6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe
Size

156KB
MD5

5f72654199a30e09bb1c574f27852c66
SHA1

cc2a65772ea582be3b8adf2e9644cf87171a1e52
SHA256

6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea
SHA512

9d3eb4305a480459b47bbfe7d2d32b1ff475bdde71201d237b247a2cf6752b7b9d022e2db58efe022765c280db79aa470bb6c7b6316c14f871fae0539c8f11e2
SSDEEP

3072:LpOIukSU+x+J9IDlRxyhTbhgu+tAcrbFAJc+RsUiM:lOIuc+x+sDshsrtMsC

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balfaiil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gicinj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dohfbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooeif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednaqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdialn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjjfggb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgciaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fojlngce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbefaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glhonj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liimncmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaqgek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddojq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgciaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehedfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehedfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkfblfab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhfonc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eabbjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe

Executes dropped EXE 64 IoCs

pid	Process
3956	Mcnhmm32.exe
1236	Maohkd32.exe
4456	Mdmegp32.exe
3220	Mglack32.exe
2892	Mcbahlip.exe
2240	Njljefql.exe
3228	Nacbfdao.exe
3604	Ndbnboqb.exe
1560	Ngpjnkpf.exe
5052	Njogjfoj.exe
4012	Nafokcol.exe
2200	Nqiogp32.exe
4468	Ncihikcg.exe
212	Njcpee32.exe
3180	Nbkhfc32.exe
4908	Njfmke32.exe
3040	Nqpego32.exe
2140	Okeieh32.exe
4148	Oqbamo32.exe
5060	Ocqnij32.exe
488	Okhfjh32.exe
2288	Oqdoboli.exe
3212	Ogogoi32.exe
1256	Oqgkhnjf.exe
568	Okloegjl.exe
5048	Odednmpm.exe
3320	Okolkg32.exe
4004	Onmhgb32.exe
1788	Pgemphmn.exe
3984	Pjdilcla.exe
884	Pbkamqmd.exe
4452	Pkceffcd.exe
4856	Pnbbbabh.exe
4428	Peljol32.exe
3936	Pkfblfab.exe
3248	Pbpjhp32.exe
2364	Pgmcqggf.exe
2116	Pnfkma32.exe
4536	Peqcjkfp.exe
1892	Pkjlge32.exe
3184	Pbddcoei.exe
3328	Qjpiha32.exe
2840	Qajadlja.exe
2872	Qgciaf32.exe
836	Qjbena32.exe
2524	Qalnjkgo.exe
944	Acjjfggb.exe
5104	Anpncp32.exe
3664	Aanjpk32.exe
1120	Aaqgek32.exe
2844	Alfkbc32.exe
4020	Andgoobc.exe
984	Aeopki32.exe
392	Angddopp.exe
4820	Aealah32.exe
1140	Ahoimd32.exe
824	Aniajnnn.exe
5088	Becifhfj.exe
1308	Bnlnon32.exe
3764	Bajjli32.exe
1368	Blpnib32.exe
1756	Balfaiil.exe
4088	Bhfonc32.exe
4100	Bjdkjo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qgciaf32.exe	Qajadlja.exe
File created	C:\Windows\SysWOW64\Aaqgek32.exe	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Andgoobc.exe	Alfkbc32.exe
File created	C:\Windows\SysWOW64\Ednaqo32.exe	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Fjbnapki.dll	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Angddopp.exe	Aeopki32.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Pmjqhl32.dll	Pbpjhp32.exe
File created	C:\Windows\SysWOW64\Aniajnnn.exe	Ahoimd32.exe
File created	C:\Windows\SysWOW64\Jmknaell.exe	Jfaedkdp.exe
File opened for modification	C:\Windows\SysWOW64\Lekehdgp.exe	Lbmhlihl.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Ocdqjceo.exe	Olkhmi32.exe
File opened for modification	C:\Windows\SysWOW64\Oqhacgdh.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Gohibf32.dll	Chmeobkq.exe
File opened for modification	C:\Windows\SysWOW64\Ehedfo32.exe	Eefhjc32.exe
File opened for modification	C:\Windows\SysWOW64\Ekcpbj32.exe	Ehedfo32.exe
File opened for modification	C:\Windows\SysWOW64\Eadopc32.exe	Eofbch32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Aqncedbp.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Mpbbmhgf.dll	Balfaiil.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Fdgdgnbm.exe
File created	C:\Windows\SysWOW64\Klqcioba.exe	Kfckahdj.exe
File opened for modification	C:\Windows\SysWOW64\Odkjng32.exe	Olcbmj32.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Khchklef.dll	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Agkbbg32.dll	Dbllbibl.exe
File created	C:\Windows\SysWOW64\Hlokddim.dll	Fafkecel.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Maohkd32.exe
File created	C:\Windows\SysWOW64\Oqgkhnjf.exe	Ogogoi32.exe
File created	C:\Windows\SysWOW64\Dddojq32.exe	Dohfbj32.exe
File created	C:\Windows\SysWOW64\Igoedk32.dll	Ekcpbj32.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Hfnphn32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Iphkfg32.dll	Becifhfj.exe
File created	C:\Windows\SysWOW64\Keoakjca.dll	Chpada32.exe
File opened for modification	C:\Windows\SysWOW64\Icnpmp32.exe	Imdgqfbd.exe
File created	C:\Windows\SysWOW64\Jfaedkdp.exe	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Gfngap32.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Gicinj32.exe	Gfembo32.exe
File opened for modification	C:\Windows\SysWOW64\Gicinj32.exe	Gfembo32.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Acqimo32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Ijlbqboa.dll	Hihbijhn.exe
File opened for modification	C:\Windows\SysWOW64\Kfankifm.exe	Kpgfooop.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Pjdilcla.exe	Pgemphmn.exe
File created	C:\Windows\SysWOW64\Lemphdgj.dll	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jcgbco32.exe
File opened for modification	C:\Windows\SysWOW64\Llcpoo32.exe	Liddbc32.exe
File created	C:\Windows\SysWOW64\Njfmke32.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Kiidgeki.exe	Kfjhkjle.exe
File created	C:\Windows\SysWOW64\Ogkcpbam.exe	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Mjpabk32.dll	Pfaigm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9364	10168	WerFault.exe	445

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeeep32.dll"	Aealah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iccbgbmg.dll"	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpjphglm.dll"	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qamhhedg.dll"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqgkhnjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnecbhin.dll"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Becifhfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfifebhe.dll"	Peljol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phfkqkek.dll"	Aaqgek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeohm32.dll"	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijlbqboa.dll"	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filmclmj.dll"	Ocqnij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bajjli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdiooblp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lboeaifi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alfkbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bblckl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Camphf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jeklag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmliida.dll"	Pjdilcla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgldjcmk.dll"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3956	1872	6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe	82
PID 1872 wrote to memory of 3956	1872	6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe	82
PID 1872 wrote to memory of 3956	1872	6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe	82
PID 3956 wrote to memory of 1236	3956	Mcnhmm32.exe	83
PID 3956 wrote to memory of 1236	3956	Mcnhmm32.exe	83
PID 3956 wrote to memory of 1236	3956	Mcnhmm32.exe	83
PID 1236 wrote to memory of 4456	1236	Maohkd32.exe	84
PID 1236 wrote to memory of 4456	1236	Maohkd32.exe	84
PID 1236 wrote to memory of 4456	1236	Maohkd32.exe	84
PID 4456 wrote to memory of 3220	4456	Mdmegp32.exe	85
PID 4456 wrote to memory of 3220	4456	Mdmegp32.exe	85
PID 4456 wrote to memory of 3220	4456	Mdmegp32.exe	85
PID 3220 wrote to memory of 2892	3220	Mglack32.exe	86
PID 3220 wrote to memory of 2892	3220	Mglack32.exe	86
PID 3220 wrote to memory of 2892	3220	Mglack32.exe	86
PID 2892 wrote to memory of 2240	2892	Mcbahlip.exe	87
PID 2892 wrote to memory of 2240	2892	Mcbahlip.exe	87
PID 2892 wrote to memory of 2240	2892	Mcbahlip.exe	87
PID 2240 wrote to memory of 3228	2240	Njljefql.exe	88
PID 2240 wrote to memory of 3228	2240	Njljefql.exe	88
PID 2240 wrote to memory of 3228	2240	Njljefql.exe	88
PID 3228 wrote to memory of 3604	3228	Nacbfdao.exe	89
PID 3228 wrote to memory of 3604	3228	Nacbfdao.exe	89
PID 3228 wrote to memory of 3604	3228	Nacbfdao.exe	89
PID 3604 wrote to memory of 1560	3604	Ndbnboqb.exe	90
PID 3604 wrote to memory of 1560	3604	Ndbnboqb.exe	90
PID 3604 wrote to memory of 1560	3604	Ndbnboqb.exe	90
PID 1560 wrote to memory of 5052	1560	Ngpjnkpf.exe	91
PID 1560 wrote to memory of 5052	1560	Ngpjnkpf.exe	91
PID 1560 wrote to memory of 5052	1560	Ngpjnkpf.exe	91
PID 5052 wrote to memory of 4012	5052	Njogjfoj.exe	92
PID 5052 wrote to memory of 4012	5052	Njogjfoj.exe	92
PID 5052 wrote to memory of 4012	5052	Njogjfoj.exe	92
PID 4012 wrote to memory of 2200	4012	Nafokcol.exe	93
PID 4012 wrote to memory of 2200	4012	Nafokcol.exe	93
PID 4012 wrote to memory of 2200	4012	Nafokcol.exe	93
PID 2200 wrote to memory of 4468	2200	Nqiogp32.exe	94
PID 2200 wrote to memory of 4468	2200	Nqiogp32.exe	94
PID 2200 wrote to memory of 4468	2200	Nqiogp32.exe	94
PID 4468 wrote to memory of 212	4468	Ncihikcg.exe	95
PID 4468 wrote to memory of 212	4468	Ncihikcg.exe	95
PID 4468 wrote to memory of 212	4468	Ncihikcg.exe	95
PID 212 wrote to memory of 3180	212	Njcpee32.exe	96
PID 212 wrote to memory of 3180	212	Njcpee32.exe	96
PID 212 wrote to memory of 3180	212	Njcpee32.exe	96
PID 3180 wrote to memory of 4908	3180	Nbkhfc32.exe	97
PID 3180 wrote to memory of 4908	3180	Nbkhfc32.exe	97
PID 3180 wrote to memory of 4908	3180	Nbkhfc32.exe	97
PID 4908 wrote to memory of 3040	4908	Njfmke32.exe	98
PID 4908 wrote to memory of 3040	4908	Njfmke32.exe	98
PID 4908 wrote to memory of 3040	4908	Njfmke32.exe	98
PID 3040 wrote to memory of 2140	3040	Nqpego32.exe	99
PID 3040 wrote to memory of 2140	3040	Nqpego32.exe	99
PID 3040 wrote to memory of 2140	3040	Nqpego32.exe	99
PID 2140 wrote to memory of 4148	2140	Okeieh32.exe	100
PID 2140 wrote to memory of 4148	2140	Okeieh32.exe	100
PID 2140 wrote to memory of 4148	2140	Okeieh32.exe	100
PID 4148 wrote to memory of 5060	4148	Oqbamo32.exe	101
PID 4148 wrote to memory of 5060	4148	Oqbamo32.exe	101
PID 4148 wrote to memory of 5060	4148	Oqbamo32.exe	101
PID 5060 wrote to memory of 488	5060	Ocqnij32.exe	102
PID 5060 wrote to memory of 488	5060	Ocqnij32.exe	102
PID 5060 wrote to memory of 488	5060	Ocqnij32.exe	102
PID 488 wrote to memory of 2288	488	Okhfjh32.exe	103

C:\Users\Admin\AppData\Local\Temp\6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe
"C:\Users\Admin\AppData\Local\Temp\6f48bedb624bee80c7b4e03159877b25cbf625230cd234c21a87381cac1212ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\Mcnhmm32.exe
  C:\Windows\system32\Mcnhmm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\Maohkd32.exe
    C:\Windows\system32\Maohkd32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\Mdmegp32.exe
      C:\Windows\system32\Mdmegp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        23⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        26⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        27⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        28⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        29⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        32⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        34⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        38⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        40⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        41⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        43⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2840
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        46⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        47⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:944
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        49⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1120
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:984
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        55⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        58⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        60⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        62⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1756
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        65⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        66⤵
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        67⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        68⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        69⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        70⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        71⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3904
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        73⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        74⤵
        Drops file in System32 directory
        
        PID:528
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        75⤵
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        77⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        78⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        79⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1476
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        81⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        82⤵
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        83⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        84⤵
        Drops file in System32 directory
        
        PID:3124
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        85⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        86⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        87⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        88⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        89⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        92⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        93⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        94⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        95⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        96⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        100⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        101⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        102⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        103⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        104⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        106⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        107⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        109⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        111⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        112⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        113⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        114⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        115⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        117⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        119⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        120⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        121⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        122⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        125⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        127⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        129⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        130⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        132⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1516
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        135⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        137⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        138⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1616
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        141⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        142⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        143⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        144⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        145⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        148⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        149⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        150⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        151⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        154⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        155⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        156⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        157⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        158⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        159⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        161⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        162⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        163⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        164⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        166⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        169⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        170⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        173⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        174⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        175⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        176⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        177⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        178⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        179⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        180⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        181⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        182⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        183⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        184⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        186⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        187⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        189⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        190⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        193⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        194⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        195⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        197⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        198⤵
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        199⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        200⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        201⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        202⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        203⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        205⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        206⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        207⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        208⤵
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        209⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        211⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        212⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        213⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        214⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        215⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        216⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        218⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        219⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        220⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        221⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        222⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        223⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        224⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        226⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        228⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        229⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        230⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        231⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        232⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        233⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        234⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7932
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        236⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        238⤵
        Drops file in System32 directory
        
        PID:7196
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        239⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        240⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        242⤵
        Modifies registry class
        
        PID:7752
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        243⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        244⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        245⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        246⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        247⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        248⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        249⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        250⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        251⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        253⤵
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        255⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        256⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        257⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        258⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        259⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        260⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        261⤵
        Drops file in System32 directory
        
        PID:8484
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        262⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        263⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        265⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        266⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        267⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        268⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        270⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        273⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        274⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        275⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9140
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        277⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        278⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        279⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        280⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        281⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        283⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        285⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        286⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        287⤵
        Modifies registry class
        
        PID:8856
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        288⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        289⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        290⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        291⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        293⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        295⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        296⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        297⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        298⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        299⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        300⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        302⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        303⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        305⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9124
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        308⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        309⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        310⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        312⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        313⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        315⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        316⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        318⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        320⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        322⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        324⤵
        Modifies registry class
        
        PID:9572
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        325⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        326⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        327⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        328⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        329⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        330⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9868
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        332⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9900
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        333⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        334⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        335⤵
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        336⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        337⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        338⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        339⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        340⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        341⤵
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        342⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        343⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        344⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        345⤵
        Modifies registry class
        
        PID:9580
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        346⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        347⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        348⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        349⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        350⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        351⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        352⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10028
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        354⤵
        Modifies registry class
        
        PID:10116
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        355⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 400
        356⤵
        Program crash
        
        PID:9364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10168 -ip 10168
1⤵
PID:9252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
156KB

MD5
ca6527aec0253f8f5d0f17d4a697aede

SHA1
aa37de53e06c6c742ec971f0432f9897fc33b67b

SHA256
e8067825bd4a7e5c41ddce0bc61b924e6a2577b4e59d7c2267e471c702de453c

SHA512
44124621a262ce0d246554004d22e7b70c5e772f8df4be8b2ed8cc355c71c70ab9ab5ae917b2b4499b16089b7eb1e6d184db880a56de508f16e62527b684d324

Download Submit
C:\Windows\SysWOW64\Aeopki32.exe

Filesize
156KB

MD5
9e8838e8dd783ec1da0f41f0a88757cb

SHA1
18cd89129390fddb4f4cef6f6329f03ffa24853f

SHA256
a3c0898ab489b57e50c2485ae0befafbeb32caa6405bf73f8b8a673c44dd2b82

SHA512
437be3e1989ef00c22ad4c5da3a3297ebb5839cfe5e93b1d4ceaacdbd1f1e85555adbaceab21f402301fa8e28f5ce468d1fe854202dad4933f4900a5d51916ed

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
156KB

MD5
54dee5c7ad734f99cb23a6d8fa69f49e

SHA1
ca172bc2e0f33c8a0fd896404828e59cc5827f1f

SHA256
39800698c17e8733b3522229a6813f12258254b3049454e2121c9480d14b9dc7

SHA512
d48d591c15354382b7974686b6a290eebe8edf032e97a01ed729c06f92f2059131e8c6448366d1a8a80e36f173e549c7bca91d62e6dbfd3adb9fdd619a61a9ae

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
156KB

MD5
7d0ce80d40a5a36c48edcf12e7e41f3e

SHA1
3ee77f9bc2e6f2772a5e3e942381aa8d5d5c4cb6

SHA256
4a043049c7f978a98773d7b2194bfee5688a8d52b9eb50f8e131c74925783b1a

SHA512
715448948cfe88641b5bca44802ab5bbf7f2545b5804dbd87854fd112bfd657cebb47b25a166b5296934aef43de9861ab0a9eb12560f47ed7b26d6802f450d2e

Download Submit
C:\Windows\SysWOW64\Bdolhc32.exe

Filesize
156KB

MD5
f71bec4f561d1e260004093b576ae208

SHA1
4f9870c1888d974e0f7c46bc6c5b932b75e499f8

SHA256
8bef33ed27ddaaf92d4d05c7ed2f48922b2e3674240b7430cc36ad8f96501dd2

SHA512
d79027a4518c77da912d6512676a1026924cf38dd60a2d0db46d27f4be2119e20d651a7e2a5b879ab9462d884550a5af3e9fd925701d73d41980fb72e5648657

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
128KB

MD5
9874f85754093a2032ec6728acfa9ad4

SHA1
5e7140431cc2c57affd928409dd5c9ce29f800de

SHA256
12e135256e0b0a14aa10ceda833d2f74d0d5acc123a8b6d8810d608e26b38f2e

SHA512
c2f90e551ec141ef68082d417cb4fa81df2a64607e7fd77e9e22e4b073ca161fb110414424c4d0cca045f62278c124cc8fc510eb617a3e86a3ea321a9b2c6c70

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
156KB

MD5
3708b5433ecacaaf9b42678a08d64e04

SHA1
ca18acc69a7a42b3ef0a8cfb714538460e9c5a63

SHA256
c118f7e69ce9da63ba242bdd7554750d06dce3339c42de86dd8432af61e1a49e

SHA512
a1262cb0a393dbb852964339ba3e52b0c0eba4fa1fe6cb666673869bb92f5b4c9789c66ccf2f925e729a8e3888d92d2418ddbbe6a3863421ebdce30e581d6c01

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
156KB

MD5
a4a6e505e3b62f251573f0eb880447d4

SHA1
f69aa095552620a9c46400572fb1f31c855288fd

SHA256
3bc9db213a40a6b824c19d59156f88ffc597e5b9cccfdb2f2e9deb87694df3d9

SHA512
4bd87b2284886a7a628142c819f36f89cb2eee6e4c75ed100a91628ac6af2e93933039556cb2cc120dbb93278102286c82e0059961ae74b0adb6e616576b035e

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
156KB

MD5
9e978ad09a997f3c67e79fe559361229

SHA1
4aebf527ad7c0aebce31da24d0a6040fb45f5281

SHA256
90ba0e208dbce15ed5d079bc251754a39f8545c68ce6ae31ef3e82f54f5412bf

SHA512
db1811e079c34c287a3460eef4f5ea3c9d8a46c7b43fb22db9eb381d81ba908c6c0b427be905f307505c43a94753a8cb8b01b99a1af05f6cd8c6b35599ed48f7

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
156KB

MD5
56bbfa843dc804f61850c95f7907f498

SHA1
9b172b79a683ab4ca733fd6dcf29348aa2ad0956

SHA256
1b4c8f323f1da757c2aa16cfa67aef7dbfb34fc253958e16fdd142860a763cc5

SHA512
9295267f8b1861ed9fbbde64067075fd7f54b09a4f1fc5872aaa3f4e87c1983e4e1b28080013e516c9c8eff2e9c2e2f16e9ac26b902853b504d8d427059427d7

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
156KB

MD5
560b6f2f449e0f369e092d1737400ecf

SHA1
ea6cd0af98e26226ef78cc03664e56795f80aa21

SHA256
41c22be5130856be6c887935c0d9ba4715d52cd549ec7270aceb213615127ee6

SHA512
03da29fb14535972c91c725fa88cf6193fe7e37e541daf6469e69bb4b159a16c6267b2bde1dbd8d916e628a253c90bf6a306d58261cee7a327b1cd3beddacbe0

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
156KB

MD5
95f86bfc3ffa7674e1631e641d93c8a8

SHA1
6ce78acf83977e4e48645e2fd55b18ee881fe37f

SHA256
113b2c84b9532edb963e2bc74a4bc1fcac75749f00562016179f9c3e5f3e7cc5

SHA512
8dfdc0f0fa4cb15c99f92702497ed710b5cc6e5829e532d3f3b128961827a25c0706b14a330bb3a8b56a7959bb6ea4e7bd897dc6eb907984ee907e4321eaa1cb

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
156KB

MD5
9653b8400b39bd90e913da6ce6f3850a

SHA1
ec6599d3146b674ac3fa5f3e7adb8b3f21f77ef1

SHA256
3f15b47b22bb89870a47b790f40d9f5da720d7be86eb7d082fe19c738a1c3edd

SHA512
cd3e8f0c2b48a3c781c610d34e12cbb7a20951393b63a3f316b3856daba64b783da58fc42df129a1351439b7e6da58d79113941cd96b60ad8d7f002939ce5645

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
156KB

MD5
b3ae5058a2ee3c4b624ad1d181a0ea2a

SHA1
875ff1d1bb9c8dfee3ebfebbe8e4f5fee4ae8ee2

SHA256
2a11a068b561834cedee9751ce876c3f95f66cf76b7cf1f6436a937594f42a84

SHA512
dacb4450fa039065a6b361182c4af5c0271f2d5a3667328e229e5619bbc3713af95a244c4f61b24e20dffc91a41ba428454e042444bebfb70c670d63c0a48def

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
156KB

MD5
200a07209318fc8b0d69755709b5d565

SHA1
08420d8c86bf62e7bebe1ce55ec3f8c6a4c46de3

SHA256
0d21e6529a2c943ee91ba997bfeb0788c395974197bca013288df6cf4d41ed27

SHA512
238f30d9549c843e31dfcf4b1e652184024ff67338e3b4d9738d36c53d31595903957e0f14083f4842b6290afe6ccb373e3f74ac4894b3d13f408cb4675ad4a0

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
156KB

MD5
b4ace60056bf434d2cf71e6f3c2d1c18

SHA1
70b1afc4f2d26c9817c28219bacbf299e48f9aa7

SHA256
b1cccce12a3538eb73421e7d36156e1a045d6f45ecb48d00d4a0e8ffff485287

SHA512
071b0abd50feb77e4af4a5bf265232727224f3588817e37d5cc253f2eeb2bfd61570e6836f4ab669956a890122204e1c404b06474d522615587afd94babec02a

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
156KB

MD5
da5fc732c94c27c353f478b57b7d0d84

SHA1
21718700bd27c685d07d570d2a4eee3d30130dd7

SHA256
87eaa4f578f337e4fe19b471b757ebdf8718869901596ed7d8b174cb86f74f90

SHA512
82be4e74cd20ef6fe6ced4a1f0bc82d9c34b8be3424d8a10d3755ce2b25e9def3314a6bdee0c98461d89d4dcd414dea43de9936958f1da751aa1059d45d5a67a

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
156KB

MD5
66da0239048212ea098ea8e9a982524e

SHA1
f0a74c2ac7e88c511a0a6e9f0a23575f6aa7d1bf

SHA256
eba6433392b8a1c3341271dfc9fec1f165f419c5cfa84a6c05daba139f0bfcec

SHA512
18bebfae72594cc5ba3b152d091d37be3abab5b5e7bc334799b87f413039fa4912a75a78816d0292fd082fa05bc1deb6699db6e63e98f497f7fb63134073180f

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
156KB

MD5
577b7e7607c022a8789a321f99c12eee

SHA1
d455a7cc521a4a9e9ed9030d7577f74de71ced61

SHA256
90c503eb56d1d2205d528b73bb23135e652f87ae96df1d9b790b284a9eb1f9d8

SHA512
3b4b22a5969b86d4c2c0e004f99bc83abfb7d921971c54e00d43466d29edc05dcc161a723b13c5c052d94493f562ea36198ded495fd5d5adcd5dec87d8dbbfaf

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
156KB

MD5
3bf9d34308debd92833cf8ddcc15eb13

SHA1
ba6093571b054ff09aaaf0ca6dc513fcad0a1d6a

SHA256
f745962190cc5c28964a84970514c6d4e40449636b5ab38e54fd74cf01216616

SHA512
8cd15a7c7913b946e4d053479d9fca235e649ecc2f665af2e5ce8d7202965168b11b9dd215cd43e41118faf91d2f022b675b237b73461ad02ce6acb46a1d1cf5

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
156KB

MD5
0a8ef2a1f4dd2b2042c0938ba09d5eb0

SHA1
aac1a90121e48b6f60116b3498556e748656a65e

SHA256
2b9927ac5b21884076aba6eae31a7d6d5208e98629afe8c068c46e4acfa0ea3a

SHA512
6ad2cfee285e5ac69180766943584412840e33e6402d24c4ebd054ecc680ea4255e685f986314c888f946a168f0134bc477fe40a0a14ee03e2ab720d75cc5686

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
156KB

MD5
3fd00f289335b8e254e9794eda332286

SHA1
8a6bbf58e1c7051369467e6a5c9804fee77502eb

SHA256
3709a73414b511f1206d8bbe80491e8c89ebe8aa46162f84272fae15f7eab082

SHA512
b6816304de78b31ce7f8242a39f3efbd7f1032ce49beaa48012775e193cafed5069489d667a5a71b4e77656677e7bae324149ceb36f55eb9836371bb2e2b3077

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
156KB

MD5
02afbeb823251b00c6b30c9d535250d8

SHA1
fd5da85652c96ae0d193c80deede02e441528ed3

SHA256
f9ee1997f276c9d38e9e306e1e0378bcd04376524a15df2d2f79c08f9dd15b28

SHA512
c6cccc57df829bbb8f0542687971fc18496dea77f4c516222f7e536db96c56aa6cc937cd83f66897eeb42df1c09ccdb1959113abfdcccc4ed23fd953e1289f49

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
156KB

MD5
a96a847ae71689d7578d5532c650f7dc

SHA1
21d431774ab01835df4f2d69252795004532e00b

SHA256
3ecf9496c61660ddf695533d4379e95675deb7c3d20e2222233c61a026741b87

SHA512
bf72114cfc421e76171db9f4759ca40d4d47ef18d7c75742f948b47299201c654eddb1ef8635dddd347f2be953ce45dbfe3d0dfaf1e8f40c9df51e2714cd671c

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
156KB

MD5
a1a77ce11b2f803b66fefa0f0bb01e03

SHA1
0d058592e68002d244b2f309891ebc08ba7f8d57

SHA256
d056767a59db39d75a65d1836f9212a4a65cda588aec4fb76228d6815d6219d0

SHA512
000e5059530354819e779e6b1f47c6d41503d8a563a11e060c8cf1d41e71f22a3753bf3a0c29e83e403c253b0a4da9e496df0bc83a04a48c2de75d2a6ac1fe0a

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
156KB

MD5
05438ce2a23c5839e1a5e2fbbcb09f53

SHA1
9f5add60604605e44eb6b9ccb1f6f04d47c04866

SHA256
9ab55fb6d31dd78123724c5beafe0cecc05f961a60eaea655e8960b71597f53a

SHA512
0965b265a41ab8c8a41d3ed7235a90ecf75f9fc4eac4b5c337abc59161a7b6f22d93dab97a963b95fc65e50928c260fdba179d922a73a35957b088ae5a7877f4

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
156KB

MD5
13add793f8001049c86e907f8c4c0c8b

SHA1
8f8ec03598cabc7dcff82aa49a25184dbb017d56

SHA256
586e2e08dbbffb996f71e4c38aec3780e1ec8e8fe1d6b88941e6af5afb7ca798

SHA512
016f210be1dc6b475bda8598ccb69acc4cfb7e6ddb6fef09a3d96940d8755ced2e93682ac509daa9052db96fede3c00219c3b4355a0331912b91d7c277de0846

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
156KB

MD5
7ff984cb6982488307a178c8abda034c

SHA1
a2d8b6e53895c7390665eed555df0f2d0784f3f6

SHA256
257e38757f93235a1d05bca676d95c1dce2fa7aade3f82f304432498dac029b4

SHA512
67c696f386002890546b8135ba320c29ccc18ef03aba66d0eaae7bac2e121b308b27cd42a1bdfe63b21bb17f957f7b10c153ee1de99e2f1852c6326b7c0a2815

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
156KB

MD5
b6de6f649ce102b7dd7b658b9ef8eca5

SHA1
a7f3d89131ba3e56f054dae63495e5f8e2e765e4

SHA256
c631f7554a9cb5fecc54ee59a9432c7ca02776e84d0403dad83dd13dca1a1efc

SHA512
d67d4e00f04cce8f2c065f887031b2d80f00b44b47f0f710120024ff81ed53c3b58968c0212f86a663c924258489da23f0428f7123ed73c4fe91f020a689513d

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
156KB

MD5
16be6cd3c1da2be71c8d39f5922a3a7b

SHA1
804d1aa30a257898bc039b1edcb493660545a884

SHA256
db424766e377875dc1c1650d29d8070681272253521e9783c485f78aad9158c1

SHA512
d3d5911cb69708c5e516ff7883d92c419ffdbcb29a1a2372ba61b0226875f2fc82773667974750308954823f3cd396e2ba5b0d7122ea5facc12c5fbb2a6b4e27

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
156KB

MD5
83d386c50c24137ae9cf27db80a038ef

SHA1
7980df39f3651e283ce5344d571546887815ccca

SHA256
d4dce5068887018586b96207af26e677bc2f6f0f5b21ae81b4d3c3c53bd34115

SHA512
1520338640c8ca5cd738c561b2b179f3690d68b54d8b748559146180a1a3563e16b451d57a833ba4bedbcb7fc26d2332a72709e4ff809df79a70a42ab18be415

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
156KB

MD5
fb4c70900ba2c2e5801e1d11c75952f6

SHA1
67dd5c2d1b6842717524d305857625bbd5c9fe68

SHA256
fba78d3e958f6960824daa24b8fd8b0b1085d58f797271c3024eb6f90518c164

SHA512
f7f717b46795c2048e8465a1d1b50f7640de821ced5348146255267f02ee3372b243828bfe255c1dc7d8702923e367e923df151ce24c96a0f84c76a6b7e4ed4a

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
156KB

MD5
2b3af9f5f2b9b1656aaf0dc025acf3bd

SHA1
3de2285efd47e210017554252c26ec8908e1ddc3

SHA256
a5341ee1ef098ef1f6254b8a733c5f3559b36a0e63c47da83776cdd178b26b46

SHA512
0e1117e964b858f48394ce101b7418c2270344338dc2e15719f668daad7bef97666d35783fe23d7980c5d19bba4ce29a0f060ff0b0ae272dfc2be219fb38cb1a

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
156KB

MD5
f322e24ad718bd0a1302e4aa224ad4fd

SHA1
8467edb761bb486b6729bbf579b3eda8bcf6201c

SHA256
ed42ec4148fc6aa150138d985211788e468241e3ea24eeed028395d5e85f1160

SHA512
799cdd0d3bf3d35d906357c8b9468c70162130204035ee2add3d819b56738dd98feb6bae1e54ac0942d95e43823ded8e515757a4279f7abe5542d1775662132a

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
156KB

MD5
4029896c4b4268e020bda531271f4728

SHA1
435b1e9752fe7418c5ce5317477b6e639177a4f6

SHA256
bba4d2f4953f21fe026a4586559c265d064b9b40d18a1b5aff7ae80c55643620

SHA512
0de118e416d60d77f28bc193e012e1dbe374a28090b4a1b1d061a5c302125f19488859f91b3f2d891bdf033e2a8d9ce32646e7c4e1e9825523000768ff957e9f

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
156KB

MD5
942e78552bfd603aa7886c7d644afa5e

SHA1
cf536612029d9edf80f2f9023773a2b22db42cf5

SHA256
eb73dca004c9a8a2bc8c7c191c5cbc2c99ffa281885b6c23cb40eb2a1b193134

SHA512
42e4d0b307ba0a40ce1b28148f1be83fe6d8cbba148be321f32d85999d1d7eafb4c0e5bd115269be25f2fde2c5dc0d9adf99ad99e984081ea687d1b0f30e81f4

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
156KB

MD5
07f0e6d50ecd9ff965ed71c76137f9af

SHA1
6cb542cd666e0cf53c38187679518d5a5107932a

SHA256
d922dfcc2997d242ccddb3cf5cfbd4031e454cfa6ed7cf35f48cf6e9168b8ade

SHA512
f91228e90a640e96e610b56bf79c19ca08bc0b849d9608f578e68e1c9706f8956b001061c38ceb1db5a101b4fdff4c9c1d1fa6a3ff70ce5e60fd35275982e734

Download Submit
C:\Windows\SysWOW64\Ogogoi32.exe

Filesize
156KB

MD5
0b877f177d254283b789e2efbe890f07

SHA1
f209d4e9d11519b57dc61ecf5f1e5a35b58d1cfb

SHA256
bbaee1f86d5240d60f5c0c3716a80647fec79a7621bd886cedcebbf1b60590f6

SHA512
75566274aa28d7cde4665294fc25579c4da88b6ce377d61e9f5897745067a3c1fb108ad4a15a6820ba767f5dd159e3f3b4e04f8c262d76a9406f17a4d5dd061f

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
156KB

MD5
7760c66d55d8578e835955b5fca65f9f

SHA1
7b4bced14ba165e76003107d20a42fa09872e9f5

SHA256
056c8fe7ef2e9a8c3fcac7925d679d69f91daacc8e00be8a87589ebf0a54ca1f

SHA512
5a124e0aa93f8c51adc240dc18210fda511576155aece40f671afe8574574ad0358ccf9f2bce37c78adf38c52a64398ce07d5870eb6928e9e1da29fb799542c2

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
156KB

MD5
4fd479149b34b5599b6d19ad7dff3b6f

SHA1
e368e8332dc46a726e2047e33c7d16372afe64f8

SHA256
7bdeaf0e0d47b847b65d2e30adb132258c8279d43ea0742e5f9c99af8fb0d621

SHA512
8d0e35a5fbce17e634cbbf1fce42db1cc0c9b2c1e86c418769d9b692da0a6ef8dee07b59c33edb7f0c647560727e3da638bea6c61966ccdfe9ff83d91e6dcf06

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
156KB

MD5
d090fd9b86d91271247cc52157d2eef1

SHA1
4753c89e664f1414fe227bb530d62536f510e117

SHA256
285543e11ebce41ba8e22a8e9b0c12da630ce2e8940169bef98bcb47016dd2d1

SHA512
305442672165bcc01d978b5e665a8d449a08365529b4f3ef2e88234ac7d0fe9d34115a22bc3469aa99227a0d9805b1567175e71f6df164025b34ed00fd0ffd2f

Download Submit
C:\Windows\SysWOW64\Okolkg32.exe

Filesize
156KB

MD5
ec57a344f30d04abe29c2207120eb696

SHA1
a818366c98414e0e1901d2f4bec7c3c8bf12efd0

SHA256
7e13bd4c6c8b59e5a097713f3ecba7aae453aec7c3d3694ecefe7c2174e354a4

SHA512
b0dcfb17d4c4887607bad4b57ce3fd1fbfdf7ce1c4e79f3a9114d90ee44dc69fe216b06fea0ea2e5f4821b9c85a469b496f9b4878d6576b6e61ab038d8b3ade5

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
156KB

MD5
4339357d488577031502ed150b5fcfc6

SHA1
648f8d5fd754c3638afa756b461447658f4f5db5

SHA256
1946d85b4b22261461b563a8f7ba91918ffcf9753536b563adbbfaf158f59ff0

SHA512
7633ffb214fba32aa9ffb14b55bc424036f48791716ae98a8564bc491aa0282dd6493ca72b96ad203f103ef811acdaa1a367ffb9e818e5d9709597cfe2f63a71

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
156KB

MD5
012ae934bcd871075be262689b943bcd

SHA1
08abca4149657d2cf6ce57c474536c2622b16188

SHA256
ce29caaae4984eee30d777642bb384d2d1cf464c33fc7814c169cf5e891cecbc

SHA512
29d379f5acb59328a323407b3abba7c9eb4929262b3fd39d151e89efdd85749d6a188dd1802ca0044e361ff175f0d58992100eb85a81d12d16982e5c99e4d55e

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
156KB

MD5
158f21e3d59880c7588235045e9cd940

SHA1
706e3d8fe741f845049cf9eececd646920912ec3

SHA256
f191dc538d368897bcea006aebba02dbc62e2f44d2ef104569222bfd142453e9

SHA512
ab68ff6f12aaecd868c5f06933209db0f4a70802d151f00f1f10db01bee2adadd3912a84ad0b53d89210b8020ece4790087ba5bbc5c052062658b0bc1a3979bf

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
156KB

MD5
b812f807dcaf749cf317455f2baafced

SHA1
9ee25e1a21839395324fb0c25fdbfe57dcd3fc38

SHA256
0979256e53e64be28444bc3f96f14c456cd17e67b8290ab5f4ce031693af3ea4

SHA512
28cd0fdbc7f3ca04fd3af6029b4ac7793f4820fb4b770fb26f83d6e616698d88e0cbf34f5e5191fbe6364ea6648514bad02b8f320c4a9e0f7d2727ebe58f0f13

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
156KB

MD5
dc8b5eb6e39f3821f94bc9e08c6c0c73

SHA1
c460ec9fdf970f065bacdfda8ed479fd160c8375

SHA256
0f01d0fec5d7a20bfd939716e3588e21cb35d62b8084223149f9578540eb939b

SHA512
fe50d3737e834bf15048ec39cd3486307a727055061cf64e5bdcd3651e98c953988fa9347710444eda644c79b5b3686d19f4a0b5d3ec9de76a60e177d8b71682

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
64KB

MD5
1f5afeaa75d9d8ecdcbe36b0b6279fde

SHA1
83fec9919ba0a2d8830c085d8f7325cafbbec24a

SHA256
566cc434cb41d63e6413c89f1ac80f6d507f3922e426018c94fcfb96c2914e1d

SHA512
65d7b22af41320b255ee1d0c5c75df31537541a8f85aa75563274cf7c0fec07d8efd449cb79ccf4132183933bd7af8e012374ec91b27890a55c0a8bc8283ba67

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
156KB

MD5
6662f6dc8e55b713855e8a34f3b129bd

SHA1
e7228f27e9488d448533adcf682a938e05a94911

SHA256
8b4c4de9e36f867516b634c1a519e21d10c5611554b6d6476e267ec55a07abae

SHA512
a06c3156f8b892232982fb729ffdbf0e51d51778d132a1b5be6e56ee0426a0fbee29f9eed2d653098616f77719a841da9555c619fa8af8ef079f9ce9fd1c67e8

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
156KB

MD5
780d394833480ad9823466aac15bb5ce

SHA1
05fa7ffc2d4631a5be2595a03c970384485a281e

SHA256
efdf6e6ead2665c79b38974817a1ab01317ce67a931bf45c5539cc3821813678

SHA512
8ac372ccbaf4c81a88b46fced2fee150750e2b4be1d148abde3379bd5472018b91a5a8628b1dc0c7b5edeecef68340e0cedb88e08c1abd2a7a11ef3730126f69

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
156KB

MD5
918f740dc92d4456d75a86a47bcad6c3

SHA1
3622c55174d97d963638fbcb6fa5a4f6ded9f5a6

SHA256
d8557fd18e9a84162aad8502fcb3ad23f5c047535c8bf2274ee575d9dede5c13

SHA512
a4c8fcd3e4e1d35cd37fc2c404d0a688b4f330529b5078b0efa7788e4615ddc99722ecc4fed070cb12d8a3aaf79cf7a3c9fd332af91c32426557b5e40eabc4b8

Download Submit
C:\Windows\SysWOW64\Pkceffcd.exe

Filesize
156KB

MD5
6713c3eef10a96757991bc0a9f9ee494

SHA1
8642252b11929ed6cb2050d77f8bd831ca549f85

SHA256
3fadc8fd80c633439d4f6e3ae3020a385b9455721ec3dee7896d3c6f56b48645

SHA512
3c9ab4429b9051dfeae5fb49491379a1f86a1a9e055bd618eed1a478ce94f8c885cae554ee9c6e3fad60449a43f0a84dd26721dc82ad580abf0b474fb81303cb

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
156KB

MD5
6c55873be8ff6e39002e9d94cb4c49f5

SHA1
644e19ae7164a905e09f7854125a1a76c1133862

SHA256
412599b9cda773b97abdbdf4acf0880a37f655d755381cd3d79e11a7c6dc0025

SHA512
5b292e49b51971dc383c984ebb8643d8eca39e7b73d6eb04ef81bfc9d506221ec0b45eb123d6f6897a9c90dfc4361d04464ef5e686fc18b24dbdfa1eb0b99d55

Download Submit
memory/8-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/212-118-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/392-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/488-174-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/528-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/568-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/824-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/836-339-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/884-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/944-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/984-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1120-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1140-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1228-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1236-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1236-571-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1256-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1308-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1368-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-543-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1672-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1756-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1788-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1872-549-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1872-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1872-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1892-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2116-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2200-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2240-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2240-598-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-182-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2364-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2524-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2840-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2844-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2872-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-591-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3040-141-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3124-565-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3184-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3220-584-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3220-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3228-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3248-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3320-221-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3328-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3520-551-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3604-69-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3664-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3764-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3904-495-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3936-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3956-564-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3956-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3976-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3984-244-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4020-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4088-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4100-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4148-158-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4224-553-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4280-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4452-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4468-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4476-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4484-483-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4640-529-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4652-526-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4820-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4856-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4908-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5048-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-166-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5088-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5104-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5140-572-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5208-583-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5252-585-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5348-592-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5392-603-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads