466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe
Size

96KB
MD5

351cb4137fb9b7d452ad35fb30f83859
SHA1

a099f50239e01e47120c073822755d4ea0a8a602
SHA256

466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c
SHA512

647feb180e29387aa5cd055b3f32dd90cf8f32aa1a835cb631c8fe0d0559974c0e387eb070513a10e28a2d5ca74a367f5219ae828be0fd0c44cada2b57bda811
SSDEEP

3072:HeCQwfD+/ukvN6iYdMSY1s2I9t5Crd69jc0v:FwgBaSY1s2gjCrd6NV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anijjkbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpedgghj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eliecc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lihpdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khhaanop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdpmkhjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edaaccbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfehpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnaffdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mikepg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cienon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgeihiac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmjlkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghcbohpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhafcd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flpbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmdlflki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haidfpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gphddlfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpaqqdjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjcmpepm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpbgnecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcehejic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcndab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgoolbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hqddqj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkpijfgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeamcmmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gchflq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpcila32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glinjqhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgbob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phmnfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eegqldqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khhaanop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jonlimkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjpkjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpbokjho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkbkoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpandm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgkimn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elhfbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkhpfbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daollh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhqefjpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaijand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljffccjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hojpbigq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iencmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icnphd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elnehifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mhefhf32.exe

Executes dropped EXE 64 IoCs

pid	Process
2620	Afpjel32.exe
2332	Akpoaj32.exe
1076	Ahfmpnql.exe
1880	Bdmmeo32.exe
2728	Bgnffj32.exe
4704	Bdagpnbk.exe
4184	Boihcf32.exe
936	Bnoddcef.exe
4028	Ckbemgcp.exe
4944	Cgifbhid.exe
1812	Coegoe32.exe
4812	Dddllkbf.exe
5028	Dojqjdbl.exe
4052	Dkekjdck.exe
1532	Dkhgod32.exe
996	Egohdegl.exe
1548	Enmjlojd.exe
3564	Enpfan32.exe
3708	Fnbcgn32.exe
3964	Fbplml32.exe
1252	Fkhpfbce.exe
1644	Filapfbo.exe
1260	Finnef32.exe
3672	Fkofga32.exe
3980	Ganldgib.exe
4440	Glfmgp32.exe
1896	Geoapenf.exe
2256	Hnlodjpa.exe
3488	Halhfe32.exe
212	Hnphoj32.exe
1392	Haaaaeim.exe
3972	Ipbaol32.exe
3140	Iogopi32.exe
1180	Ihpcinld.exe
3920	Ipihpkkd.exe
4296	Jldbpl32.exe
4672	Jpbjfjci.exe
1616	Jikoopij.exe
3684	Kpiqfima.exe
4712	Klbnajqc.exe
1504	Lhqefjpo.exe
644	Mapppn32.exe
4472	Mofmobmo.exe
5092	Nofefp32.exe
4656	Ojnfihmo.exe
4412	Ojqcnhkl.exe
3644	Oifppdpd.exe
4784	Ppdbgncl.exe
1080	Pjjfdfbb.exe
1748	Pfagighf.exe
4116	Ppikbm32.exe
4364	Pmmlla32.exe
1020	Ppnenlka.exe
1868	Qfjjpf32.exe
4824	Qpbnhl32.exe
3884	Qjhbfd32.exe
2212	Amikgpcc.exe
2696	Abfdpfaj.exe
2348	Apjdikqd.exe
4496	Aaiqcnhg.exe
4032	Aalmimfd.exe
4600	Afhfaddk.exe
3048	Bfkbfd32.exe
2940	Bpcgpihi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mhefhf32.exe	Malnklgg.exe
File opened for modification	C:\Windows\SysWOW64\Hjpkjh32.exe	Hcfcmnce.exe
File created	C:\Windows\SysWOW64\Mikepg32.exe	Mflidl32.exe
File opened for modification	C:\Windows\SysWOW64\Fgkfqgce.exe	Fpandm32.exe
File opened for modification	C:\Windows\SysWOW64\Gkcdfl32.exe	Gojgkl32.exe
File created	C:\Windows\SysWOW64\Pemqkk32.dll	Ailabddb.exe
File created	C:\Windows\SysWOW64\Ckbemgcp.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Jnfjbj32.exe	Jglaepim.exe
File created	C:\Windows\SysWOW64\Hhiaepfl.exe	Gclimi32.exe
File opened for modification	C:\Windows\SysWOW64\Hfefdpfe.exe	Hnjaonij.exe
File created	C:\Windows\SysWOW64\Cljmgigk.dll	Jnfjbj32.exe
File created	C:\Windows\SysWOW64\Fdhail32.exe	Eegqldqg.exe
File created	C:\Windows\SysWOW64\Kiaqnagj.exe	Kcehejic.exe
File opened for modification	C:\Windows\SysWOW64\Eegqldqg.exe	Epjhcnbp.exe
File opened for modification	C:\Windows\SysWOW64\Iagqgn32.exe	Ijmhkchl.exe
File opened for modification	C:\Windows\SysWOW64\Eeddfe32.exe	Ellpmolj.exe
File created	C:\Windows\SysWOW64\Ablgll32.dll	Kcehejic.exe
File created	C:\Windows\SysWOW64\Bfgcag32.dll	Paomog32.exe
File created	C:\Windows\SysWOW64\Dccfkp32.dll	Aaiqcnhg.exe
File created	C:\Windows\SysWOW64\Bbpolb32.exe	Bkefphem.exe
File opened for modification	C:\Windows\SysWOW64\Qejfkmem.exe	Pomncfge.exe
File created	C:\Windows\SysWOW64\Dllffa32.exe	Debnjgcp.exe
File created	C:\Windows\SysWOW64\Npgmdnlj.dll	Ihmnldib.exe
File created	C:\Windows\SysWOW64\Klbnajqc.exe	Kpiqfima.exe
File created	C:\Windows\SysWOW64\Ianfdf32.dll	Lmfodn32.exe
File created	C:\Windows\SysWOW64\Qbfmcg32.dll	Fajgfiag.exe
File created	C:\Windows\SysWOW64\Ficlmf32.exe	Fkbkoo32.exe
File created	C:\Windows\SysWOW64\Gclimi32.exe	Ghgeoq32.exe
File created	C:\Windows\SysWOW64\Gmeadk32.dll	Eljchpnl.exe
File created	C:\Windows\SysWOW64\Amfhgj32.exe	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Pbdgkjib.dll	Pnfdnnbo.exe
File opened for modification	C:\Windows\SysWOW64\Gchflq32.exe	Ghcbohpp.exe
File opened for modification	C:\Windows\SysWOW64\Kfeagefd.exe	Kplijk32.exe
File created	C:\Windows\SysWOW64\Ahkdgl32.dll	Dcnlnaom.exe
File created	C:\Windows\SysWOW64\Jhhgmlli.exe	Joobdfei.exe
File opened for modification	C:\Windows\SysWOW64\Nncoaq32.exe	Nnabladg.exe
File created	C:\Windows\SysWOW64\Hpaqqdjj.exe	Geklckkd.exe
File opened for modification	C:\Windows\SysWOW64\Hlgjko32.exe	Haafnf32.exe
File created	C:\Windows\SysWOW64\Qgdcdg32.dll	Aalmimfd.exe
File created	C:\Windows\SysWOW64\Abgjkpll.exe	Almanf32.exe
File opened for modification	C:\Windows\SysWOW64\Pbfjjlgc.exe	Pklamb32.exe
File opened for modification	C:\Windows\SysWOW64\Egohdegl.exe	Dkhgod32.exe
File opened for modification	C:\Windows\SysWOW64\Mdagbl32.exe	Moeoje32.exe
File created	C:\Windows\SysWOW64\Dnmdil32.dll	Hqddqj32.exe
File opened for modification	C:\Windows\SysWOW64\Iebfmfdg.exe	Inhmqlmj.exe
File created	C:\Windows\SysWOW64\Fkbkoo32.exe	Fajgfiag.exe
File created	C:\Windows\SysWOW64\Adokoq32.dll	Iebfmfdg.exe
File opened for modification	C:\Windows\SysWOW64\Jaljbmkd.exe	Ijbbfc32.exe
File created	C:\Windows\SysWOW64\Gflcnanp.exe	Gmdoel32.exe
File opened for modification	C:\Windows\SysWOW64\Qfjcep32.exe	Qkdohg32.exe
File opened for modification	C:\Windows\SysWOW64\Hpaqqdjj.exe	Geklckkd.exe
File created	C:\Windows\SysWOW64\Albkieqj.exe	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Lmgoad32.dll	Ghcbohpp.exe
File created	C:\Windows\SysWOW64\Mmdlflki.exe	Mhhcne32.exe
File created	C:\Windows\SysWOW64\Fajgfiag.exe	Ebbmpmnb.exe
File opened for modification	C:\Windows\SysWOW64\Ijbbfc32.exe	Iajmmm32.exe
File opened for modification	C:\Windows\SysWOW64\Jonlimkg.exe	Jfehpg32.exe
File opened for modification	C:\Windows\SysWOW64\Abgjkpll.exe	Almanf32.exe
File created	C:\Windows\SysWOW64\Ngofgcjo.dll	Imdgljil.exe
File opened for modification	C:\Windows\SysWOW64\Jnpjlajn.exe	Jaljbmkd.exe
File created	C:\Windows\SysWOW64\Hjbhph32.exe	Homcbo32.exe
File created	C:\Windows\SysWOW64\Lcpkmaqn.dll	Efampahd.exe
File opened for modification	C:\Windows\SysWOW64\Edfknb32.exe	Enlcahgh.exe
File opened for modification	C:\Windows\SysWOW64\Oakjnnap.exe	Ogefqeaj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6324	6232	WerFault.exe	626

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcblbn32.dll"	Inkjfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpnkdfko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgiamm32.dll"	Oinbgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiiajl32.dll"	Jhhgmlli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoljhi32.dll"	Nlknbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lahoec32.dll"	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ancjef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Badjai32.dll"	Fnbcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bbcignbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbglgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgmebnpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bqpbboeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkhceh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agckiqgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbiapehp.dll"	Ijdnka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkebqokl.dll"	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bikeni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jglaepim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngnppfgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oeamcmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nepgghpg.dll"	Ababkdij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphiikma.dll"	Gojgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mapppn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpefaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdihfq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abfdpfaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icpjna32.dll"	Cgklmacf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afboah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flpbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odcfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfnef32.dll"	Facjlhil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elhfbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbhhieao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmghklif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egilaj32.dll"	466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edaaccbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdjpphi.dll"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clhofq32.dll"	Gglpgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhlebfjp.dll"	Gkcdfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjhbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdagbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mphamg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfecjhc.dll"	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nhjjip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egmjnelk.dll"	Najjmjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eliecc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amikgpcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paifdeda.dll"	Gbhhieao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifmldo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jglaepim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qpbnhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjmodffo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nhafcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Geabbfoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njmopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ihpcinld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfooh32.dll"	Lddble32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjpkn32.dll"	Fdhail32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jegohe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbfema32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2620	2320	466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe	92
PID 2320 wrote to memory of 2620	2320	466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe	92
PID 2320 wrote to memory of 2620	2320	466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe	92
PID 2620 wrote to memory of 2332	2620	Afpjel32.exe	93
PID 2620 wrote to memory of 2332	2620	Afpjel32.exe	93
PID 2620 wrote to memory of 2332	2620	Afpjel32.exe	93
PID 2332 wrote to memory of 1076	2332	Akpoaj32.exe	94
PID 2332 wrote to memory of 1076	2332	Akpoaj32.exe	94
PID 2332 wrote to memory of 1076	2332	Akpoaj32.exe	94
PID 1076 wrote to memory of 1880	1076	Ahfmpnql.exe	95
PID 1076 wrote to memory of 1880	1076	Ahfmpnql.exe	95
PID 1076 wrote to memory of 1880	1076	Ahfmpnql.exe	95
PID 1880 wrote to memory of 2728	1880	Bdmmeo32.exe	96
PID 1880 wrote to memory of 2728	1880	Bdmmeo32.exe	96
PID 1880 wrote to memory of 2728	1880	Bdmmeo32.exe	96
PID 2728 wrote to memory of 4704	2728	Bgnffj32.exe	97
PID 2728 wrote to memory of 4704	2728	Bgnffj32.exe	97
PID 2728 wrote to memory of 4704	2728	Bgnffj32.exe	97
PID 4704 wrote to memory of 4184	4704	Bdagpnbk.exe	98
PID 4704 wrote to memory of 4184	4704	Bdagpnbk.exe	98
PID 4704 wrote to memory of 4184	4704	Bdagpnbk.exe	98
PID 4184 wrote to memory of 936	4184	Boihcf32.exe	99
PID 4184 wrote to memory of 936	4184	Boihcf32.exe	99
PID 4184 wrote to memory of 936	4184	Boihcf32.exe	99
PID 936 wrote to memory of 4028	936	Bnoddcef.exe	100
PID 936 wrote to memory of 4028	936	Bnoddcef.exe	100
PID 936 wrote to memory of 4028	936	Bnoddcef.exe	100
PID 4028 wrote to memory of 4944	4028	Ckbemgcp.exe	101
PID 4028 wrote to memory of 4944	4028	Ckbemgcp.exe	101
PID 4028 wrote to memory of 4944	4028	Ckbemgcp.exe	101
PID 4944 wrote to memory of 1812	4944	Cgifbhid.exe	102
PID 4944 wrote to memory of 1812	4944	Cgifbhid.exe	102
PID 4944 wrote to memory of 1812	4944	Cgifbhid.exe	102
PID 1812 wrote to memory of 4812	1812	Coegoe32.exe	103
PID 1812 wrote to memory of 4812	1812	Coegoe32.exe	103
PID 1812 wrote to memory of 4812	1812	Coegoe32.exe	103
PID 4812 wrote to memory of 5028	4812	Dddllkbf.exe	104
PID 4812 wrote to memory of 5028	4812	Dddllkbf.exe	104
PID 4812 wrote to memory of 5028	4812	Dddllkbf.exe	104
PID 5028 wrote to memory of 4052	5028	Dojqjdbl.exe	105
PID 5028 wrote to memory of 4052	5028	Dojqjdbl.exe	105
PID 5028 wrote to memory of 4052	5028	Dojqjdbl.exe	105
PID 4052 wrote to memory of 1532	4052	Dkekjdck.exe	106
PID 4052 wrote to memory of 1532	4052	Dkekjdck.exe	106
PID 4052 wrote to memory of 1532	4052	Dkekjdck.exe	106
PID 1532 wrote to memory of 996	1532	Dkhgod32.exe	107
PID 1532 wrote to memory of 996	1532	Dkhgod32.exe	107
PID 1532 wrote to memory of 996	1532	Dkhgod32.exe	107
PID 996 wrote to memory of 1548	996	Egohdegl.exe	108
PID 996 wrote to memory of 1548	996	Egohdegl.exe	108
PID 996 wrote to memory of 1548	996	Egohdegl.exe	108
PID 1548 wrote to memory of 3564	1548	Enmjlojd.exe	109
PID 1548 wrote to memory of 3564	1548	Enmjlojd.exe	109
PID 1548 wrote to memory of 3564	1548	Enmjlojd.exe	109
PID 3564 wrote to memory of 3708	3564	Enpfan32.exe	110
PID 3564 wrote to memory of 3708	3564	Enpfan32.exe	110
PID 3564 wrote to memory of 3708	3564	Enpfan32.exe	110
PID 3708 wrote to memory of 3964	3708	Fnbcgn32.exe	111
PID 3708 wrote to memory of 3964	3708	Fnbcgn32.exe	111
PID 3708 wrote to memory of 3964	3708	Fnbcgn32.exe	111
PID 3964 wrote to memory of 1252	3964	Fbplml32.exe	112
PID 3964 wrote to memory of 1252	3964	Fbplml32.exe	112
PID 3964 wrote to memory of 1252	3964	Fbplml32.exe	112
PID 1252 wrote to memory of 1644	1252	Fkhpfbce.exe	113

C:\Users\Admin\AppData\Local\Temp\466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe
"C:\Users\Admin\AppData\Local\Temp\466ab98a5974e1164aeca610f4f017305e2c8735a16424d141eb3964390be60c.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\Afpjel32.exe
  C:\Windows\system32\Afpjel32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\Akpoaj32.exe
    C:\Windows\system32\Akpoaj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\SysWOW64\Ahfmpnql.exe
      C:\Windows\system32\Ahfmpnql.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1880
      - C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        23⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        24⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        25⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        26⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        28⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        29⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        30⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        31⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        32⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        33⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        34⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        36⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        37⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        38⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        39⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:644
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        44⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        45⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        46⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        47⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        48⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        49⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        50⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        51⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        52⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        53⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        54⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        55⤵
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        60⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        64⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        65⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        66⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        67⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        68⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        69⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2280
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        71⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        72⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        73⤵
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        74⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        75⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        76⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        77⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        78⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        79⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        80⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3816
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        82⤵
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3260
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        84⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        86⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        87⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        88⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        89⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        90⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        91⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        92⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        93⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        94⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        95⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        96⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        97⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        98⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        99⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        100⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        101⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        102⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        103⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        104⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        105⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        106⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        107⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        108⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4760
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        110⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        111⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        113⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        114⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        117⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        118⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        121⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        122⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        123⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        124⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        125⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        126⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        127⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        128⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        130⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        132⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        133⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        134⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        135⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        136⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        137⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        138⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Lamlphoo.exe
        
        C:\Windows\system32\Lamlphoo.exe
        139⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        140⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        141⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        142⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        143⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        144⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        145⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        146⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        147⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        148⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        149⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        150⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        152⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        153⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        154⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        155⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        156⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        157⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        158⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        159⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        160⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        161⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        162⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        163⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        164⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        165⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        166⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        167⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        169⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        171⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        172⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        174⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        176⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        177⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        178⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        179⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        180⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        181⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        182⤵
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        183⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        184⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        186⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        187⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        188⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        189⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        191⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        192⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        193⤵
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        194⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        195⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        196⤵
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        197⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        198⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        199⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Ecanojgl.exe
        
        C:\Windows\system32\Ecanojgl.exe
        201⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        202⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Eebgqe32.exe
        
        C:\Windows\system32\Eebgqe32.exe
        203⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ellpmolj.exe
        
        C:\Windows\system32\Ellpmolj.exe
        204⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        205⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Epjhcnbp.exe
        
        C:\Windows\system32\Epjhcnbp.exe
        206⤵
        Drops file in System32 directory
        
        PID:7636
        
        C:\Windows\SysWOW64\Eegqldqg.exe
        
        C:\Windows\system32\Eegqldqg.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Fdhail32.exe
        
        C:\Windows\system32\Fdhail32.exe
        208⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        209⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        210⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        212⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        213⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        214⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        216⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        217⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        218⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Gflcnanp.exe
        
        C:\Windows\system32\Gflcnanp.exe
        220⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        221⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        222⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        224⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        225⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        226⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        227⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        228⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Iggocbke.exe
        
        C:\Windows\system32\Iggocbke.exe
        229⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        230⤵
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Ifmldo32.exe
        
        C:\Windows\system32\Ifmldo32.exe
        232⤵
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        233⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        234⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        235⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        236⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Iebfmfdg.exe
        
        C:\Windows\system32\Iebfmfdg.exe
        237⤵
        Drops file in System32 directory
        
        PID:7980
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        238⤵
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        240⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        241⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Jfhlpnfp.exe
        
        C:\Windows\system32\Jfhlpnfp.exe
        242⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        243⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        245⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        246⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        247⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        248⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Khcgfo32.exe
        
        C:\Windows\system32\Khcgfo32.exe
        249⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Keghocao.exe
        
        C:\Windows\system32\Keghocao.exe
        250⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        251⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8340
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        253⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        254⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        255⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        256⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Lfbgmj32.exe
        
        C:\Windows\system32\Lfbgmj32.exe
        257⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Laglkb32.exe
        
        C:\Windows\system32\Laglkb32.exe
        258⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        259⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        260⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Lkbmih32.exe
        
        C:\Windows\system32\Lkbmih32.exe
        261⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        262⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        263⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        264⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Moeoje32.exe
        
        C:\Windows\system32\Moeoje32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8912
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        266⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Mmjlkb32.exe
        
        C:\Windows\system32\Mmjlkb32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        268⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        269⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Nkpijfgf.exe
        
        C:\Windows\system32\Nkpijfgf.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9124
        
        C:\Windows\SysWOW64\Najagp32.exe
        
        C:\Windows\system32\Najagp32.exe
        271⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        272⤵
        Drops file in System32 directory
        
        PID:3844
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        273⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Nhicoi32.exe
        
        C:\Windows\system32\Nhicoi32.exe
        274⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Nockkcjg.exe
        
        C:\Windows\system32\Nockkcjg.exe
        275⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ngnppfgb.exe
        
        C:\Windows\system32\Ngnppfgb.exe
        276⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        277⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Onjebpml.exe
        
        C:\Windows\system32\Onjebpml.exe
        278⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Oeamcmmo.exe
        
        C:\Windows\system32\Oeamcmmo.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        280⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        281⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        282⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        283⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        284⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        285⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        286⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        287⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Pdpmkhjl.exe
        
        C:\Windows\system32\Pdpmkhjl.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8236
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        289⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Pklamb32.exe
        
        C:\Windows\system32\Pklamb32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        291⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        292⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Qghlmbae.exe
        
        C:\Windows\system32\Qghlmbae.exe
        293⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        294⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        295⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        296⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        297⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9208
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        299⤵
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        300⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        301⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        302⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        303⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Bkdqdokk.exe
        
        C:\Windows\system32\Bkdqdokk.exe
        304⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        305⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        306⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        307⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        308⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        309⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        310⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        311⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        312⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        313⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Chkjpm32.exe
        
        C:\Windows\system32\Chkjpm32.exe
        314⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        315⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        316⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Dojlhg32.exe
        
        C:\Windows\system32\Dojlhg32.exe
        317⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        318⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        319⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        320⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        321⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        322⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        323⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        324⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        325⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        326⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        327⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3528
        
        C:\Windows\SysWOW64\Fefjanml.exe
        
        C:\Windows\system32\Fefjanml.exe
        329⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        331⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        332⤵
        Modifies registry class
        
        PID:1776
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        333⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        334⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        335⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        336⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        337⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        338⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        339⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9244
        
        C:\Windows\SysWOW64\Gchflq32.exe
        
        C:\Windows\system32\Gchflq32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        342⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        343⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        344⤵
        Drops file in System32 directory
        
        PID:9420
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9464
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9508
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        347⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        348⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Hhobjf32.exe
        
        C:\Windows\system32\Hhobjf32.exe
        349⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        350⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Hllkqdli.exe
        
        C:\Windows\system32\Hllkqdli.exe
        351⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        352⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9844
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        355⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        356⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        357⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        358⤵
        Drops file in System32 directory
        
        PID:10028
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        359⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        360⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        363⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        364⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        365⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        366⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        367⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9416
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        369⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Kcehejic.exe
        
        C:\Windows\system32\Kcehejic.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9496
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        371⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        372⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        373⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        374⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        375⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        376⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        377⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3800
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9972
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        380⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        381⤵
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        382⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        383⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        384⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        385⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        386⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        387⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        388⤵
        Drops file in System32 directory
        
        PID:9344
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        390⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        391⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        393⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        394⤵
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        396⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        397⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10096
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        400⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        401⤵
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        402⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        403⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        404⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Niglfl32.exe
        
        C:\Windows\system32\Niglfl32.exe
        405⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        406⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        407⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Opfnne32.exe
        
        C:\Windows\system32\Opfnne32.exe
        408⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        409⤵
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        410⤵
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        411⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        412⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        413⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Pdklebje.exe
        
        C:\Windows\system32\Pdklebje.exe
        414⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        415⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        416⤵
        Drops file in System32 directory
        
        PID:3488
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        417⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        418⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2500
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        420⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        421⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        422⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        423⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        424⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        425⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Ancjef32.exe
        
        C:\Windows\system32\Ancjef32.exe
        426⤵
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        427⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        428⤵
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        429⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        430⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        431⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        432⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3500
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        434⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2056
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        436⤵
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        437⤵
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Bbpolb32.exe
        
        C:\Windows\system32\Bbpolb32.exe
        438⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        439⤵
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        440⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        441⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        442⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        443⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        444⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        445⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        446⤵
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        447⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        448⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        449⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        450⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Eijigg32.exe
        
        C:\Windows\system32\Eijigg32.exe
        451⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Eliecc32.exe
        
        C:\Windows\system32\Eliecc32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1096
        
        C:\Windows\SysWOW64\Ebbmpmnb.exe
        
        C:\Windows\system32\Ebbmpmnb.exe
        453⤵
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Fajgfiag.exe
        
        C:\Windows\system32\Fajgfiag.exe
        454⤵
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Fkbkoo32.exe
        
        C:\Windows\system32\Fkbkoo32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Ficlmf32.exe
        
        C:\Windows\system32\Ficlmf32.exe
        456⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        457⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Focakm32.exe
        
        C:\Windows\system32\Focakm32.exe
        458⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Fkiapn32.exe
        
        C:\Windows\system32\Fkiapn32.exe
        459⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Facjlhil.exe
        
        C:\Windows\system32\Facjlhil.exe
        460⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Geabbfoc.exe
        
        C:\Windows\system32\Geabbfoc.exe
        462⤵
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        463⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        464⤵
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Ghgeoq32.exe
        
        C:\Windows\system32\Ghgeoq32.exe
        465⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        466⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Hhiaepfl.exe
        
        C:\Windows\system32\Hhiaepfl.exe
        467⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        468⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        469⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Hepoddcc.exe
        
        C:\Windows\system32\Hepoddcc.exe
        470⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        471⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        472⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Hojpbigq.exe
        
        C:\Windows\system32\Hojpbigq.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Hhbdko32.exe
        
        C:\Windows\system32\Hhbdko32.exe
        474⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Hchihhng.exe
        
        C:\Windows\system32\Hchihhng.exe
        475⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Iibaeb32.exe
        
        C:\Windows\system32\Iibaeb32.exe
        476⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        477⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        478⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        479⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        480⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Iabodcnj.exe
        
        C:\Windows\system32\Iabodcnj.exe
        481⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        482⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        483⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        484⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        485⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        486⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Jkajnh32.exe
        
        C:\Windows\system32\Jkajnh32.exe
        487⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jbkbkbfo.exe
        
        C:\Windows\system32\Jbkbkbfo.exe
        488⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        489⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        490⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        491⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        492⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Kbedaand.exe
        
        C:\Windows\system32\Kbedaand.exe
        493⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        494⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        495⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        496⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Kbinlp32.exe
        
        C:\Windows\system32\Kbinlp32.exe
        497⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        498⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Kifcnjpi.exe
        
        C:\Windows\system32\Kifcnjpi.exe
        499⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        500⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        501⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        504⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        505⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        506⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        507⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        508⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        510⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        511⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        512⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        513⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Mmahff32.exe
        
        C:\Windows\system32\Mmahff32.exe
        514⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Mjehok32.exe
        
        C:\Windows\system32\Mjehok32.exe
        515⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mlgegcng.exe
        
        C:\Windows\system32\Mlgegcng.exe
        516⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        517⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        519⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Nlknbb32.exe
        
        C:\Windows\system32\Nlknbb32.exe
        520⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Njmopj32.exe
        
        C:\Windows\system32\Njmopj32.exe
        521⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Ncecioib.exe
        
        C:\Windows\system32\Ncecioib.exe
        522⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nmmgae32.exe
        
        C:\Windows\system32\Nmmgae32.exe
        523⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nffljjfc.exe
        
        C:\Windows\system32\Nffljjfc.exe
        524⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Nlbdba32.exe
        
        C:\Windows\system32\Nlbdba32.exe
        525⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Njceqili.exe
        
        C:\Windows\system32\Njceqili.exe
        526⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        527⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 412
        528⤵
        Program crash
        
        PID:6324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3500 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 6232 -ip 6232
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afpjel32.exe

Filesize
96KB

MD5
851457ad9521cff1eaa50a8c047457e3

SHA1
0ebe887b029496f69f3f8293fabdb3c39e3aba71

SHA256
56eae84389fbd8ea1dc99ecf3b941dfdd3e6a3daa378d3d6c89d9f21ef0537a4

SHA512
f4fb6267edbec00fa5da1c981878afbd8e33ff93be8db5b909cb7596760754f4eb43241e1e40563940802eb4fba000eac17bc60052c98afc5a86ada130314ece

Download Submit
C:\Windows\SysWOW64\Ahfmpnql.exe

Filesize
96KB

MD5
3a667f1eeaef640e285b49f4f2667cd2

SHA1
9360846652a0122b249b2540389ab6f5c53cb843

SHA256
c0ff021b3b55969aa42c9175941ff6e14cc6eff81ca5eb69bae9a24adec446d9

SHA512
6f213e5427bebefa5e3936faf7e6ebc07ca085167cc3e82c93d48dd9805c8a71e5797225f6c3e9933af09e2872dfd9d3fd71a46f48044a1857fe20c1cd870b7d

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
96KB

MD5
a27110b5cb2ccd92fca3b757b72c9f0c

SHA1
c57d37019a35ee80068eeb26b857eb4725790944

SHA256
9ab236409b8e64fd76f77a525996346f41303febb5b648a8a46f22b13176c7eb

SHA512
010fb40f857214bcada81f354a05f243550ccbefd6ab63151f2260052dd5a77e5c0b14339e4c1753ada73909b5d69b446184b03d37d0c05b2712c53795562aa0

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
96KB

MD5
8c71a06404493aaafac0ef0b5118a1bb

SHA1
bccd8c6691c0645eb94476b27355e707f34e8f9d

SHA256
281743766847f26f65a4b6feffc50e7c6dace3d1972918d634967c6d01aac5df

SHA512
34dd3ebf132fa84958dd8c64d3f0f35e542d270e2683cc49d09cc0e61f5e62ac2783c476a3d04e6cfb95aa917b885408f0a6bed48a5e7301706b44fb2ddb2613

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
96KB

MD5
d81c39153648ce06a1e4ab700c91bee8

SHA1
9f4688cd9602290d5289d076872ea10364445c19

SHA256
128c1349d9d4a75ef47a448f428f3cd7be072690e1e4860bb9e5a2a42c33c226

SHA512
89af1a045ed04b1ca45e6b769a69e1d2ecfe384bdd4aff66a16ff1b17e52998e382d944506d1b8307e6c82db8e036ab33160447017d38544f61babfa61cce1d8

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
96KB

MD5
e2ef2c850d8d0ad491e3799ec760ca68

SHA1
7cb554c63e96eedfa2446c04eee4c3a011f97473

SHA256
c259fb0135c1d89382a348e9d7743d2c5f739ca3306b5c27be1f7f00b6a5e861

SHA512
c62a84308fa4e2d9c970694c07c0e119ada8f1ed95c60b1176629e2dca7df830dcdb9aacb024ad7010b8f657b8370337c43f8ff51577b05f0f8adffea137ebcd

Download Submit
C:\Windows\SysWOW64\Bnoddcef.exe

Filesize
96KB

MD5
529c4b11f9d3baa445b4fc16527cdd79

SHA1
2d6dcc998bfcee4d16a497713ff68758ddce58ba

SHA256
47a9cd41c81799c79531e7a294bd6cc2169d900eaf045288728d4bbb6fc1a9ea

SHA512
41b8c772cb8b9e5c182614b4b7d16f11d2a59cd85a9b79197009f4a98d183ee622240175ea7039f0e8a979dc976cdb8255f43803f01dae864abfffbe2a518138

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
96KB

MD5
db59beb4a846eadffee329e853df3f6c

SHA1
dd4bc9b5547fad79cb776978e8043254058cc65e

SHA256
4a6c6ff2c4f4c4526d8185bb92982094ba5ac495240c519d74446a23e4a48b09

SHA512
42719a6120f9b883031c9718bd3ec8504a3e81aa294d700b9b33ddb170e1db4c986d1dfe7e9626d68d8aa280d0765e26f3c0929b176b21bcb530e5321e81ed41

Download Submit
C:\Windows\SysWOW64\Cbmlmmjd.exe

Filesize
96KB

MD5
a83a97e327a3b1946532627aa6c9265d

SHA1
70b75a80704730c26e2bb32c29de6f59fcb89058

SHA256
2a2f5df95161aef0a734b304891654613ca5e8e3b6ae27cf3cd82bc54f948ce9

SHA512
af27f20932d27d8a02544a83d7b6736ca6e10100f6cbb8fb29584c4099747b24d0176d69d897acc7ae9536900a80ddd87192b3dee2da0cb138063d9e074322ce

Download Submit
C:\Windows\SysWOW64\Cdolgfbp.exe

Filesize
96KB

MD5
038fbde9a2aabe9f255640360964e0ab

SHA1
88612eb28463c4ee29e3293b090fe5182d2e184f

SHA256
5c3bd27a15023c09934a034dbd426d75e8d7f6d10aa2ef1f8db86a46f3ec4524

SHA512
446e1d8b37ceef98bb81389eac34351527d80d2ed81a844f8fbf951feefb0bf3ead2c3806c24bb5d3c64ae47a5ba667817c02fcb61450e787ce0b617da10a77f

Download Submit
C:\Windows\SysWOW64\Cgifbhid.exe

Filesize
96KB

MD5
26e7d8942916c48c443d99e95b0f0f63

SHA1
6472fc78ab41ba4fcba81110c547e42e4f6d566d

SHA256
f69b7f5fc5b59a0139efb4c0d9ddb1d8b512967f8660171955506459c132dbd8

SHA512
c0da0cbb3adb8da6221b127708be2c4080a72191a3e5066caa4d235c3700137268398432ca2b56943a00151724aa8beebd923b2e417f8980e082681bfa3f3b88

Download Submit
C:\Windows\SysWOW64\Ckbemgcp.exe

Filesize
96KB

MD5
e3a09cd3d21bd2422f0bcea8bdbd5438

SHA1
8c636ce04259cf8665c5476c92e771b1698c969f

SHA256
a34b926ac1bac389304d1a5145c1ae6e4352c84170758c5971338e130c284733

SHA512
6eb299e86240827f03bf7078681373dc8e3840831330c329bc24cac5877c8432a0d32008fa814c6d7168c3d526b088c7f8a1bfe47f9fb30d9ebe43ef9ba074a9

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
96KB

MD5
4952f4f2133a44e63b09e71f4f0b10bd

SHA1
7cf69f433c1d4e683bdb507dda9a8ba7f8b8eee1

SHA256
2f3c0e7ca743807a47d334d883abde97ad742beb16c1ae487ff28c743156d729

SHA512
20c524536847dbfdfce6e39863eb994d826db5215bbd8ecfeadac6116f4a481dba78f146a5a7b7ab898e8eba3f8ab47badab99aeb3ef8ddacaaae0807306c50f

Download Submit
C:\Windows\SysWOW64\Cpljehpo.exe

Filesize
96KB

MD5
8426354310f4db94ed706679bce1ae75

SHA1
8feb53261cb07f24535086363e209466f2b76fcb

SHA256
118463b4f9fa6ef7e96cffa9e22f876b6fb8d5199b5e3745bae302d8b32d5d83

SHA512
3f0aaae05b97dcc67244db834239a436f34968f2e579c4fe437d090a71a1af2dc481c6edaaee17f5287337c0d3e40cbd91971cb97dcebdc269c93c0c91266469

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
96KB

MD5
9b0104ea0b7767fd64d7a7f29e65073b

SHA1
fed433c7660bdb53deb7a35bd12eb15954633e42

SHA256
4cd39ab44a1809996865870130f8072b91fcba845ebd69bad84376501cfbd86b

SHA512
ce3d4cce7dbb87c960431d83e7a83a0ea7c081f1f759b605da031b9f742bbccf8068077dd97b8310c2f8c691296b0210becdad894d45673beb3fb9d4de20fea6

Download Submit
C:\Windows\SysWOW64\Dkekjdck.exe

Filesize
96KB

MD5
4602b1c5fa16500fa798c382b89fc668

SHA1
bbfaeb7ab4818472e7d5b6997efff0f11b938d26

SHA256
ff69d5c9cf8763823356070602fb3131e752469b53c89e87f4f880db8faa8229

SHA512
bccf2f00b542c7a0efe4ffc35e2f1ab1432a5a39245b391976bc040fd32b36d9f6d9b40876ecb3385f3c51eb51d67b9a7a2993235147e3dc02e767f5211024c5

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
96KB

MD5
f4933073d464e0a57ec32ea386e4f7f6

SHA1
ef61619902324320bc400436736b13872a2cec4d

SHA256
9419a423915a587842f0341de20cc576f80264645b1ba047621ac52e93064668

SHA512
59af3d8471e4b20b5ac5f64427e230c4edfba20b6f07ca783f3d9d45407bb19f7c935733dc513e589611e3ff752ebdc0b6dafe19723812128cfaaed79bedb143

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
96KB

MD5
ac4bfa0c5b0800f970b34286f30f7cbf

SHA1
4deb319fc973c19996116678f2d630d891986ac8

SHA256
a29d5cfb80319b1d9c6494fd8b56981e08e2a22c03cd5b5b6cf29133852988ea

SHA512
31b0a5c93731869f978f5bc7555d784c2a18709e8cf50961c4350520dc22ce3218f0c13ec04e56d315087cc0e46cbe258241d19ad609398b18e4dba7d3c0072d

Download Submit
C:\Windows\SysWOW64\Eegqldqg.exe

Filesize
96KB

MD5
145ba017bab07b357974ba18d20b1f8b

SHA1
13b56faf0f43b775d9ee9fcca0701ad82a1d7750

SHA256
6e622a97ae4bf338e07fa4a67dbb7b43a6afb335d0ed4ba01cfc3ac7b7c9d976

SHA512
f089e9d417c11a44542e17455628b54dce37bb822af2445d3cc7a31c8023ab596fbe078685348331560fcac7ccddeffdd612d79bdde8a3ec1adfe6be6a8fc255

Download Submit
C:\Windows\SysWOW64\Egohdegl.exe

Filesize
96KB

MD5
dfb5a8ea378bcc7929f85b6170030e4a

SHA1
8bbd5aaed7ead480e1278a58bb7c626c9ef087f3

SHA256
9f5a75f7ff616b01b89fe92c2b806abb81fc32d4127653091cc113c4aae43b88

SHA512
01868a36c04a333b051706b15531d18c58ed91fd1eff5f50d5388e48f98722aeeb9d39e847d53f2d91f1b07fe59ab96d1f8768058786d2dd10930c231782608b

Download Submit
C:\Windows\SysWOW64\Elhfbp32.exe

Filesize
96KB

MD5
5f5e2023af6075183d49b8921012643d

SHA1
c902bd0e9c8d949152790c135a85fe065f71962c

SHA256
8fc8b99f6e4ef3734e05651081ef401a8bdac20f3f9d845b0fafbb033396a9ea

SHA512
7f5d02f79e1f050c034e9944b3e67905328ad5bc181570e9b6cbae6426ced129187d9b9def6dd9d7445d1844addb9c570e51cb36079f06eb0f41b6f49b0a5fcd

Download Submit
C:\Windows\SysWOW64\Enmjlojd.exe

Filesize
96KB

MD5
a9ccae44f21200c7b0ff0b8e1dfc1c50

SHA1
28d1f462f19a153953c1d2a700262681d8673cfd

SHA256
238ab39e2c4f4767d5fceca216514b03d67f53ae327fdb9cd002a42d091e4216

SHA512
93c238930230fa7d79eb3dab26b2829b3c98e09e80490aae89ad86392100541f20e1df93c447eab98a64476dbb01eeebc72289ce97a02998f7e4bc03180a3721

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
96KB

MD5
43dc0b3acc784c9636a0a394ee1427ea

SHA1
a6b931cc9e931376933e70929f81649157c270c6

SHA256
6acff8a9d3b407ea5c44c04b71d5e502ec6dc49d3a5d47d26cf6350f6fd2e008

SHA512
603d36ed8f9fc2339042295a424503a4789705da1ddf25283c4a00397a2d11325023797666808c1a28e50f05d668780be7dfabe1dee670eaac9ddc63d05d50c5

Download Submit
C:\Windows\SysWOW64\Fbplml32.exe

Filesize
96KB

MD5
b9ab1b5960c924132192f0cef886660f

SHA1
d29338f48e51af4ad4685daa8c50652e0c32076b

SHA256
adc3c9c6a1a2d38be968f4316c746ae25038ab647afc9166819ed6190f4f2b2c

SHA512
8cac3b261a055640df660b8bd619e8836566bbd8541f73dc2ae3e183ccb2d93a7b5546fd0aeffe6200deb9f5b52692da21fbd204321f40d7a6bd1eff0feb15e4

Download Submit
C:\Windows\SysWOW64\Filapfbo.exe

Filesize
96KB

MD5
8689e979916555f6df2520a557729755

SHA1
87c4059bdb11d05552b48b939023d2268f724b7b

SHA256
448fa3835d97039a72a34f1f8cb84b5d297fac2167f56371497ce80b586f38ff

SHA512
906ca6000d8faa85ed3b6cb39bb2fbec0d65632f1adfd0a6692ad006ff8b1129b77d9274f1e0639de44285062dee6de6a8e52ff6b1c794f8399a7819d3f915e4

Download Submit
C:\Windows\SysWOW64\Finnef32.exe

Filesize
96KB

MD5
d8b3a81ce08be02b0ebabf969759a25a

SHA1
cd36ff6bd1f185320dc7268b972177ac49bc3682

SHA256
82bd45a56bfc59add0cd22fdb850110aad8becbee955b1c69e19d4268da4d657

SHA512
aaa96880380c8d8a51dd9fa204cbfc009303d123a08287b8c1d3153db6810a34bc00b09fe5eaf5f2787bfd975c383c6c152ba5a6948914edfbf49df0d7057ace

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
96KB

MD5
77acb15bd8aebd7c2c53eaa8e3d0ee82

SHA1
68971b0c8eec5a5cf81738894c22fb9030254d96

SHA256
a3c099e94ec9c347c54365a8633855184ce3f0ffa2e4b41f5c3dcb35b01f0165

SHA512
04a1da8d0ed9708c73b46ea5dea2a2baf24b0b28de711046e3de021ce786c8c1e5e679b2cea78c77cfe172b6e124c8da916d5e47edd466fdd802f53893533839

Download Submit
C:\Windows\SysWOW64\Fkofga32.exe

Filesize
96KB

MD5
85fa21197fe2192265a6627ea69aacbf

SHA1
436082c62379e495bf8f8661381567733861f203

SHA256
f8a41940d4983c2ea2e9b35e42fab6f6b26e48bffdfc4f7f53c5bdcb33f28900

SHA512
babce5d140f1e29d5fc3990d0d0f0027cb893958472432770b1dc66cdafb985d92c59c66aee2a046467a42ee55e52de043b282404acf6c864a73e0032cdeb14e

Download Submit
C:\Windows\SysWOW64\Fnbcgn32.exe

Filesize
96KB

MD5
07e76811974b98a602f785f2921fd7bc

SHA1
de76554674a082c0cf76a3ee7b9dfc28f0d7ac68

SHA256
484e0491b46e4fe102a6e49d4855d5ae7be27658d026a1f727c8d4835cf8b958

SHA512
5bc01a5202c931dff797560d8f82927503ab41f4e71a712ba561c88940b0f9ace8f6627d79df43c4863769cd5fab31c1bbc791275d254a4b4f9271fce560709a

Download Submit
C:\Windows\SysWOW64\Fpckjlje.exe

Filesize
96KB

MD5
830d7cf7e3146e404e0402ce4b8b2113

SHA1
12c0051d4bf6b221bfec8cfb19343c765a63dbf2

SHA256
9c1a34260c10d5ec7fc928f3140ae02fda2405cfba14d0fa4f87b56aa0288c5a

SHA512
bbe6e29353c5384f7390468a749ebada388ff91f17cbe1422871e0a2f6c80539ea70339e55efff0a76b060e1bda82e53815a95e6793a5f9d2ae2597071463cc3

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
96KB

MD5
626c79417ab65f4d52d0cabe128eb757

SHA1
5d57ea3870cb5418debaa65df3a16d01b5388f7c

SHA256
e047d460a0f81693f2a54e213c98451c253950123465b82cb3a7d937e816fbbf

SHA512
e9230a97d1aca93238624b7003b75e5011e67ed4e1024baef4bc686d4dac653d16cec5fb040909e2b8bb2afffe7c19e492937be7a75080ae4ac009d5e8fa7473

Download Submit
C:\Windows\SysWOW64\Geklckkd.exe

Filesize
96KB

MD5
d2adb3e20b8e1cc25f966cfce0b7a68c

SHA1
02dfefece74ad24f14c2645eadb1674362dd9a82

SHA256
570a407f81f401058728fffb36222277cbfb21f5295bdcf08b550f1ee145863f

SHA512
92f5fdcba367ecabff9cdfb76b0dc66d675926a07275189fcae3178cf095e0bf8f97d52f7a228c2ed030c3f45f3a5986b714883b0961faa3952d09ec8fe8dbf3

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
96KB

MD5
dfebc4ac17abe34101ee04d9e3f94ff5

SHA1
8e79a6bf5ef45e62d66190cc5690397e91a6b502

SHA256
0523d03d20c5ccc7ee6cb3fbcc8ec85bbed52c650c3425686f68ee21693a29e3

SHA512
f8664940b98b1efe2cc216112ec66a4efa45031e5ba2eeb9142d0db7dc3a9cd77be07d06da9971dc0c47176f16c66346e31d82723baaee0fc9d82763ffe6467a

Download Submit
C:\Windows\SysWOW64\Glfmgp32.exe

Filesize
96KB

MD5
44d6ba9dd30cd5fbb2b9c9a39baea1d0

SHA1
0db372f25fb379620df68bb3926e7d6e10837a94

SHA256
3d6952cdb5f17c5bd4012721b6a02ad8eda14201fb87db0739cc4a2d04f52d33

SHA512
25211b6f4922aee54fd640cc661172a6f2dd9fbcc744367c942aebfc9504c1e199e7a12bda0fdfad2e9211a1ecf124643e902481a057582b5163c2adfb1b458b

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
96KB

MD5
5a4cd9e89cf6bef026df0a07d6b3bc2d

SHA1
e2d3d9dc2bb373b177084e0e9a334371d381e5ca

SHA256
940c6bc6e6615de57d1e91010388ec3d523b83f22661778c9806f971b9343886

SHA512
9f876fd8605fe388b9b7b46859c029353f1da6ad97b4e94044ee2b583824f6e841a1c1256f6f59877a42f93c0408bc96affdc958034571faf528e1e57d44a373

Download Submit
C:\Windows\SysWOW64\Haidfpki.exe

Filesize
96KB

MD5
7fec9e271465335d33257d2afa1e515c

SHA1
13b267ad22d479d2ba8ad7ae4aa6b34a7c3a24cf

SHA256
909e0e6668b93c6ae01d18f4341072db00ae136920b8cfc701621728899505ed

SHA512
7cf735ece505687eca59370a7490950fa7342652824f6cae3fb4fa98d5f55d77d28f26e747d32068c1bcc13d0d5febfdffa344180ab71a2c78bf765c9520dd53

Download Submit
C:\Windows\SysWOW64\Halhfe32.exe

Filesize
96KB

MD5
1343fb7fbba8c5594605183b54eaa6fc

SHA1
f469595fb36e83c56a4b906b2379744378cc7c3d

SHA256
0b62b01383b0a7fff6d2a1fefb5adde2d29b70af6921153665790c7c948dfe46

SHA512
bd482513f2dea1c8f1df89fc89d39be2449995a9565e3e65463e34421749c3f4f9495731f8d97bd9d7980e90f35cd0eef51d4d76e8bae937a94e408756abb87c

Download Submit
C:\Windows\SysWOW64\Hlfpph32.dll

Filesize
7KB

MD5
d632d37fdc12ea355049fc3bdc000e34

SHA1
a380248dbd92b832a9361fb889b25c686928b3f8

SHA256
30055e88ceb1716005ce7e5a29725486cb76b7ab27d1c105fcdfcba64af94e1f

SHA512
2ce549a757aaad089fe73e360971cbb05120770edb2d64793801e62850af1fbf2ddf46b3085a51196647bd8e88dc1be0508ee8835cf0702e318a6628e7eb78f0

Download Submit
C:\Windows\SysWOW64\Hnlodjpa.exe

Filesize
96KB

MD5
ab523f27483ef8d3b57f37806f7f8afb

SHA1
6f0a8d9105e0b38363b8cbaeb9f4c59d5e770944

SHA256
a7c4034de3d8fa111b39def23856a684e9f58413bfe029fa46d5b28e38427d4f

SHA512
1eb7e8fdad50965c74a540c443c7da734eb16d7ce6337334b1e5b471d811dc9d3255cf127a4e84542ad236a7c7082beabf08281789f1cf05757f2395329fb6c2

Download Submit
C:\Windows\SysWOW64\Hnphoj32.exe

Filesize
96KB

MD5
a6a281d41fdaebe4d8f44f08808c7862

SHA1
d8a962434b11224634ebf8d381779849c7b1aeb6

SHA256
ff4a9833f920db5379cb30b7aaf7328a8ad1cbd3246d29812682e6932c0e4b05

SHA512
5860c1264a1e309a6fcb380684bc382ba2eb18270225557c962b94efa8f199739f0253900b749c9caf522e780e5c03d375345a2200ebc56e456d7e6c6b6cbf3c

Download Submit
C:\Windows\SysWOW64\Ipbaol32.exe

Filesize
96KB

MD5
fae29ffdf60c0d0743b9efdf59e4de8b

SHA1
94440b21911db593514eb7484a4dafdc6b0b3c68

SHA256
0a647bc8de48fa26a0bec390a6085794d98564660e0799a430631dcb828e6288

SHA512
51b20bdbc94f63cb2f5630af36042f191b954ec17f8e512618da720470ab123d171fa80f77722c073628610d1d191b8c1b4d13191027bc48fcd5ab11acaae35f

Download Submit
C:\Windows\SysWOW64\Ipihpkkd.exe

Filesize
96KB

MD5
571e6fc53d81dab5b7121e5028453b57

SHA1
38972b1d05f9777cc54976c7f898ea53253e0ba1

SHA256
80b4b72ce632b0f0aa7a35060c993c4e39d28c3c6d44bb69fcf887422221b056

SHA512
c7f2612df83f8a261f48e451c5fecf202f2369858770456077f91cee1976514d90fced245bea8a1e6766896cff71e7b90f578b3507855d6779950eed389fd712

Download Submit
C:\Windows\SysWOW64\Jpbjfjci.exe

Filesize
96KB

MD5
13254b4dfb5e352539ddaee915bcfa48

SHA1
4ed27d39b4e580177a33cca3e74130fd19ab9853

SHA256
37b82447c41e7038fd10cfed4f1d8708201a9571ea622d672c9c6f87535015af

SHA512
0fe5c97c790b4b12cac51ccf3206d3036edca353a73ef99a006c31f87b6e7ad3e7e26e5286a1b54533d735372186182e1da841b09306d6a89c6fd4125b1eaa72

Download Submit
C:\Windows\SysWOW64\Lccdghmc.exe

Filesize
96KB

MD5
522efa79fce36d47a9c02a4e840cdfd0

SHA1
46dadf0b13748a3559d2404329997cc81aa4e25c

SHA256
434a74be7f1d348ee2ace714339d87376cbf1b3a5ba1f2d7b1b31fda5a32e50f

SHA512
79da7a80c279d2292970549aded36bc4452f9e46b2c7892191d900f3f10ceebca43772b0cdba0bfa8051c0aee4c3c346d205b8df71d29b9239c1fdf0c155209b

Download Submit
C:\Windows\SysWOW64\Ogefqeaj.exe

Filesize
96KB

MD5
a1b08bbe8d00ba88a3850f3e10a5acd3

SHA1
6f90c2c92fea95b3fbc3638ff967bece3c8c2223

SHA256
cd8bce72dfccc15c19699b8cfa55ab3e58b5451a9bb60a405dbcafa06351c9bf

SHA512
6431b8ececf37cacbb0743b90fe1539a53568efe5417636dc01c9c9ef984a39fef562d4b92f246a386e7439c843fee49ff03da56b929fa44aa9e05df872fa870

Download Submit
C:\Windows\SysWOW64\Ohnljine.exe

Filesize
96KB

MD5
038b9f276f0865763be2df644bf52e1d

SHA1
ae23ce59428005be36a080ab5995eb1d8a825bd2

SHA256
877275f0b33e73d7d2e0db24ea08f597085d994bc4efb7864dc226662e97633b

SHA512
ba6fb7ea9dfa8acf807d0efee7198a46f049f1f4275170ea338d410483e7a9f6cc683fe776631b136ae84384272672dd2bb8e563e29c869f0bf48078c32f8d18

Download Submit
memory/212-239-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/644-316-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/936-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/996-128-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1020-382-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1076-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1080-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1180-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1252-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1260-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1392-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1504-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1532-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1548-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1616-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1644-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1748-364-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1812-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1868-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1880-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1896-216-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2212-406-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2256-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2320-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2332-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-422-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2696-412-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2728-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3048-446-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3140-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3488-232-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3564-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3644-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3672-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3708-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3884-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3920-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3964-160-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3972-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3980-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4028-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4032-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4052-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4116-370-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4184-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4296-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4364-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4412-340-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4440-208-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4472-322-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4496-424-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4600-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4656-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4672-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4704-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4712-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4784-352-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4812-95-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4824-394-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4944-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-103-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5092-328-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads