6ebc1e7a130634d3c

SHA256
7f1477574eb833f268cc835de54d8d23a89d5f86872d787660cc7c63e781cd31

SHA512
e880a8b34322912c20d583adbeb5db7a7b4f0ee19ae536cfc8b07262313937aa8711649d9f3605b797b296d2f312984b67150e9eb467230ff013126031f2340e

Download Submit
C:\Windows\SysWOW64\Egelgoah.exe

Filesize
55KB

MD5
b9fbd4c23d316502eaced68618b98578

SHA1
c02f648c6b947b4e62c6f08f92582358c4c6bdd8

SHA256
ce779cc3626a631719dddd7eafd4bf566532234e4d1d37f064bff4e788ee582a

SHA512
c32f2d4674ea8e06a1baca48decca7daff756ddd020b9e83b4a8c957171ab6b435354ba1ed8aea2697996d58fd9b0bab2d29051d958b2796c9bb65794f94f524

Download Submit
C:\Windows\SysWOW64\Hfcnicjl.exe

Filesize
55KB

MD5
1d0b197e1dda1b92f84f8cd2006285dc

SHA1
15c650dd22c97901dbb741f3b7716420fd1d34a1

SHA256
59c9bbbf483664aa5625619fcdfd1b03da43e68bd24a94eba3e72e846ea5de6d

SHA512
7244415d880420e1754246afc90d26443f35ea2a75fbe6dc843ef8c855675503cbe9497778baf7587404ab07713f9d8a69c6c40044ee43caff898c10e6287160

Download Submit
C:\Windows\SysWOW64\Hlogfd32.exe

Filesize
55KB

MD5
dc0132d9cef387f268890224b99209b3

SHA1
531f56167e0679d7d8ffe8f96b3785f2e0292c1c

SHA256
3046053815e52a2df3c6739fbfd4f8819ed90b6e30fb8c14736f480f48ef15c9

SHA512
c4c3d5677859cc28a3d6683c778392fa42560ced63cc91f9f572712e582dba7f1c949766747cf7a6c38107ad0ec04542b2355f3ceede041d17aa6bd754847be0

Download Submit
C:\Windows\SysWOW64\Jdajabdc.exe

Filesize
55KB

MD5
c732709940786b4f0a7af21d57527977

SHA1
be0e939c60e702ce5f05ef80e8d505db5b46500c

SHA256
ee410bcf269b8add7c0e43f9db428b7b872edfe4e82a889c0cce57b5fd494191

SHA512
5d0a4576e65212a07a8c1d3986c9e5259be95150562849a00650ca9b6c7478eccf3f9f720f61f890b51d9ba366eff71ec9be8977d972055fc08f716f404d058f

Download Submit
C:\Windows\SysWOW64\Knphfklg.exe

Filesize
55KB

MD5
e22e1cba9826c611dd3a0fb62851498a

SHA1
3b3894f53555f5609d07747583048ac2613d083e

SHA256
93166e542b8ffc040d4e11622d895748093c86c67e087b05f5132aa62a132fa3

SHA512
1f0bb8d1dbde485d278b24532a2aa96726751692e2729f0253bf41eeaec244f2af3c52f2aa36b0b01d5e70c23cbf55a118785b77b76a1bdf26460de756464a9a

Download Submit
C:\Windows\SysWOW64\Kpanmb32.exe

Filesize
55KB

MD5
8db222c4a41bd5f720994b7b4b702c9f

SHA1
361d129907a67ee638a46038d51999f3203ad18a

SHA256
0748b0480922384fed46a6c5f5d1a02c4f6bdc628122f35669a1ab695041e478

SHA512
eabd833c5a26188df0cbd4b4160965f2e4fb732c03f589757ecbbfcfeeca130fb219f3f7e174c3d57121435a817df368efb0f8eb9fb0e066da33d7be9f72a5f6

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
55KB

MD5
d24d1cac13383899f3873afcd9f03d11

SHA1
6fea37f94fe5e01cdf15f6c4babfb8209f0bcc57

SHA256
8567e3d796cf1332853253466d9252bcc64c00a1df746f3e3a4604b1ff01ee2e

SHA512
98a31611f6dd7c415073027f49c08804777b1cc448eb5c3dda5f617b1bbf1cbee230957056b8cf35671fe527ac438c4e6340222699c34f4460b108231d33f04d

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
55KB

MD5
7a28a3c6d2eb0838dc5fa8ba789efd05

SHA1
2ade3acde7e6f810dda15f57139ec6f1c9411ce4

SHA256
6762a99708c7a56b682cc6c634ea910677a02c74006872203a5dfb9e2fcd384d

SHA512
38771e75661c99b6198acc5024cfe3ff92f72e2911ca10bdbd927c3a01076932d049aa282a5e949f3d2fa4d2a55c9c577406a5276b1aadf2f586d836a891d198

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
55KB

MD5
1a0e8031ebaf50af7b93b01ac806eed4

SHA1
7ec9aa06d0b327a4e75db09cef3117a0c30b0c74

SHA256
b0a131dc1e9c82866eed94a7bb72342bd82e532094c35bcd4cdc1ccd42416142

SHA512
b38fe935a7d0c7178fd7e316e669ca43189269abca9aee748679edfd99b81f3dc726e565e60f5b200c7d0792dbf999d6bfa52152b856ca14615917259644a765

Download Submit
C:\Windows\SysWOW64\Maodigil.exe

Filesize
55KB

MD5
981842100d8a24af4b67d789b72ac14e

SHA1
14cba6008bcdfc10ff2831a350c3f4d3d5887be9

SHA256
477b1acce863b8198e10e31b36fc92fb2ef24ee212aa425a4eb50be43d8d87f8

SHA512
f9a2a4e3388b3211d438ffebcd14dbff78da1d6d089201c563f4e08c61c695438c7139204ca0973be6d2b4fad5f72711ae47bcab232a45a01e86c0087543fb5e

Download Submit
C:\Windows\SysWOW64\Mbgjbkfg.exe

Filesize
55KB

MD5
3662ca6498cd2926a97cd6c7a4ce43b6

SHA1
c59c526855f716f344cdb5ba1328c0dd2c45e0f1

SHA256
1949b34929427ad8768b937f18e32b4cea5b9f27294fa0d621d9a30b6ea3e9fb

SHA512
b86c0bb57d9d2d850299499c0c8a7981d734a3906645e52a6302c76d669fad643dbbdcf2257541fb44dcbdf8a537b99a4c6e183277cdf984e1ac1bd55990dcc8

Download Submit
C:\Windows\SysWOW64\Meamcg32.exe

Filesize
55KB

MD5
5a896fa9ea146b86a9c61f382a00e805

SHA1
21108b060e3ad8eae2bbe2dde47c319b153165d7

SHA256
1a46de3ae0059c1b2f99bbbe68912b660b2867eab8197f14ecc94b995f6c245c

SHA512
fc7a97065788685fa99d97c29b95c2fdf1fff1c07c49a182101614f5ad59604374cdb8ef763c7490dcd86486171b0e45ebc47859f82824259b05ae69bf96696b

Download Submit
C:\Windows\SysWOW64\Meefofek.exe

Filesize
55KB

MD5
ba5e5986f4acce695c154617374df5b0

SHA1
28802f82ecefd2bfe7bf668401d72cedc29b85de

SHA256
ec3208ca6dc62add2dafec115a289052c25c98b1d856cf1b9740fd701a79d0cc

SHA512
53b914f0ec5c978847b0bb759feefdd1e2974918fe6b534e8c7866d7a380e02958934419961e1e263424d98f372e9ca554414d1329a7e1f6168244a7909935ac

Download Submit
C:\Windows\SysWOW64\Mhenpk32.exe

Filesize
55KB

MD5
532478bb14cdaf7fa4ccd191034cfcf2

SHA1
880729796452fefc22a23952a91b311d9c962113

SHA256
6ecbf5a300e150b01842b195ee6d7fc1a21e26ff47a60305fa9eed3c78c2ac43

SHA512
739a53a8cacac57dcdad515fd3f60c5028d8f70338ef061a01d9469bf4e0ac3c9f9779f5182d6c9a319c9f081bb1176f292a510bd8ca878c87fe18cab64aebdc

Download Submit
C:\Windows\SysWOW64\Miofjepg.exe

Filesize
55KB

MD5
bdc8e7ac5184471724203be2169667eb

SHA1
ed1748a3a90e498d92f2fca4ea0a7bda56673287

SHA256
b7e4de7cd847650236cddbd88fca9bc5792b0c8b469640fcfbfebea5ba373a6f

SHA512
114d58fb7a416940b7631e9b986764b7bd26c856ca238843ba614206d449db3cc90f3f359d0c51fa9f0d280fe649f1b1b108a4dbd58d597712337b0e790e4983

Download Submit
C:\Windows\SysWOW64\Mjbogmdb.exe

Filesize
55KB

MD5
758c96013e9fcfac6d3ffbfeca98a142

SHA1
8f5063cb5f42e469967320ced89712fdb6e8aed3

SHA256
26fa10f2e9f563381d9c030769b326a295768141adc3bdeac755ae658b40b171

SHA512
16a980626c9934a3c635cb166cd5d52d36183b20bc23f3a7798f4c0bf7d9e02c7edd5d760246560022f959cc9631e431b5e2398adea075bb79452affbd17862f

Download Submit
C:\Windows\SysWOW64\Mlbkap32.exe

Filesize
55KB

MD5
f558936a685df48fcc8686fde502c1ab

SHA1
251819c11c1baee236f410b2f7789f526b2924a0

SHA256
d7d591fdd00decc1b82c212dd12e11fea4fcbc743f8b9e9227050e48187a0cc3

SHA512
797277b81a1da213a89ab04ab7deaee67db25c7da7f380c509f6fb7af7ed4fadb7b4943d5227d5a3f184f46bb924b7f6fe49caa98846736accd9a016c72c6ad2

Download Submit
C:\Windows\SysWOW64\Mlkepaam.exe

Filesize
55KB

MD5
12c2dd8f9d6baf55f63af60b4db28d33

SHA1
22286288d428a041c4281f6d36c32e3acc7b4405

SHA256
43c6f82fb4a71f517350c729defdb9bcfe3a849892f17c0ca49faa9451a87077

SHA512
af0058be2ed943504d99f4075df9d58572802b189bd262e75cd9a7eb22d39345e5629ae0faeea2d40c601219fd42e3487768971c428f0dea9e0d7674937b456f

Download Submit
C:\Windows\SysWOW64\Nemchn32.exe

Filesize
55KB

MD5
dddb7981007091060e49583640c1c298

SHA1
a9c590cdb4b4b52900d41529d9884b53c5820c24

SHA256
90bc5658e5d7e62fa2afe011b935e5093c1eed3c1bdd4c9e8c267a50e41c6012

SHA512
b3e7964deb1910a3b29017e5282fe5c4ac5eddca47d822d23da3cc9717def1c5f4b97a47c158502e25ce919a105f03150a496440a9d2f9d74d326301b907c30c

Download Submit
C:\Windows\SysWOW64\Nobdbkhf.exe

Filesize
55KB

MD5
aa611c28969a013ae1a83108dd9d842f

SHA1
fa2fb3e3edfd1f8c56c03035ca5e296e362b67d7

SHA256
237edb32485849898d6b9cf6973c03645f0b6fe8e119c0ef7dccfdd7c122e909

SHA512
9fb5cb6cac3eeca35913b0200579a3c8c55b3d1fcfcbf34f30c9809fc0556f17a1e7ddf587eded0b3e48f319e74358d1b2d5773c8b2af6cb4dc4cad56aef6148

Download Submit
C:\Windows\SysWOW64\Obafpg32.exe

Filesize
55KB

MD5
10144a57f66c15443536fbc185803f8d

SHA1
6ced2b503f9b5ed91a31e44d0a19a1c62bdb5afe

SHA256
33ccc100ced35b123d3b924c092aad17b23301ad8dc1725194d5fe63b7201adc

SHA512
89c83a82e3e029456f2b32375e1080d61dab895ddf73befec6a3224ee7574934f89a5c585ed73a36aaa5ca4867e2e66ae876fcbbfbae7d62248703ef2ec1f53e

Download Submit
C:\Windows\SysWOW64\Objpoh32.exe

Filesize
55KB

MD5
3f3bb2771c3db89208b9e3e2ffb51979

SHA1
7bb892826b3fb8a825611fd53eedaf2149e6db3c

SHA256
24b3c4081ee566e7be39b6a064534cb2da4533eb4c80156d7461698b0e7a04bb

SHA512
595f1793426bf4db91cb8d3715b197f220a63353a07fdfeacb8f97f9a29f62e9e4c2381ca116fde8860c801f70fd08b9ab4eec6130d96e3eedbb933f598f057b

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
55KB

MD5
6576a60c96073f35ff08aea8ff57347f

SHA1
ed253099db3d90b08d35a3c80d9d9302d5a28aa7

SHA256
e17cccd366f0855391792327530fe89fd55a768a2f8a8835287b65455568ea17

SHA512
e4ef0418c16ee0062d5e9b2a4845d4f0989418821c3114a06bfbbe2da0fcaf205c2e5c88e7d849ba5447d6f1fc5403d66c9e2b8bc64bdcf2655554421d611176

Download Submit
C:\Windows\SysWOW64\Oboijgbl.exe

Filesize
55KB

MD5
a9cffcb131132baa561952ead5656610

SHA1
7781bc6c0b96631d32c7ae448d40031671956f4f

SHA256
d99d0b7c7a89ec1d0b89dd6b4425b5959b94e58ce789ebce791063f700596a0d

SHA512
30e855990f09970c838476e1fe616798fbe895d6eb9974c4b654c57bbb05258641a1e7293978af6d8e2f44cfd27f744569fd0075cc96d18e82a4a6a4eb5e4d9a

Download Submit
C:\Windows\SysWOW64\Ogjmnomi.exe

Filesize
55KB

MD5
ee437e24474249d151be9c68423d5977

SHA1
4bf6b291a8b41bdc3ce6de5ce2e7d9386796557c

SHA256
7b27ece4a06225c6eb566f2e06290444f9e525a45028eb396dc8efa9907fe8f1

SHA512
af466f944ff3d64d12f0b123e07edd5d290a82549fa200101888fc72c6fd68544c24936de837a7de4f2f41ef7ad73ac05fed7d689fcdb5462550203f225496b8

Download Submit
C:\Windows\SysWOW64\Ohiemobf.exe

Filesize
55KB

MD5
cc1b771efbf3924069171b856e37b7a0

SHA1
4a083a673fb6bf158f380b7dbd7775a7e01cb796

SHA256
67bf90c274a720d84b7d6c01b2774f8aa7c58004c4f52f5cee6122f0fa42c8d9

SHA512
6fa0e34ff9048e4f6989d396ab1245a31d0a0f93598364028627e3eacc6ba94fe4b0dab9922135688a9dc938b96f013d0a4e2285cc7337d09051510cb3c5a0f6

Download Submit
C:\Windows\SysWOW64\Ohkbbn32.exe

Filesize
55KB

MD5
a13f186c5763b28851e1ecc198de3998

SHA1
fd195cde20713b159ab7da5bb559a155c6f4f09b

SHA256
1ee34a6e2e2c9dfc4409e128e4d68370c2d16341c33e564696bd5a446cb2e7e9

SHA512
eee4658a52100ce42b5d609cdbd55c66f5618000feb5bcceef0df14c9cba8fafcb83512093eeb91e449716495f3b2367511a56218683759656ff93a17f78df2a

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
55KB

MD5
f7390098492ee14542dd7bce252c2b5b

SHA1
f982a1b3665933e9029a1eef772c783f5376b64e

SHA256
08fbeecebfe85b83bf5620782122893c32f3ca18dcb0d66de9e11eca9efd62e8

SHA512
acf918839d5e61f4e2539df09cedd42f3a702095fd6ffb31c1bef88315f7636a450b87ee2f31d1f61a1a6097db4ec531520ad452e9ab10607f354582a7116ee8

Download Submit
C:\Windows\SysWOW64\Olbdhn32.exe

Filesize
55KB

MD5
8d899e4f62bfedf8b1ce39fe551529ac

SHA1
9b238643f948b1c0d1c1407c68eb6c7675417ff1

SHA256
9767d67236ae3a0175daf2c52209be12beab46804f72ac3bd3769f4946f13e40

SHA512
9b16cf92daceac7ff364fe67fcdf4147add77bcc8c1ff21f152ae6b5de07bd91d290582ea3b93e16e7144baa5a436ffb0669ebd9df43005ed2e64c331fc470fc

Download Submit
C:\Windows\SysWOW64\Omcbkl32.exe

Filesize
55KB

MD5
b2bf232b069c2f6539939b3b6019c871

SHA1
b6819f047e616b27984560ed367cadb7922beedb

SHA256
877a75544295d0910678e4c0acff87cec440aaf474b0a8fabc9a0e9a75bd003b

SHA512
46fd61ca74252bac98cd67735f6c6361f2ff4b757ffa408d14f7fb49cde7fd685b1dd4572a0a951aed838e8b469b20f6321e2b85b2834e0d99ba6f6e2b6abadd

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
55KB

MD5
4aa99656f4438a1d260e4010d55e1e11

SHA1
aed543c59625bb98c83f16256f22d4ecc12f88d1

SHA256
f2295c3613cc708e74c3b6a87e82ad2fa5b97ed19b233f57e0ec0d532b9cd063

SHA512
cdd2a3568e830cfe51e0c36d26d4142cb104db3d79c14ae451fedd7f52724d43c13c2a4ec9b9c50e8cfe9b74dd7f63ee27f94d7a754381bc8e4620bd1ec9a77b

Download Submit
C:\Windows\SysWOW64\Pcepkfld.exe

Filesize
55KB

MD5
8879c8b83cbfc5de8704fdbcf5a032b6

SHA1
87dc3953f4314e702c6912ec6770773b531cbed0

SHA256
b4bc46839e6255eb4589225d16c64e114ecda9ac61ce4518cf11942a7fb34427

SHA512
bc640d157ae9b7aaee1092e956edacf8bd01f2fbc543f6c87a15bd8205cb9fb5839ab31458faa09370dc207aea3d704841e9ecc86fe576408db07e81c80d4374

Download Submit
C:\Windows\SysWOW64\Pcjiff32.exe

Filesize
55KB

MD5
98c4362d22dd514eeb7778174be6eb53

SHA1
5b374524ada6cb68736ac72ee98452f21af3ad74

SHA256
175e786cf1f3c84eb28a9cbc4160b85cf97bf3fd2f3bb82e21c990ba0cadcdd1

SHA512
f7209a2fc75c0ae9eeb0a3cfa0121e83ac8b430b525ddc0ef251222af1637afda4512f317b7a8d1d500a6c39d3c7307758e65b680e6e195c43c586c9654757fa

Download Submit
C:\Windows\SysWOW64\Phedhmhi.exe

Filesize
55KB

MD5
e675fd4fb304ac7fd4ba7f05252f4265

SHA1
5340a5908bd31ca5729107b0ae5d753d3b6cd6a9

SHA256
6962f5f0379bbf0bb93703264f14f0be76bd7dcfadd3b48b137a4f05f839e22e

SHA512
687d2c077321f75f5499c195139dc2c3e172fd8cb8b3a28766239d9223167cb02bdaea6b3c9254ef4360186d7836f60ff235e324d43e525a5fcd52d364ca4fd2

Download Submit
C:\Windows\SysWOW64\Phkmoc32.exe

Filesize
55KB

MD5
21c902a6c8df2e864ec1520e43a007d6

SHA1
6772059dc4ff6cd7c908b48555e8b0f0b2d06859

SHA256
30b403ca5a3149a2d7beb125a9007bc7d7f3d0e35e761cd01e5cfbb480a7b5b0

SHA512
0cd8825559cc149bdd62f20af61cc3c7c1a54d5d261f1ac7b3acfd2db907727455c0eaf89c738c494bff02abc16c1e6afaa2e641c8602d0b71fb383c610fd1da

Download Submit
C:\Windows\SysWOW64\Plbmokop.exe

Filesize
55KB

MD5
6d6e809d0e4fa588b1bcf6604f551f8d

SHA1
8b8e0b893466fc0510b2668e35111a0a9e90b41f

SHA256
d5a24bd62012c8ba858c7ea72e30222b0353f3df1ac9d705281badd7d004dbe6

SHA512
9472bde5510159e15b660f0c0b4b7f63f212293408c580b7e12ed080edd6e11cfc76c593c412bbac7b82ec9bca7ec8ebced6c616ba8a18d57dfde27e81a50d92

Download Submit
C:\Windows\SysWOW64\Pllgnl32.exe

Filesize
55KB

MD5
ca98cf010a4ce89a37f82d99cce0c361

SHA1
97f0c1a3f65d1e1b504c14f4f3952f4994113975

SHA256
84af4c68ba7c93e1383c6ae71dcba009cb32efcd9cc15c8e42748e4b72e2a790

SHA512
c0ca167556c5eed1be011348112112418fa2947f90e2c57614fc5583d94747f353ba9dd574157f3afc0811de376d82f29e3ade84704711fac14ec1f33db45df2

Download Submit
C:\Windows\SysWOW64\Plndcl32.exe

Filesize
55KB

MD5
8210cb2e7560afc9257e3f0bdd337d65

SHA1
8aa2427eadcb239b70f15498aaf953accee5950f

SHA256
a22b28fb16caa1c854a9fafbb0f281d2a6237544a58612dcfd43e9e6b9173390

SHA512
5720665e41e01f2445ff694a387a325713a38c344c55fd18276f8529d85059c41e272db0663f3b5ed7acbcbcc9fb82ebd5e892b0db3870396a5bc9425ae620ac

Download Submit
C:\Windows\SysWOW64\Pokanf32.exe

Filesize
55KB

MD5
ff1c66ded55403e8e1454af1617d7700

SHA1
ab655021f6f0d7dcc8c9d5637ccc75b78241cfdd

SHA256
f0ee29e3ec906406957bea146cfe6f5628569aac0f53ab723a68f3794dc57d11

SHA512
4026a9c608b23b7a10677f79094e4c32531d0c524782949c08aec6bdee5c2353276324e634d37fdbbe1fa40f6ff349d4215a14a5719839a301f1aebb635ec0dc

Download Submit
memory/380-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/524-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1084-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1084-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1444-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-500-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2184-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2184-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2184-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2412-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2688-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2836-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3224-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3224-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3340-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3340-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3488-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3768-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3768-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3880-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3880-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-499-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4868-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4868-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5132-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5172-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads