49a0a1f4e43b2c0dfeb0341d30fca4bfc099c2c7ca3f355761b394489fb62e33

Analysis

max time kernel
138s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe
Size

128KB
MD5

fd2a912327be4663a65c58ae47a93df0
SHA1

e9268a8d641bb5571ff5d1188a2c0599fc286756
SHA256

49a0a1f4e43b2c0dfeb0341d30fca4bfc099c2c7ca3f355761b394489fb62e33
SHA512

effd976952cbaefa740c1ab2abd153e8f6affc0ca2aaf4552653b48f9a678604f86b0f8f6fe5b35968f1c158fc6b82746980e740d12adef609ec30d9c40b4a13
SSDEEP

3072:cZowQX8t6kF4xrzEAk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:KGURaFzEAFtCApaH8m3QIvMWH5H

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eekaebcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hapaemll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifhiib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obfhba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blbknaib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cefoce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbgbgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbddcoei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdjfcecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbmncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbdjfln.exe

Executes dropped EXE 64 IoCs

pid	Process
880	Gjlfbd32.exe
4400	Gqfooodg.exe
1404	Gfcgge32.exe
4368	Gjocgdkg.exe
2612	Gpklpkio.exe
1916	Gbjhlfhb.exe
4044	Gjapmdid.exe
916	Gqkhjn32.exe
1292	Gcidfi32.exe
3016	Gjclbc32.exe
1612	Gmaioo32.exe
5072	Gppekj32.exe
868	Hfjmgdlf.exe
4504	Hihicplj.exe
3616	Hapaemll.exe
3788	Hfljmdjc.exe
4584	Hmfbjnbp.exe
912	Hbckbepg.exe
1152	Himcoo32.exe
1728	Hadkpm32.exe
4688	Hbeghene.exe
1904	Hmklen32.exe
4284	Hcedaheh.exe
4408	Hfcpncdk.exe
4032	Hibljoco.exe
4384	Ibjqcd32.exe
712	Ijaida32.exe
3904	Ipnalhii.exe
2796	Ifhiib32.exe
752	Iannfk32.exe
3184	Ifjfnb32.exe
4792	Ijfboafl.exe
3188	Imdnklfp.exe
2076	Ibagcc32.exe
2576	Ijhodq32.exe
2420	Imgkql32.exe
4224	Iabgaklg.exe
4648	Idacmfkj.exe
5080	Ifopiajn.exe
1644	Iinlemia.exe
2492	Jaedgjjd.exe
4852	Jbfpobpb.exe
1520	Jjmhppqd.exe
1756	Jmkdlkph.exe
1540	Jbhmdbnp.exe
2692	Jibeql32.exe
5104	Jaimbj32.exe
1052	Jdhine32.exe
4128	Jidbflcj.exe
3020	Jaljgidl.exe
1532	Jdjfcecp.exe
228	Jfhbppbc.exe
1452	Jigollag.exe
4500	Jmbklj32.exe
1968	Jpaghf32.exe
4200	Jbocea32.exe
1600	Jkfkfohj.exe
3520	Kmegbjgn.exe
5048	Kpccnefa.exe
5060	Kdopod32.exe
640	Kgmlkp32.exe
4800	Kmgdgjek.exe
1768	Kpepcedo.exe
1784	Kbdmpqcb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Donfhp32.dll	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Qekdppan.dll	Jidbflcj.exe
File opened for modification	C:\Windows\SysWOW64\Pndohaqe.exe	Pgjfkg32.exe
File created	C:\Windows\SysWOW64\Febgea32.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Bfajji32.dll	Lfkaag32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pflplnlg.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Qjpiha32.exe	Qgallfcq.exe
File created	C:\Windows\SysWOW64\Iphkfg32.dll	Bhaebcen.exe
File opened for modification	C:\Windows\SysWOW64\Eekaebcm.exe	Eoaihhlp.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Ogkcpbam.exe
File created	C:\Windows\SysWOW64\Hmhhehlb.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Gjclbc32.exe	Gcidfi32.exe
File created	C:\Windows\SysWOW64\Bejkjg32.dll	Hfljmdjc.exe
File created	C:\Windows\SysWOW64\Ebkdha32.dll	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Hchcofhp.dll	Ogljjiei.exe
File created	C:\Windows\SysWOW64\Jigollag.exe	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Gjapmdid.exe	Gbjhlfhb.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Ecaobgnf.dll	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Bblckl32.exe	Bopgjmhe.exe
File created	C:\Windows\SysWOW64\Njkdbljm.dll	Eoaihhlp.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File opened for modification	C:\Windows\SysWOW64\Jdhine32.exe	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Fojjgcdm.dll	fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Jibeql32.exe	Jbhmdbnp.exe
File opened for modification	C:\Windows\SysWOW64\Aldomc32.exe	Aejfpjne.exe
File created	C:\Windows\SysWOW64\Dammlf32.dll	Hijooifk.exe
File created	C:\Windows\SysWOW64\Pkajcp32.dll	Pndohaqe.exe
File opened for modification	C:\Windows\SysWOW64\Cbjoljdo.exe	Conclk32.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Jibeql32.exe	Jbhmdbnp.exe
File opened for modification	C:\Windows\SysWOW64\Pbkamqmd.exe	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Ddmhja32.exe	Dekhneap.exe
File created	C:\Windows\SysWOW64\Gdeqhl32.exe	Gbgdlq32.exe
File created	C:\Windows\SysWOW64\Nmfgdeof.dll	Okjbpglo.exe
File opened for modification	C:\Windows\SysWOW64\Eabbjc32.exe	Ekhjmiad.exe
File created	C:\Windows\SysWOW64\Lcnhho32.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Nhmkghpm.dll	Pbddcoei.exe
File opened for modification	C:\Windows\SysWOW64\Bdhfhe32.exe	Bnlnon32.exe
File created	C:\Windows\SysWOW64\Qdchadai.dll	Bopgjmhe.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Dkljak32.exe	Ddbbeade.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Ilidbbgl.exe	Ieolehop.exe
File created	C:\Windows\SysWOW64\Ehifigof.dll	Jaljgidl.exe
File created	C:\Windows\SysWOW64\Nggdeh32.dll	Aejfpjne.exe
File opened for modification	C:\Windows\SysWOW64\Gbgdlq32.exe	Gcddpdpo.exe
File opened for modification	C:\Windows\SysWOW64\Ibjjhn32.exe	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Hbeghene.exe	Hadkpm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10760	10388	WerFault.exe	535

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Libddmim.dll"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcpopjlq.dll"	Bhkhibmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbbdholl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdnaigp.dll"	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcjpfk32.dll"	Lepncd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Peqcjkfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkffog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcfhof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adijolgl.dll"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnhfnh32.dll"	Cacmah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmhhehlb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mngoghpn.dll"	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbddcoei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacmah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekjfcipa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphqml32.dll"	Kmegbjgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfoafi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggdddife.dll"	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qchmagie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mchqfb32.dll"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgnjkdco.dll"	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbgdlq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 880	928	fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe	83
PID 928 wrote to memory of 880	928	fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe	83
PID 928 wrote to memory of 880	928	fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe	83
PID 880 wrote to memory of 4400	880	Gjlfbd32.exe	84
PID 880 wrote to memory of 4400	880	Gjlfbd32.exe	84
PID 880 wrote to memory of 4400	880	Gjlfbd32.exe	84
PID 4400 wrote to memory of 1404	4400	Gqfooodg.exe	85
PID 4400 wrote to memory of 1404	4400	Gqfooodg.exe	85
PID 4400 wrote to memory of 1404	4400	Gqfooodg.exe	85
PID 1404 wrote to memory of 4368	1404	Gfcgge32.exe	86
PID 1404 wrote to memory of 4368	1404	Gfcgge32.exe	86
PID 1404 wrote to memory of 4368	1404	Gfcgge32.exe	86
PID 4368 wrote to memory of 2612	4368	Gjocgdkg.exe	87
PID 4368 wrote to memory of 2612	4368	Gjocgdkg.exe	87
PID 4368 wrote to memory of 2612	4368	Gjocgdkg.exe	87
PID 2612 wrote to memory of 1916	2612	Gpklpkio.exe	88
PID 2612 wrote to memory of 1916	2612	Gpklpkio.exe	88
PID 2612 wrote to memory of 1916	2612	Gpklpkio.exe	88
PID 1916 wrote to memory of 4044	1916	Gbjhlfhb.exe	89
PID 1916 wrote to memory of 4044	1916	Gbjhlfhb.exe	89
PID 1916 wrote to memory of 4044	1916	Gbjhlfhb.exe	89
PID 4044 wrote to memory of 916	4044	Gjapmdid.exe	90
PID 4044 wrote to memory of 916	4044	Gjapmdid.exe	90
PID 4044 wrote to memory of 916	4044	Gjapmdid.exe	90
PID 916 wrote to memory of 1292	916	Gqkhjn32.exe	91
PID 916 wrote to memory of 1292	916	Gqkhjn32.exe	91
PID 916 wrote to memory of 1292	916	Gqkhjn32.exe	91
PID 1292 wrote to memory of 3016	1292	Gcidfi32.exe	92
PID 1292 wrote to memory of 3016	1292	Gcidfi32.exe	92
PID 1292 wrote to memory of 3016	1292	Gcidfi32.exe	92
PID 3016 wrote to memory of 1612	3016	Gjclbc32.exe	93
PID 3016 wrote to memory of 1612	3016	Gjclbc32.exe	93
PID 3016 wrote to memory of 1612	3016	Gjclbc32.exe	93
PID 1612 wrote to memory of 5072	1612	Gmaioo32.exe	94
PID 1612 wrote to memory of 5072	1612	Gmaioo32.exe	94
PID 1612 wrote to memory of 5072	1612	Gmaioo32.exe	94
PID 5072 wrote to memory of 868	5072	Gppekj32.exe	96
PID 5072 wrote to memory of 868	5072	Gppekj32.exe	96
PID 5072 wrote to memory of 868	5072	Gppekj32.exe	96
PID 868 wrote to memory of 4504	868	Hfjmgdlf.exe	97
PID 868 wrote to memory of 4504	868	Hfjmgdlf.exe	97
PID 868 wrote to memory of 4504	868	Hfjmgdlf.exe	97
PID 4504 wrote to memory of 3616	4504	Hihicplj.exe	98
PID 4504 wrote to memory of 3616	4504	Hihicplj.exe	98
PID 4504 wrote to memory of 3616	4504	Hihicplj.exe	98
PID 3616 wrote to memory of 3788	3616	Hapaemll.exe	99
PID 3616 wrote to memory of 3788	3616	Hapaemll.exe	99
PID 3616 wrote to memory of 3788	3616	Hapaemll.exe	99
PID 3788 wrote to memory of 4584	3788	Hfljmdjc.exe	100
PID 3788 wrote to memory of 4584	3788	Hfljmdjc.exe	100
PID 3788 wrote to memory of 4584	3788	Hfljmdjc.exe	100
PID 4584 wrote to memory of 912	4584	Hmfbjnbp.exe	101
PID 4584 wrote to memory of 912	4584	Hmfbjnbp.exe	101
PID 4584 wrote to memory of 912	4584	Hmfbjnbp.exe	101
PID 912 wrote to memory of 1152	912	Hbckbepg.exe	102
PID 912 wrote to memory of 1152	912	Hbckbepg.exe	102
PID 912 wrote to memory of 1152	912	Hbckbepg.exe	102
PID 1152 wrote to memory of 1728	1152	Himcoo32.exe	104
PID 1152 wrote to memory of 1728	1152	Himcoo32.exe	104
PID 1152 wrote to memory of 1728	1152	Himcoo32.exe	104
PID 1728 wrote to memory of 4688	1728	Hadkpm32.exe	105
PID 1728 wrote to memory of 4688	1728	Hadkpm32.exe	105
PID 1728 wrote to memory of 4688	1728	Hadkpm32.exe	105
PID 4688 wrote to memory of 1904	4688	Hbeghene.exe	106

C:\Users\Admin\AppData\Local\Temp\fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\fd2a912327be4663a65c58ae47a93df0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\Gjlfbd32.exe
  C:\Windows\system32\Gjlfbd32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\Gqfooodg.exe
    C:\Windows\system32\Gqfooodg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\SysWOW64\Gfcgge32.exe
      C:\Windows\system32\Gfcgge32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4368
      - C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        23⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        24⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        26⤵
        Executes dropped EXE
        
        PID:4032
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        27⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:712
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        29⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        31⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        32⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        34⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        36⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        37⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4224
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        39⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        40⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        41⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        43⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        44⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        45⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        47⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        49⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3020
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        54⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        55⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        56⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        58⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        61⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        63⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3264
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        67⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        68⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        69⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        70⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        71⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2184
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        73⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        74⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        75⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        77⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        78⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        79⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        80⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        81⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        82⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        83⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        84⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1692
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        86⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        87⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        89⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        90⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        91⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        92⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        93⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        94⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        96⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        97⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        98⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        99⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        100⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        101⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        102⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        103⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        104⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        105⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        106⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        108⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        109⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        110⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        111⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        112⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        113⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        115⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        116⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        117⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        118⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        119⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        120⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        122⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        123⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        124⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        125⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        126⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        127⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        128⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        129⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        130⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        131⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        132⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        133⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        134⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        135⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        136⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        137⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        138⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        139⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        141⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        142⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        143⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        144⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        145⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        146⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        148⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6556
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        151⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        152⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        153⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        154⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        155⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        156⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        157⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        159⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        161⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        162⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        163⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        164⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        165⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        166⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        167⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        168⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        169⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        171⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        172⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        173⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        174⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        175⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        176⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        177⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        178⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        180⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        181⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        182⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        183⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        185⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        186⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        187⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        188⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        189⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        190⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        193⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        194⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        195⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        197⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        198⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        199⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        200⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        201⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        202⤵
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        203⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        204⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        206⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7448
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        208⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        209⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        210⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        211⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        212⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        213⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        216⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        219⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        220⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        221⤵
        Drops file in System32 directory
        
        PID:8064
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        222⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        223⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        224⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        225⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        226⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        227⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        228⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        229⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        230⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        231⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        232⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        233⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        234⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        235⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        236⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        237⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        238⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        239⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        241⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        242⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        243⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        244⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        245⤵
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        246⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        247⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        248⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        249⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        250⤵
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        251⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        252⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        254⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        255⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        256⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        257⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        258⤵
        Modifies registry class
        
        PID:8096
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        259⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7628
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        261⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        262⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        263⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7696
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        265⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        266⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        267⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8256
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        268⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        270⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        272⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        274⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        275⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        276⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        277⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        278⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        280⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        281⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        282⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        283⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        284⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        286⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        287⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        288⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        289⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        291⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        292⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        293⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        294⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        295⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        296⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        297⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        298⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        299⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        300⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        301⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        302⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        303⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        305⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        306⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        308⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        309⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        310⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        311⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        312⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        313⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        314⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        315⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        316⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        317⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        318⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        319⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        320⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        321⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        322⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        323⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        324⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        325⤵
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9248
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9292
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        328⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        329⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9424
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        331⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        332⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        334⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        335⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        336⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        337⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9820
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        340⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        341⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9956
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        343⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        344⤵
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        345⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        346⤵
        Modifies registry class
        
        PID:10128
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10184
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        348⤵
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9268
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9408
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        352⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        353⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        354⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9652
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        356⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        357⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        358⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        359⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        360⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        361⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        362⤵
        Modifies registry class
        
        PID:10180
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        363⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        364⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9452
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        366⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        367⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        368⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        369⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        370⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        371⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        372⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        373⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        374⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        375⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        376⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        378⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        379⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        380⤵
        Drops file in System32 directory
        
        PID:10124
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        381⤵
        Drops file in System32 directory
        
        PID:9416
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        382⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        383⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        384⤵
        Modifies registry class
        
        PID:10116
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        385⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2940
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        387⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        388⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        389⤵
        Modifies registry class
        
        PID:9444
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        390⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        391⤵
        Modifies registry class
        
        PID:9628
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        392⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        393⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        394⤵
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10420
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        396⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        397⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        398⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        399⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        400⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        401⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        402⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        403⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10812
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        405⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        406⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        407⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10988
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        409⤵
        Modifies registry class
        
        PID:11032
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        410⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        411⤵
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        412⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        413⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        414⤵
        Drops file in System32 directory
        
        PID:11252
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        415⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10340
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        417⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        418⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        419⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10592
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        421⤵
        Drops file in System32 directory
        
        PID:10656
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        422⤵
        Modifies registry class
        
        PID:10708
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        423⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        424⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        425⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        426⤵
        Modifies registry class
        
        PID:10932
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        427⤵
        Drops file in System32 directory
        
        PID:10976
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        428⤵
        Drops file in System32 directory
        
        PID:11020
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11084
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11136
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        431⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        432⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        433⤵
        Drops file in System32 directory
        
        PID:10284
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        434⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        435⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        436⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        437⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        438⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        439⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        440⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        441⤵
        Drops file in System32 directory
        
        PID:11064
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        442⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10248
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        444⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10388 -s 408
        445⤵
        Program crash
        
        PID:10760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 10388 -ip 10388
1⤵
PID:10664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aacckjaf.exe

Filesize
128KB

MD5
2f054374bc2910252cb812036887db98

SHA1
fa22c6625e12f8becdd3852e62a0e6a5b50de4dc

SHA256
db183e85ff55ba7e732e83abdb2d319a8aa395f83727a38c2f0e4cb79f6b45d0

SHA512
4c0bdc0f9df258d7e59c5b4d336eecd4697e2eb4232dc910a75e1d8fa8ed8980c52abf2d620e5e4238cec0cffc968d39dcf29bd5fcc7452c8fd2d245ada851a6

Download Submit
C:\Windows\SysWOW64\Abemjmgg.exe

Filesize
128KB

MD5
52d5aab9a74cf991eca641f90070cfa7

SHA1
568e87ebcb79d366727b9b6c44035c0684812c01

SHA256
39076601be889efad6b25e2219fb93ef10c27eb2cdcaf8bf6637aaa2f5b3747a

SHA512
1ba7ca013752805bec4816e79034b035a84809e6529eb93b2e61aa74e5127f36b6ad5f285964d41f9177260fec317749d7276f6461fbd768179ea370f86b76a6

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
128KB

MD5
08e37bd1918217d3ae33d41854e4c843

SHA1
c0b70bd62bb7daef22f3f085a6287893e1827163

SHA256
7cb67d099354c4414310bd1d2096429e01542735779105166b91826489db391d

SHA512
92f439f552456cfc9fc6082f4554979db147dc8d4774b6f891757927feee066ff87497b6e343ca990d32abbe581de49e45638ed0f3707ccad956e93abcafb374

Download Submit
C:\Windows\SysWOW64\Baaplhef.exe

Filesize
128KB

MD5
a5d97359f75fa4d5e8051ca8cc8a8f57

SHA1
0e3007e110bf8c072877065bac230bfafbbea310

SHA256
9481dd5e6bec6094d42f6d10c4e95ee0c9436c5c5aef3abb61954d4b9dc3565c

SHA512
8454334925c31f8cac4cb9e1bfc406a87922f2054055afb4c0385c9b858613507398e69aac3f998c740079f185a5d9afd544e9b95818505643bde2f1aa54f093

Download Submit
C:\Windows\SysWOW64\Bblckl32.exe

Filesize
128KB

MD5
6b2127e1ccb561af994eb96d1991d01a

SHA1
acc113f1bf8baaeb78dd2d27088dfbd779e98b43

SHA256
da6dca63a5d82a53fc9e41c714f66276b079035e7f5f1c7da0f4af0be623c1d7

SHA512
11b7546b02545a7be17121bf02248d6069d372ced77ae169204cbeeaac3a082e316e8fbfdc260bee35005328c61da0a22bddfff54b6be58d8ecd8610563f0f69

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
128KB

MD5
c86fe87442e4c45ef16dcceebc88cade

SHA1
0e75dff10a08882cb0fada73894fc7dd16114ec1

SHA256
46233c47e632efd4d664c368d211d4fe3cca75199d6f4791e0dff78fd6513508

SHA512
ef98de82708efeaa62f5c37cc127eecc1eec5ad0a2dfc6a764262121101231eecd3c17cbd969d140ca1a3e502eb1a38c5f6131e8317a286252aa709d460af4f0

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
128KB

MD5
72ccde38cf0f7b24b968f9f89294706d

SHA1
0c24e83288e8c586c20b3392bac12291e783a744

SHA256
9fd6283092eaf7ba08ea61cb770674c285fedecc4148b6ea733669047633498e

SHA512
84e3af1dbfbb4e9a0b0b27b3af9fbb4f530500aee5c22bfdf6f217d8aca5ee8aa692b3ee5c3eebd6d3d35a9e9f1e246af50a218326b3efb85320e27b0ed838a4

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
128KB

MD5
98e6d01f5fc516309b90d71f67810cfc

SHA1
875b2f512ffc057c98de1e072c55dbbc86f07325

SHA256
0e0beb7dad221a2a8e28a9ffa15d5fad86034df15181045209b91ca4bcfb7546

SHA512
8b43a3c57dde883a9b3f991bc3bcc05a71c7e3130cba8e45b3cd1ce445577bdd2fec79ea9bba2a7ad6f7592d6021c76d9e4df05d5ae1104d4a4e65a14d899e24

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
128KB

MD5
d46b95ffe524eb7efb624270e83db1d8

SHA1
b01ad4a3407d4793408cd970252392ee23bd60f4

SHA256
27ea6e8d3f6bcf02e8feaebdc9cf4a5548a69b63b2d52325ec919594c30f86b2

SHA512
1b88320adc7ee4220fa202b87cd5087fb9b3ad2b3bb4ce695b6aba66f942f844c8c51c7a5f2f3183fc4403b147fa6ace97f7183a350588672ecdb21bae62a2a8

Download Submit
C:\Windows\SysWOW64\Clbceo32.exe

Filesize
128KB

MD5
8dd72026ef42bef1412cab72aa710ddd

SHA1
461b70771ef65d8569f28b5eee9c73a4a75f220e

SHA256
6527c7d2dd67c132d264ff961ca46afbd5f68683d2827ca9e9d6afc77e6bc82e

SHA512
8fa569dc2f3b02846231357ca047637412130d42132e6b09eda22c6f0bbad18bb6778e70a4f8c3054f1b173fd63711305939586565ba670856861704227d8406

Download Submit
C:\Windows\SysWOW64\Clkndpag.exe

Filesize
128KB

MD5
f06904bb00a460b049201b0678a40fe5

SHA1
72ffdb5141349694db1de61362af1a4378f2c134

SHA256
66481bba0b09de7e1634cca268fa3ce3fdd45cd24eaf1bb48720105fbbec250d

SHA512
4abceabf6732403e6fc2a12c9ffc31cd4bcd4c7a843d66595b1b3eeaf7bb9b7f92b92a1fa1cf56feb2e8c2ee48daacec55fa47a5e15763ccbfe6fcf4b36cad5e

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
128KB

MD5
3a44e4c41e598af2fefe2fb5ce4bd5de

SHA1
b84688d54812774e9663b44385ac0c95ef345b5f

SHA256
18fc84c43431ae0232bcaa806ada5ba6e89e9843b11c00f9c9d8954b31171fff

SHA512
7402905041400976797c30f73e669e00be06cca74d3c225f25c94946000ac46cb6c724ec7aac0859b44932a1457e33f1c7bb13ca4d5871e9717a25a00195aff3

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
128KB

MD5
f660d8cee69f31f5f6e4bdbabe011bce

SHA1
ffff73185036df6c9f61087955508da6cae38cb6

SHA256
05892528f1102792563c08069a02231ad83a6b947e56da62875c2aed41b0b33a

SHA512
75c4bd2eccd622490323759790f14823a27d7627cf3662fd6562bbfffa80b447e4165fd2da5606b7ef5bd56010ce1a63d993300c3345095ab2e410d6201783ef

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
128KB

MD5
c9ed7b31cf12a2b38cdb2f2546ef4f1f

SHA1
4481986b1530e6dae9480f4c07e8a46dc5e0e554

SHA256
00997a4df8e7a6a2de8ca9f184585d3443de640d6258aad56eeffe4069d30337

SHA512
923dc6a3bbac051734119896277eb58598607a629025ac29e2de58e0eee1a012f8a2500c9f1f8135e5e59049af5d9449c8d8e07cf2b57a90673ce95bf74b8a91

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
128KB

MD5
971f87ef29bf1e43e35d14f7c9b66dfd

SHA1
81e8e3d63d1ae82f89a416dfe9bae1dc7947a55f

SHA256
e6d4c5bd7245490a25a14b22c80e4e3e248942d89b73c0a4f89863d4fe1bf41d

SHA512
d9054e6b94f3fefb02ab8abb9092ba18aa4fcd82c6cb18578da8e9ed4a641462715a385aec059af7df120a4236be6c8e400763519e6ce548c3f53169aae83be7

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
128KB

MD5
7cfbabd88f6cc1c2ed8438b3738a39b5

SHA1
4d261713378f68683dc645ed151a155dabab8887

SHA256
4398720f351870b27564b5585048687486ce3538d5a0379765aa3b7fbd18b970

SHA512
f6bc9d3c2cde5b57d11cfeae4e5d1a25c380fef85cbff1e09059c62d77cfff8de88f8ad55cd295aa1d78757c4b906ce5ef11764558a1dd488c4faeb49cc86d69

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
128KB

MD5
0c103939ac9e01e52acd0260fcb16624

SHA1
5a1e5dd638e5907aef714becd8761b3d1dabf85f

SHA256
e4f2f6be6fef2fca7edffca479a4c9ed02749b701ec0f408034300d2a8533add

SHA512
b89222048de001898bf9425b89fec0323798846fbd6ffa9092df4ecdf239f99e03e59a85b3f95ceaaa6e1baff2d1c1426b74dd9b4036b7b831e391485266bc6b

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
128KB

MD5
04fe190c00df9fba49fa7bd153b709e3

SHA1
79d8744ecff12b0711a69751f0b1073a28533063

SHA256
11ef89785af5f2c55a339422defc8bf7422769a2d304dd798f3cabe14651864d

SHA512
e2c006c82f37f9965ad857eb012e4650bb786022e1d35dc38a22d97ef39b99c002114be350a26a6d5a43bd45e2d8e06b70cb1f16faacb2c312d0ab82d4cbf064

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
128KB

MD5
c773bf2d5c00d5af8043bf95028b2177

SHA1
78965cfd9afde400850e4e0d7700a0f8de6309a8

SHA256
b2bc644a05bab8b7b025fb815382a2cf79183f9cc9c642431ec37a183bc26a06

SHA512
0b0791265913a4020a457a6e9daf1f5a51c3d5366faa0af1164986d7a663a4adad29515fe696687b772d7e0ffb21becbffb8586d8be37d575c6d472166adee69

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
128KB

MD5
4747bfbd0ca29be6b3ad43698c714f81

SHA1
3f953a90dfc9062ca75435857c4cac16c49f1de7

SHA256
7d1d7a46006e2390a4538e6165c1c767a1164486ff161630dcb8fa50dfbb2291

SHA512
8801e40212b50cd91c71e67204a0533744e039ca9ec22c75cbc3f9e9cec0ce672ed1fd2e1717db251b68649589deafeba7eb1fc1dcc59f5b44d2e19131c00554

Download Submit
C:\Windows\SysWOW64\Gbjhlfhb.exe

Filesize
128KB

MD5
b6cf5b6722803433263219ce677bc8d7

SHA1
f671267dee949b36e9c10df1850e8f9bd98671c9

SHA256
cb1e650cec60dd843e33d10cfc4018e39990581d86a6437636b23b7fffc160ee

SHA512
7f3b33d7e2e70542c151f09da11841acb4b82ee9e5593afe62c634d2e0aaff79d8c08c39ea364e7277be58a38712321a737adcaf5a23437ede86d3b49fb8c55b

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
128KB

MD5
21a66015de0cabe1305cb83c7132eb1b

SHA1
3a75faef87e3c82271db21ec453c77be004c0fbe

SHA256
827a98d7bef0812c8f4d499a1f35a3b7656d9776cc269ad903232d2285d67f72

SHA512
416e9d796333cc4191a2356c18288d08cb63ed2e18010e9626ae741a93d0747c21465842bd3b9b91240765fa59883da426ddebb1d828230ca17087d7a1d0f3fd

Download Submit
C:\Windows\SysWOW64\Gfcgge32.exe

Filesize
128KB

MD5
53f80904970d370ecdec6d8ddd07f98e

SHA1
3ee6e80f453fd159880bf05f5456d612ab744641

SHA256
bb6a6ac96c1e07ab16d66b15a1da4527b2952168b2cfe2df275cdead95723a0a

SHA512
7ebcc05a37039a15be195f8dd589ae09095e3b32019f64a9f61a52acf34f5c20ee167abd5e4c14a9f1d716aa3bc8d8332e4cda66f0f015c8d8302576d7b5661d

Download Submit
C:\Windows\SysWOW64\Gjapmdid.exe

Filesize
128KB

MD5
d0669c6d319a7f4ab8a512ec43f7ad64

SHA1
917fe5790ee1a347c110319d6dddfa671dc72937

SHA256
5181bc6843560ccd181c172c707368f95e74cedc4d8d0eeeca8c6a23c71df877

SHA512
7a152124f33bfe171ca9627a67cad9888f717c3d8f191521b22be18e8e52aa2fd9cba2a5ca87726134986286df3ac55da45cb9513936de82d401f82cd749edd1

Download Submit
C:\Windows\SysWOW64\Gjclbc32.exe

Filesize
128KB

MD5
9bba444a66964ed2befca58cd8dfe197

SHA1
fdd03901da95cf166668a670cfaa01c2d820bb6b

SHA256
1942f2fcf9721c6e07b0f38c95908864837db0a7a21bfc33aab11c807f2864f2

SHA512
5156daf45ec95e0378d805feb0791916a595f3bca036d597e0d8dea49c93172a656c48b241ecd0ad8988a94c8a888f3f7b578ea7a7c8bbfca51e37c02f5edeb1

Download Submit
C:\Windows\SysWOW64\Gjlfbd32.exe

Filesize
128KB

MD5
0f8b7ba3a132f582f5868eb9af049554

SHA1
00e87af8013256a6b1898a441d5fa23a0cb5306a

SHA256
88d88c43c983e9669847df0e5a054a190b4567c9ddae1c68b31d86ae1580fcfb

SHA512
9b6f52889dd251d50323de6a9ae5cc72253db1bd6e3d1fff09fa715157abc26ae6360d9c6f9a6a97ff2881d4652b00bae0a41a98256f7669b9e1d325a80441d6

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
128KB

MD5
9c8a713ca504dac31478a096aa12005e

SHA1
5aa2484de3c32583c53e821b050e19b3f8073288

SHA256
b2d855880bb00162e89bcd841a06664377756b0f9cf2fd4a6f272a0af9be65cf

SHA512
23933106bd69c16ee28708569390fbfbd528312f713214ae0e2c8fcff9acd972de5d8d03e9aeb8efa782ccf700dfb090264ed189a683e1c735978f55b8931e3d

Download Submit
C:\Windows\SysWOW64\Gmaioo32.exe

Filesize
128KB

MD5
76fd3482fb36c9aa8dff58f82fc50b90

SHA1
5accbddb1ade9241e1cf8e78e8593057a3f6e93d

SHA256
5ab0bb4c7c8a30135c4667a3833e25c5e8d1e85a58ae63823f8cde7a0fcb2340

SHA512
265205e471f35e0ab7b0879c46e06c2704ca11d4c3a98507199097f4953a5a10fe7efcb4d34cd0b2b9d01a5598ab4b4da04e5b0a36c69a28e46919c5df0f075c

Download Submit
C:\Windows\SysWOW64\Gpklpkio.exe

Filesize
128KB

MD5
58fa46273b9eecce323a919d1ca6bb8a

SHA1
111414f11744fa7c5347f98014703591234a00ca

SHA256
53db0bb55ee4aea8f0d2579ef53676f3091187799894e197eab10152d8f1f397

SHA512
4c4635b5c8fdbdb5253f48fb191c72cd889d7ad2902a56eb334aed38c908aaba55e9f7e66af0aba0accc09d419d53183a6a2b170860b25a380d644522ebfa5dc

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
128KB

MD5
df5111575ff3b5a53455997e757fdb8d

SHA1
722f3eda47d0201c0683f99f4dad974ae16f6357

SHA256
90fe1854b7361473a9517d78a4cc4488ff4b519c26cb73c524dcce019b37d661

SHA512
a7edc1819609fe1d431e8812f33c3c87e8683c20c34ab6cb53ec2391640b7e733a9b20ab17c878f3f3cd7b85d79ea4b8e1f1d4b06e45e4ef336386835190a6fd

Download Submit
C:\Windows\SysWOW64\Gqfooodg.exe

Filesize
128KB

MD5
1c1f10f5fba066c6dc3fcf6edbaea760

SHA1
efe643d45f6437fadcdb1077460d31bdde732c16

SHA256
1cabf7daf0158adaf2ca3e82f8fb6b508d68603f0520366b9cab73b76ac02871

SHA512
37312f20bbc2818494f5d780af5e27ccabacb7d595adbbfa826e0fbc5d2ca8771280f8ccddeedeae5d288ce5e9ff604fca94575849d8698d23e3fedbacbf6fb8

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
128KB

MD5
fb8007d39dd36d668780b53883d6283a

SHA1
4df026faeac35a7043104349a24c4ceff50989ed

SHA256
2685f6a5e6729e324a15608b8fdc0bc00e8eab1f50d3005bfa9897eb1df5f5f0

SHA512
684449536f5b143abf58c5239b4399cf7d379d51c2ac72c4099e668eb856ba1807be02a72d2291a07379bb479f135b5d34e2cb1aeae4bb8cb22c7987471e1de4

Download Submit
C:\Windows\SysWOW64\Hadkpm32.exe

Filesize
128KB

MD5
f9b5c7309c9b64318c01ec39276a75ab

SHA1
e0e8149e60b8464be66cb8a0ce31590c431238ae

SHA256
a8f4c318cc448e270bdb583a3ba7ebb5e1de6062b1f36dd40f86df1bd3810436

SHA512
5b4d6142cf0767a5f533c274d87d1a81a878ebd8fbedce559b371af0ef5bb8962dae4b6315c83d8e862079b87d5798e433c0ddb9e00f77cfc1919b6292300e0d

Download Submit
C:\Windows\SysWOW64\Hapaemll.exe

Filesize
128KB

MD5
fbb250c80400d39af174f2631064a57a

SHA1
fccd1fb329e700af6feecd552ac0d092a9514b0c

SHA256
adc797ab4b689817718a7bd8de3a72bace3753896cfb1afb4d7332c2681bc701

SHA512
9d7642c92f79b39596304f15dbdc128dfcb90b9019e3aafe4f39279f0eb35136a6482821588c4133727fc3677c1771953b9a7f6b2eea6b7618bd695c13d80e5b

Download Submit
C:\Windows\SysWOW64\Hbckbepg.exe

Filesize
128KB

MD5
fca0f0bb2052391074548124d44cff80

SHA1
d8bab49321c2ddd82970dea9f7b0f9f03d4463c6

SHA256
ec9f1c7e27928d49a39fabfdb205d75f58591748391033657bfde65c060ef73a

SHA512
3e8fde07fb631447586db2427d17d1edda23d54ce6d93d51ac170ffa9444f8b10f0a8cc1ab2432f3e7f8827a6f42aebbf040a6993f4a5e2c63f7e0c8876f01e6

Download Submit
C:\Windows\SysWOW64\Hbeghene.exe

Filesize
128KB

MD5
fe0ec31b22a49d97154b858e6595587a

SHA1
f94bb058d2b35e161bcdd4b2aa857e91bcb488fe

SHA256
9b81c38424865d9135bcf77608de172a57c645448792714249a7bacea309d4f0

SHA512
8b31da05e80d982d552ab04ebdceea000ac841ef7c13d901ae57e081027df6ac494d3f52db8cc90b7145ab79cd1ae02a5e7c80a2fd1e626c6762f6e4a4f290d3

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
128KB

MD5
c0ce02bd90c178a0693ea83c60262230

SHA1
e552b3545e5c90629af8cdf3fea82cabd235c7fc

SHA256
1a6c8d2c1b99113edabbda8f09545ebbe089be09dd4f90726f648032e8914b8a

SHA512
95f28955bc02cf386a1b84abd252110062b7120b4ef491129e2eb6f9d0ff0c01a0dd8f1c618450153d000f46e55408e78e613a10fb9a841fc6acc20b3432c4c9

Download Submit
C:\Windows\SysWOW64\Hcedaheh.exe

Filesize
128KB

MD5
de727ddca4bd3961533dcc1f95bd34c9

SHA1
38fbaeed10f80ef605b36299336055638be11cb4

SHA256
edc28ac6629d38ba43c067904d932aef25a5bff317f93ec4cb43437b5aa6a94e

SHA512
14d5504859ff76decc542f7dff1b445b365d59225eb6ba4aa7bf9bed8073c2e30a32f29dcac07edb2e4cb2a53ee74d6675ddfaff9b600bfdacf633f221490d49

Download Submit
C:\Windows\SysWOW64\Hfcpncdk.exe

Filesize
128KB

MD5
fd5bb4e5127e7778f9f4ecfa2e2a56f1

SHA1
a720b877750c3f264b4a5088f20a506e13f8e928

SHA256
5afb206bc3af2d66f43b83af16d77c6b9d1e6c90f8aa465fe95a53b0ae34a6e9

SHA512
e541b4e18edd513ff478789f6bbb68537c0dd03f798542c9cce5809e38eb6b02b7f83aaa19a5b330761becf8f978b9747482a76373dc42b427e76e96d417b965

Download Submit
C:\Windows\SysWOW64\Hfjmgdlf.exe

Filesize
128KB

MD5
c3aae0774a4e7925258f5060b7976b40

SHA1
ecf03758662e24575d74a8bb84583d7fa6e44002

SHA256
694a3ca29ad80d2a064341d8e673eda7355bf9c9de07c0f0bf5d027b4efd51bb

SHA512
e3f888ae147b1e612abc41f4a73ce1d043abd5e61af619c5647ea538d3b689c883c817c1c3a8f2d12197b26eb0f24ea54cd1ee5d8aac363cdc29407626abfdd6

Download Submit
C:\Windows\SysWOW64\Hfljmdjc.exe

Filesize
128KB

MD5
9ca9db9eb65ea7294570f6e492ce9956

SHA1
67891e671316e8059808171ae67c2151df982365

SHA256
13bba70148123ce5d52719970d60675415aa92eebf99fa9c2fbcc836f95029d2

SHA512
f61d71ce82ee59da2e3ff51405d53a6e96939bcdec3793962339b3277baa11a0716f450a94d3b2a833eacdaf16e0e19ab8f5888ade87cd6e72f3cd053d99ffbe

Download Submit
C:\Windows\SysWOW64\Hibljoco.exe

Filesize
128KB

MD5
1a3ba9c96a922194208886554e38ef0f

SHA1
823ea6c35c09f1dcac8da5f50911f63b23abeda2

SHA256
92807415fa851c18d1095f530dc40ca7ee9be6e512196598d6bca1037168a28c

SHA512
8939c86112f242bd7f042b6cae59b1adf6fe06663e837b9a888d438638b1d1bd6e494115789613b3b9cffad9e5bd475d8276801d59bdd3b87a45b4ae894a9c93

Download Submit
C:\Windows\SysWOW64\Hihicplj.exe

Filesize
128KB

MD5
77f272fccdc7b80bfb48335859258fd4

SHA1
66ceb05e956b68ce8f5f09a1e638c190a74ec9ee

SHA256
0c70a6f3e95fb886dcc05febaaca1cd2bd36ec0f2a9d7fd28641674c3feb9e4b

SHA512
5292ad7107f682a85c0c7f1eb9da0c94865ed0afc7e24fe1fd7dd4eee91eeba98b2e3cdd1a77087b23ddf10410b12597b2f882e49a5c573d72a8a1d47e4803a6

Download Submit
C:\Windows\SysWOW64\Himcoo32.exe

Filesize
128KB

MD5
3b648dde3eb65de631f4e39c93fafc58

SHA1
83bfae4cef49efb77507db67dd762eec6d8de93e

SHA256
cea487205b5fad291681a6e7fb11ba61dc12966e4667845ce5f45d4462f494bd

SHA512
ddca0e60b232e67e2865fe3001bbf977fbabedc34017bc883c2fd8575bb43d2012758c8cdebe0feba101a245404f3b65b8eb8c248b0789f7250b91dabfb8bfc9

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
128KB

MD5
b36dc7357ee0e7266dabea49036d2e6f

SHA1
41fbe4b5c07af3dc7ae2d65a7e806e52b341f2c3

SHA256
c84094f093291686baa0d69081268cd9bb5dc662ae94387956f53033bca43415

SHA512
3be9665a14e873b588c28349951ac4ee72ed528ee89d427fcb94fd43594cc6180a3a011263671be393bae69fd5424d163be6bf711e1a056e34d21a1fa4d7b72c

Download Submit
C:\Windows\SysWOW64\Hmklen32.exe

Filesize
128KB

MD5
24cb9d9ea934b64109b3afa0b3c537fe

SHA1
c67530692c0b33b5a87a07b6a82a07963f1d916d

SHA256
007cdeaef1b3a32d662cd4a513e590d0681c0fc5af3e01bc865b7d3b728d8493

SHA512
4bc5e303283b9567765480687e7cd1db961574ec8a00834f00a81800f87bfd8fcc6ace3cd5546165f1bf5c23d31903f1c59d2642086b8e4f7772ff863617a2cf

Download Submit
C:\Windows\SysWOW64\Iannfk32.exe

Filesize
128KB

MD5
d706ab04364813ad15d5446a3bf25f3c

SHA1
f70b8ac503d158531e4a61108e1116f514dda679

SHA256
566fb777c0848c7fe118e968164405a7230a106edcd98d6712b7769c190f68c6

SHA512
0fb1b776638b5a625dcac96dfb3618e758f5808a06a48975d9c9898755554aa2a264a0ead0efdc02af5620a4049f96597c4367f8e06bd2e9a604cea5900599b7

Download Submit
C:\Windows\SysWOW64\Ibjqcd32.exe

Filesize
128KB

MD5
74b237bbf3982be9564945a9c08da756

SHA1
3515161b432eb7f0315b1cc3bd7adf9175ef0961

SHA256
b01a4fdb80cd2070e18d6ab94df864c0216c05ae0118c02862033b52b01e48bc

SHA512
377e63fdfaad08127ccca31811f1c4331ff65b5ae04cb0d4fe73099ede9927cee999ef25ac504078afedc48568b7b86f39aa40b152fe181b0b3013749de5e91c

Download Submit
C:\Windows\SysWOW64\Ifhiib32.exe

Filesize
128KB

MD5
41275eb053dfae748d0443d6e85ccc12

SHA1
0ca04d944199856362984818c5a666aef37e1c95

SHA256
71e7f803cca30aa02eba700ad501c90f0dabafd67c8cd5a97540591abfae0d7a

SHA512
8d4af9f8072cc8b72b92324e89e4695d51ec6e277c6935094d5d9ca7c9159c2d06000f79262121d91a54b3fb3358624c70ff42ad8b28beb3145043fd0171730e

Download Submit
C:\Windows\SysWOW64\Ifjfnb32.exe

Filesize
128KB

MD5
deabed00b47eebe7ab16a20bce1edf8a

SHA1
594308651e92e35cecf4e92247cd453de3c09e96

SHA256
60a00dcb58cb0eed6c8a64610ddf883ca1236693dbd36f3c829091af5272997a

SHA512
e78eceec03956c14f3554e2e57b47b4f6fef9cfdad6bafa2caf2462703f0398068a4f0354a19521dec38b9df0dac83df519f7ae8602d48857b1d6109f7859854

Download Submit
C:\Windows\SysWOW64\Ijaida32.exe

Filesize
128KB

MD5
cde74009f5b0e6c33ce539cac36e76de

SHA1
b7700e9ad6273fdab0d1661515e43b5666400d9c

SHA256
660157f9da33a4ca3721af1e8d8613f39f200f4d759f2642272041d20eaeb941

SHA512
16ea6d105b820db1da544923567598748f77ce662ce1cc04e6756d8d2167f349c45dde64219666d3e96f70e97849567c0fd672b204cb345f1db2fe30bef616c2

Download Submit
C:\Windows\SysWOW64\Ijfboafl.exe

Filesize
128KB

MD5
1917df67af9447ed26bfabee1fdb1063

SHA1
054abbf221068dd5e15d3dba0bb6f287a5616245

SHA256
044d24fd82fa4299503c913c10ce9558b30134df0925a20bc6a6995110db2114

SHA512
6260fc75a6589d09b3342055899b25ac41fa66d428efbaada5a421dab4379e7e95703ce48aa679a714f5906e14a3504331560fe0e9f481e989378be611a52b56

Download Submit
C:\Windows\SysWOW64\Ipnalhii.exe

Filesize
128KB

MD5
315250a5923b5bac5d2be2d658775200

SHA1
90e0eee4515762cf81afade99751eac509c81e9b

SHA256
36474b21537504f302ab2512074fcbc076592ad203e5cfc6c13020b0bb13b64f

SHA512
aafb9b4965fd7e2074316d9094a1780a1f1793d85fccb06bf8fab52ec342721b7e73877146d70fa7bef20fe3dc294b5a0b25ef0753384dbab419c9afead4cd4e

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
128KB

MD5
c159055b900241eb980c5200b0a7d382

SHA1
a79e09739aabc7030706fe045f2b0ed6b6ae0954

SHA256
11c4fd5749073ff0d15bd61b8af3889fd9601a9f3876d66b706dc8e47a2cf8d1

SHA512
a7b809f4e5055da39e36f2c21f195608159cb9a48283f84d8d0f56c19092ef900fed9435237632b074f1550b319d84cbd46ff8ad819549fb5d4cddf368b832be

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
128KB

MD5
0b2ac99f7e79fc32ed693e90dec343f5

SHA1
816e2aa23ecba8ed1ad2a7ec79a10340119d902c

SHA256
a2f59b6f132bb85f7841579a5e1dcac2b5347e6a713bae0a56cf3785d60b66f9

SHA512
83b43dfd3e04549ab0560d4d0c09d43d76f6406bd2e55b4a6a893dde4c79ce4784c8203440707b3dbbede054ec252e999711193db3ae8e8a5b10a0217d06fa16

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
128KB

MD5
2b7792e043b7be3060f378df52f2cae0

SHA1
cfccd2e99903d6ad036f24d753c526f18093d62a

SHA256
c2d52eb0fecc43d72e9c70f05e1d4ff92a69109125319dfc41edce0b5b0aefb2

SHA512
3f11959c14e3558e90f8068499c0c1e2c9b048d023eae0c8f311412fd57832aec0bd95618e65bcd3b58a6f866f75c294c378a3f3bcf495644975d31f9ce152ea

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
128KB

MD5
4af36a522962712b472797582bea3e6c

SHA1
553cf1335e297213db4163f4164acfcfdf350719

SHA256
dcc9a2880b37b52fa636ae3485df1fbb59bee706839e75dc5e141aadb80287ac

SHA512
44604ead18b2571062f060fc3573f7477bc4e08e4ce8aaf85725524733da4bf420a6e7bfe7f71a72464c13a58443e60b6b1a16181d3219109e004b2d8318ddac

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
128KB

MD5
83beda1803174d7670856c8f1c3599a7

SHA1
efcea2d65d8ca4575766a1b3fa1a9a008c850766

SHA256
fb2771c1a578d9687c93993501a26d26dce2bb916a35ac86c565a41470bcc7c8

SHA512
bc7242420c5476f11c4d15dc1c299b9535cb7b62376138aa4dd972caac4ca66af83c47b4ee69b18917dabf050f5aadb988cf18a1d6d1778ccca5cf1b4b54491a

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
128KB

MD5
6d1e4125ae71ea213bddc64f18a3625c

SHA1
8930cab2d201572ccc418018a6289dda2834e3a8

SHA256
5a6c973a93e71404ad7c7fe38179916e2faddde3491f11e70a540c774eaf8253

SHA512
8d671e3c8eb0e9da3f8f7675f0b19fd2b7e8043300e6d033006bb11de57b5a8b2956dadae2494fc870e21850c586f9ac5be1874e830752065b829924df933448

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
128KB

MD5
1653c7ff3a847227eba8271968508f02

SHA1
57eb3e33793470e1cd765cb60c4de47cca8c1574

SHA256
afb3442dced01e7613ca8a2422095670d684a876af9a985d69e9643b27bfd8ff

SHA512
243256cbbe30cc83e6cd87b4222f4822b320bb029bd9123470a98e4d315498e18dbd26ab038d033396b95c4d8e944248f2fdf5ca970268d43210ed80088feb72

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
128KB

MD5
1278bf886adad6a52c53de1fb7f72a31

SHA1
ba81f3c07e1feafd88d2547446b40a33ac86f2e3

SHA256
5842fa26fe0657a30e0acbcd34ce8f8a604a510b8130ecd76ef5b4bef787c7fc

SHA512
bbe9c6306bc36e4f2edd6dcd4e2c8d5b7b9f4ede13979d0f6daec59f5d9c6aa3f0d45a1b006a426d43bd83ce50eaea2d66967cb537367e4d8832dd857570b492

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
128KB

MD5
c4f2ae8d5bccc2160970a4c7993e7325

SHA1
8ec68a8a860b30351f01d129ab71dafd0615a6e4

SHA256
bf8cab52921b89ebe648fe144dd5fcc59709eadbdf472a116c421fe7187fdac7

SHA512
0f9cb0db1636a4de2ea5eaabed6b25115787bd4b8b59bfa24250f5a37595ad354c2f688a6ac1d19bc6c4f8d74932a11dd62384e20396dab7db01e7ba00e9f292

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
128KB

MD5
e1c843a5c8b8c0a94d5fca1df2499b19

SHA1
60c55fb5054d6471d158d06da5af741204e89a78

SHA256
d6346124b15b77c80476f3e97fa985e0ed58521ccc9f666c8bab35deedf446bf

SHA512
5fbc8fb696402998ea8d8a2c2e27670b3b804bb6fbcc968bfaddd60246be4668134af24d67797dbebd1e6be1d311500ded454da067b38cbf97a6aa206fcfc3f9

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
128KB

MD5
07f86f8f211528436a04695694b911f5

SHA1
9996f3a540623251feb026a5655f7ffe9709f377

SHA256
547028ccee28f030bf410ccdc954ad80065684649f26d4004822436a8889edd2

SHA512
a32a5702161335e808483004912e0c21b5fd56b6550368f11c69b59a0374604c197f45242fdab6c241efb4db7c0d112483d432bae742c46b83950646626fcafd

Download Submit
C:\Windows\SysWOW64\Nnaikd32.exe

Filesize
128KB

MD5
c0e40a0e942d79c890e633333c14dbf9

SHA1
7dd34791a3b8f5c621f8a7817c9ea71a67741251

SHA256
0de1c1305c44e947588a9a251daa666357d32a88ef8860e6b35e413ab4e26c8e

SHA512
ea275a712ed9e7a3930401e5f7915fc918179f19d3318ddbdefd70e9df75575d2ab60614ba5b30d89293bbb2eddc51e7bc418b808d583f25be7bb777e162c945

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
128KB

MD5
b12fade47a827d0de6e4d87408ade12a

SHA1
7cb83155a2e98266339d37677288efa6bd99b9a5

SHA256
d2dea3654c7f8676c5700b587f7c9f8b24330edb6fc389eb0bb207fa5262e303

SHA512
7b3d8faeab6e03b76082d2f70db949a040b2e57134f3bfae67e1b523f3e789df5d4ae6cf75a7be51b52a4083a357e31b6d3bab1dbf53998895fe60de0c27ac05

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
128KB

MD5
38546c11c5d7dfbd5ec817c67ed81ea7

SHA1
bc07fbcfb1105e04c606c7e2b76550e85bbae055

SHA256
758f6a2ac9e7a145ef9861a9ccc0cec0c9b118b5555a11e569a630d40c94051f

SHA512
351c29c1df352b8d06dd98b6bba9a8a1db1d2ef464941da40d7d8218fbbcc8a7a4ead3ac61954e718bff11a9fb61210fa03404c021aad23d23a5af19d1f211f4

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
128KB

MD5
e78c80f2b01563d734d5f1289517f3ea

SHA1
cd0a123dd08003aaf049a60a505f1e2f0c5d5fa2

SHA256
2fb593152ca16450057319e2dece8c0579185324831568fa229b141f803df479

SHA512
da834e7e31789b7736b33bd06640643e710207ab157dbca1d2440c489752356eff5b83a173962b54cc76c6282ca274ef824d2eaac5f74495b688c09378dc8712

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
128KB

MD5
6a1aecc79e486edf5ac72fb022df339f

SHA1
81749f1f33c99686a21805bbae69fec73d975fc4

SHA256
728601023aa48b0d3ab16554f4c7db0f91af3b7dbef36bc06bd4b5d8494ce2a3

SHA512
c4dd162457b6cf767382fcfbc795a4a77078bdc8a235435f3c459a299b4ae7f046733d3073a1612fc6dc31d26d2143c8fdb4d51691bf058f2b6b91a7ec33e1b2

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
128KB

MD5
5b44f103426a2d52fc7a6c6f99cd1ed5

SHA1
d8bf9fa196a67c2a0ad080165aa288641e060f24

SHA256
ee98a9c110d500e4515dc2fd3358b932414091bfac40363823d633d097766bbd

SHA512
0cef7dfdc968fb821822a8f8af73530b9fcb939bdbb0743acb6b14e1a003584efb90501685832289e6541ac53c9a5340dd517ca017b9af23c7fd420cf07ba6ff

Download Submit
C:\Windows\SysWOW64\Pgjfkg32.exe

Filesize
128KB

MD5
02efb57d2562317276b158826e4e20ec

SHA1
51635ca7099d71455e847fac4468a9e1d7a0e359

SHA256
27f481801176ad49c39581cb813f4651b32194ec5dfc293e2f81595d73d6590f

SHA512
82776ea6796b304cc20329a49e3f726527ebe21317d42d308191155c1a92bba4631e21c2a82ae00f828ef20e85f1e3d1029c20fde22ae25591d5820bb810086a

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
128KB

MD5
286a58c079ca392bbdf9842b3479e8c4

SHA1
ce3c5689adf9fb5e5b8d19b6c4d6d33a34b5ed0f

SHA256
2693e2706a4181494d7b2f70967a9839a2538f449f88f85f3337d7fea65e1548

SHA512
e0e0df0099ce54d1365e4f609379dcd04224951288a208b26cb975233b5ff0674eeb5a600311306ca6b0350deaa25b4ea9549d924327149bd7e21bc16e1d2f0d

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
128KB

MD5
2ec0a18c343573d891971753931aa617

SHA1
d971a0eda15473d8595bb2ed119892667af0eec0

SHA256
96521891e4ec610f655f964b164d2b055805c3c8231f5922aaee38cb6f287842

SHA512
6e56d348ce1842e1de5ccfd167d5bf5ca9dbdc25c4dcfba2a0303af1f535b028377cc65f3a163b0df9e223cc7df5a7d02d2c7a74fad1e4eb5e469e1fc5a5b358

Download Submit
memory/228-381-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/640-431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/712-221-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/740-484-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/752-241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/868-104-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/880-552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/880-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/912-144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/916-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/928-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/928-5-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/928-539-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1052-353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-157-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-550-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1292-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-570-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1424-537-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1452-386-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1532-371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1540-335-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1600-411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1612-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1644-309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1692-578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1720-515-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1756-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1768-447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1784-453-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1856-463-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-586-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1968-399-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2076-269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2092-557-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2184-491-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2420-285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2492-311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2576-275-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2612-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2796-233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-81-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3020-365-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3188-263-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3264-455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3520-413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3616-121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3776-584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3788-129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3964-490-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4032-200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4044-593-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4044-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4064-541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4104-531-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4128-359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4200-401-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4216-514-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4360-521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-33-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-573-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-214-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-17-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4408-193-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4444-507-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4460-467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4500-393-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4564-497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4628-572-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-168-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4792-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4796-477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-437-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4852-317-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4908-560-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5048-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5060-429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5072-97-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-299-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5104-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5124-591-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5172-594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads