bbb69c06f685de58df9f25f13d6214ba186c7985e856dc8fa59a4cbfcec84661

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe
Size

55KB
MD5

90efb54757e4a144a97896aff8df9e40
SHA1

3991f293468e85436681ac5b1c745c176ed29169
SHA256

bbb69c06f685de58df9f25f13d6214ba186c7985e856dc8fa59a4cbfcec84661
SHA512

263cde846769251881293ddaf0d786572065966996ce4b25ad195027e12ff2dec001376ddfc5a9bedcdb934c0db3537784626715a83ae09a7e081cebe17996a6
SSDEEP

768:kkbKGsNr9RDIIk8Wu83zekO79Y/dMul4ykWE3GQhKEb+yCjf4q1Kz2p/1H5LXdnh:5KhQIkrX3z47KdP4ykrOFKz2Lb

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebfign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfoann32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkmjaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lafmjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deqcbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbeeiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ickglm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moipoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekcgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnldla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbjena32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Galoohke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khiofk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbocfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiagde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edionhpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe

Executes dropped EXE 64 IoCs

pid	Process
3944	Cbdjeg32.exe
2552	Ckmonl32.exe
4068	Cnkkjh32.exe
5060	Cfbcke32.exe
3612	Dkokcl32.exe
1280	Dnmhpg32.exe
1080	Dmohno32.exe
5016	Dbkqfe32.exe
4648	Dkceokii.exe
4440	Dbnmke32.exe
3832	Dmcain32.exe
2548	Dndnpf32.exe
1120	Dflfac32.exe
2500	Dijbno32.exe
868	Dngjff32.exe
1696	Deqcbpld.exe
4420	Enigke32.exe
1400	Eecphp32.exe
1356	Enkdaepb.exe
460	Ebgpad32.exe
2756	Ekodjiol.exe
4316	Eicedn32.exe
4496	Enpmld32.exe
4332	Eifaim32.exe
1040	Eppjfgcp.exe
508	Ebnfbcbc.exe
5112	Fihnomjp.exe
3592	Fneggdhg.exe
2792	Feoodn32.exe
436	Fligqhga.exe
3992	Fealin32.exe
2856	Fmhdkknd.exe
1260	Fbelcblk.exe
1668	Fechomko.exe
4848	Fpimlfke.exe
3352	Fefedmil.exe
1296	Flpmagqi.exe
3568	Fbjena32.exe
4676	Glbjggof.exe
4532	Gfhndpol.exe
2152	Gldglf32.exe
3364	Gncchb32.exe
3936	Gemkelcd.exe
3380	Gmdcfidg.exe
1836	Gmfplibd.exe
4868	Goglcahb.exe
5116	Gimqajgh.exe
4396	Gpgind32.exe
1996	Hedafk32.exe
2904	Holfoqcm.exe
4340	Hibjli32.exe
1724	Hlpfhe32.exe
1736	Hbjoeojc.exe
3228	Hidgai32.exe
1796	Hpnoncim.exe
4812	Hifcgion.exe
2488	Hbohpn32.exe
400	Hmdlmg32.exe
3276	Ibaeen32.exe
1012	Iepaaico.exe
740	Ipeeobbe.exe
396	Ifomll32.exe
1192	Imiehfao.exe
5144	Ipgbdbqb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Clgbhl32.dll	Ckmonl32.exe
File opened for modification	C:\Windows\SysWOW64\Aopemh32.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Dqpfmlce.exe	Dnajppda.exe
File created	C:\Windows\SysWOW64\Enndkpea.dll	Hnbeeiji.exe
File created	C:\Windows\SysWOW64\Iimcma32.exe	Iafkld32.exe
File created	C:\Windows\SysWOW64\Dddjmo32.dll	Panhbfep.exe
File created	C:\Windows\SysWOW64\Bdmmeo32.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Ekcgkb32.exe	Eghkjdoa.exe
File created	C:\Windows\SysWOW64\Pqolaipg.dll	Ocdnln32.exe
File opened for modification	C:\Windows\SysWOW64\Eicedn32.exe	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Flpmagqi.exe	Fefedmil.exe
File opened for modification	C:\Windows\SysWOW64\Moipoh32.exe	Mmkdcm32.exe
File created	C:\Windows\SysWOW64\Cammjakm.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Amcpgoem.dll	Ljbnfleo.exe
File created	C:\Windows\SysWOW64\Cnhgjaml.exe	Cgnomg32.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Deqcbpld.exe	Dngjff32.exe
File created	C:\Windows\SysWOW64\Gpgind32.exe	Gimqajgh.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Gadiippo.dll	Oabhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Bpfkpp32.exe	Boenhgdd.exe
File opened for modification	C:\Windows\SysWOW64\Jimldogg.exe	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Pjphcf32.dll	Oiagde32.exe
File opened for modification	C:\Windows\SysWOW64\Hbohpn32.exe	Hifcgion.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Ilnbicff.exe
File opened for modification	C:\Windows\SysWOW64\Aagkhd32.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Fqppci32.exe	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Gijmad32.exe	Gacepg32.exe
File created	C:\Windows\SysWOW64\Pmhkafda.dll	Imiehfao.exe
File created	C:\Windows\SysWOW64\Bgpcliao.exe	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Feenjgfq.exe	Fbgbnkfm.exe
File created	C:\Windows\SysWOW64\Cnokmj32.dll	Momcpa32.exe
File created	C:\Windows\SysWOW64\Lippqp32.dll	Fpimlfke.exe
File opened for modification	C:\Windows\SysWOW64\Gmfplibd.exe	Gmdcfidg.exe
File created	C:\Windows\SysWOW64\Nkgdfb32.dll	Ofmdio32.exe
File opened for modification	C:\Windows\SysWOW64\Dolmodpi.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Ahfmjddg.dll	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Kadpdp32.exe	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Mfnhfm32.exe	Modpib32.exe
File created	C:\Windows\SysWOW64\Fihnomjp.exe	Ebnfbcbc.exe
File opened for modification	C:\Windows\SysWOW64\Fligqhga.exe	Feoodn32.exe
File opened for modification	C:\Windows\SysWOW64\Nclbpf32.exe	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Hlkfbocp.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Jllhpkfk.exe	Jimldogg.exe
File created	C:\Windows\SysWOW64\Fgoakc32.exe	Fqeioiam.exe
File created	C:\Windows\SysWOW64\Oqklkbbi.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Cdecba32.dll	Dbkqfe32.exe
File created	C:\Windows\SysWOW64\Oanokhdb.exe	Onocomdo.exe
File created	C:\Windows\SysWOW64\Paeelgnj.exe	Pnfiplog.exe
File opened for modification	C:\Windows\SysWOW64\Bgelgi32.exe	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Ciipkkdj.dll	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Nmcpoedn.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Jnifpf32.dll	Moipoh32.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Acankf32.dll	Doagjc32.exe
File created	C:\Windows\SysWOW64\Eqlfhjig.exe	Enmjlojd.exe
File created	C:\Windows\SysWOW64\Mjaonjaj.dll	Enpfan32.exe
File created	C:\Windows\SysWOW64\Nohjfifo.dll	Pplhhm32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Iblhpckf.dll	Lnldla32.exe
File created	C:\Windows\SysWOW64\Dnkdmlfj.dll	Aagkhd32.exe
File opened for modification	C:\Windows\SysWOW64\Coqncejg.exe	Chfegk32.exe
File created	C:\Windows\SysWOW64\Eibmbgdm.dll	Gbpedjnb.exe
File opened for modification	C:\Windows\SysWOW64\Lchfib32.exe	Lcfidb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11336	12248	WerFault.exe	546

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gngeik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlglnp32.dll"	Jaajhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpecpo32.dll"	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhaoj32.dll"	Fdnhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlqeenhm.dll"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbdfqocb.dll"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jihbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kolfbd32.dll"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgpilmfi.dll"	Gaebef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kplmliko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mokfja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feoodn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmhdkknd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlgoek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichqihli.dll"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfoaecol.dll"	Coqncejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgcjfbed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhfpbpdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhfjcpfb.dll"	Flpmagqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphnbpql.dll"	Kpqggh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbdjeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pffgom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dflfac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almoijfo.dll"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihdldn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpnmig32.dll"	Jafdcbge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchkcb32.dll"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehenqf32.dll"	Dhikci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anlkecaj.dll"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hibjli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnnljj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipbaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcodk32.dll"	Khiofk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Modpib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kckqbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plgdqf32.dll"	Fofilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcilohid.dll"	Pidlqb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3944	856	90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe	90
PID 856 wrote to memory of 3944	856	90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe	90
PID 856 wrote to memory of 3944	856	90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe	90
PID 3944 wrote to memory of 2552	3944	Cbdjeg32.exe	91
PID 3944 wrote to memory of 2552	3944	Cbdjeg32.exe	91
PID 3944 wrote to memory of 2552	3944	Cbdjeg32.exe	91
PID 2552 wrote to memory of 4068	2552	Ckmonl32.exe	92
PID 2552 wrote to memory of 4068	2552	Ckmonl32.exe	92
PID 2552 wrote to memory of 4068	2552	Ckmonl32.exe	92
PID 4068 wrote to memory of 5060	4068	Cnkkjh32.exe	93
PID 4068 wrote to memory of 5060	4068	Cnkkjh32.exe	93
PID 4068 wrote to memory of 5060	4068	Cnkkjh32.exe	93
PID 5060 wrote to memory of 3612	5060	Cfbcke32.exe	94
PID 5060 wrote to memory of 3612	5060	Cfbcke32.exe	94
PID 5060 wrote to memory of 3612	5060	Cfbcke32.exe	94
PID 3612 wrote to memory of 1280	3612	Dkokcl32.exe	95
PID 3612 wrote to memory of 1280	3612	Dkokcl32.exe	95
PID 3612 wrote to memory of 1280	3612	Dkokcl32.exe	95
PID 1280 wrote to memory of 1080	1280	Dnmhpg32.exe	96
PID 1280 wrote to memory of 1080	1280	Dnmhpg32.exe	96
PID 1280 wrote to memory of 1080	1280	Dnmhpg32.exe	96
PID 1080 wrote to memory of 5016	1080	Dmohno32.exe	97
PID 1080 wrote to memory of 5016	1080	Dmohno32.exe	97
PID 1080 wrote to memory of 5016	1080	Dmohno32.exe	97
PID 5016 wrote to memory of 4648	5016	Dbkqfe32.exe	98
PID 5016 wrote to memory of 4648	5016	Dbkqfe32.exe	98
PID 5016 wrote to memory of 4648	5016	Dbkqfe32.exe	98
PID 4648 wrote to memory of 4440	4648	Dkceokii.exe	99
PID 4648 wrote to memory of 4440	4648	Dkceokii.exe	99
PID 4648 wrote to memory of 4440	4648	Dkceokii.exe	99
PID 4440 wrote to memory of 3832	4440	Dbnmke32.exe	100
PID 4440 wrote to memory of 3832	4440	Dbnmke32.exe	100
PID 4440 wrote to memory of 3832	4440	Dbnmke32.exe	100
PID 3832 wrote to memory of 2548	3832	Dmcain32.exe	101
PID 3832 wrote to memory of 2548	3832	Dmcain32.exe	101
PID 3832 wrote to memory of 2548	3832	Dmcain32.exe	101
PID 2548 wrote to memory of 1120	2548	Dndnpf32.exe	102
PID 2548 wrote to memory of 1120	2548	Dndnpf32.exe	102
PID 2548 wrote to memory of 1120	2548	Dndnpf32.exe	102
PID 1120 wrote to memory of 2500	1120	Dflfac32.exe	103
PID 1120 wrote to memory of 2500	1120	Dflfac32.exe	103
PID 1120 wrote to memory of 2500	1120	Dflfac32.exe	103
PID 2500 wrote to memory of 868	2500	Dijbno32.exe	104
PID 2500 wrote to memory of 868	2500	Dijbno32.exe	104
PID 2500 wrote to memory of 868	2500	Dijbno32.exe	104
PID 868 wrote to memory of 1696	868	Dngjff32.exe	105
PID 868 wrote to memory of 1696	868	Dngjff32.exe	105
PID 868 wrote to memory of 1696	868	Dngjff32.exe	105
PID 1696 wrote to memory of 4420	1696	Deqcbpld.exe	106
PID 1696 wrote to memory of 4420	1696	Deqcbpld.exe	106
PID 1696 wrote to memory of 4420	1696	Deqcbpld.exe	106
PID 4420 wrote to memory of 1400	4420	Enigke32.exe	107
PID 4420 wrote to memory of 1400	4420	Enigke32.exe	107
PID 4420 wrote to memory of 1400	4420	Enigke32.exe	107
PID 1400 wrote to memory of 1356	1400	Eecphp32.exe	108
PID 1400 wrote to memory of 1356	1400	Eecphp32.exe	108
PID 1400 wrote to memory of 1356	1400	Eecphp32.exe	108
PID 1356 wrote to memory of 460	1356	Enkdaepb.exe	109
PID 1356 wrote to memory of 460	1356	Enkdaepb.exe	109
PID 1356 wrote to memory of 460	1356	Enkdaepb.exe	109
PID 460 wrote to memory of 2756	460	Ebgpad32.exe	110
PID 460 wrote to memory of 2756	460	Ebgpad32.exe	110
PID 460 wrote to memory of 2756	460	Ebgpad32.exe	110
PID 2756 wrote to memory of 4316	2756	Ekodjiol.exe	111

C:\Users\Admin\AppData\Local\Temp\90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\90efb54757e4a144a97896aff8df9e40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\Cbdjeg32.exe
  C:\Windows\system32\Cbdjeg32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\Ckmonl32.exe
    C:\Windows\system32\Ckmonl32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\Cnkkjh32.exe
      C:\Windows\system32\Cnkkjh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
      - C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        23⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        24⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        25⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        26⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:508
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        28⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        29⤵
        Executes dropped EXE
        
        PID:3592
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        31⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        32⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        34⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        35⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        40⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        41⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        42⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        44⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3380
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1836
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        47⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        49⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        50⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        51⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        55⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        56⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        58⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        59⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        60⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        61⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        62⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        63⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        64⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1192
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        66⤵
        Executes dropped EXE
        
        PID:5144
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        68⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        70⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        72⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        73⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        74⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        75⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        76⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        77⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        78⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        80⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        81⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        82⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        83⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        84⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        85⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        86⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        87⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        88⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        89⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        90⤵
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        91⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        92⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        93⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        94⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        95⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        96⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        97⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        98⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        99⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        100⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        101⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        102⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        103⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        104⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        108⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        109⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        110⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        111⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        112⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        113⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        114⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        115⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        116⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        119⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        120⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        121⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        122⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        123⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        124⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        125⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        126⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        127⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        128⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        129⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        130⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        131⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        132⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        134⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        136⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        137⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        138⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        139⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        140⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        141⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        142⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        143⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        144⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        145⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        146⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        147⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        148⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        149⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        150⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        151⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        152⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        153⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6496
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        158⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        160⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        163⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        164⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        165⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        166⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        167⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        168⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        169⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        170⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        171⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        172⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        175⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        177⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        178⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        179⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        180⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        182⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        183⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        184⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        185⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        186⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        187⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        188⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        189⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        190⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        191⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        192⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        193⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        194⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        195⤵
        Drops file in System32 directory
        
        PID:8060
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        196⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        197⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        198⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        199⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        200⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        201⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        202⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        203⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        205⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        207⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        208⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        209⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        210⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        211⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        213⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        214⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        215⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        216⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        217⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        220⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        222⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        223⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        225⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7584
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        229⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        231⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        233⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        234⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        235⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        236⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        237⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        239⤵
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        240⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        241⤵
        Modifies registry class
        
        PID:8580
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        242⤵
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        243⤵
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        244⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        245⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        246⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        247⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        248⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        249⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        250⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9048
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        253⤵
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        254⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        255⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        256⤵
        Modifies registry class
        
        PID:8256
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        257⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        258⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        259⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        260⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        261⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        262⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        263⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8900
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        265⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        266⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        267⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        268⤵
        Drops file in System32 directory
        
        PID:9176
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        269⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        270⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8500
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        273⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        275⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        276⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        277⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        278⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        279⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        281⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        282⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        284⤵
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        285⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        286⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        287⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        288⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        289⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        291⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        292⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        293⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        294⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        295⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        296⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9544
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        298⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        299⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        300⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        301⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        302⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        303⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9824
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        305⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        306⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10004
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        309⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        310⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        311⤵
        Modifies registry class
        
        PID:10132
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        312⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        313⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        314⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        315⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        316⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        317⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        318⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        319⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        320⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        321⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        322⤵
        Modifies registry class
        
        PID:9744
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        323⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        324⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        325⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        326⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        327⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        328⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        329⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9260
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        331⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        332⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        333⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        334⤵
        Modifies registry class
        
        PID:9736
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        335⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        336⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10024
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        338⤵
        Drops file in System32 directory
        
        PID:10160
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        339⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        340⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        341⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        342⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        343⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        344⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        345⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        346⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        347⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        349⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:336
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        351⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        352⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        353⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        354⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        355⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        356⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10128
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        358⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        359⤵
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        360⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        361⤵
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        362⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        363⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        364⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        365⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        366⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10544
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10584
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        368⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        369⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        370⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        371⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        372⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        373⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        374⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        375⤵
        Modifies registry class
        
        PID:10928
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        376⤵
        Modifies registry class
        
        PID:10968
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        377⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        378⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        379⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11140
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        381⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        382⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        384⤵
        Modifies registry class
        
        PID:10300
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        385⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        386⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        387⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10556
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        389⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        390⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        391⤵
        Modifies registry class
        
        PID:10768
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        392⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10892
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        394⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        395⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        397⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        398⤵
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        399⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        400⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        401⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        402⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        403⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        404⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        405⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        406⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        407⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10280
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        409⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        410⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        411⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        412⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11160
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        414⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        415⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        416⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        417⤵
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        418⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        419⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        420⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        422⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        423⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        424⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        425⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        426⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        427⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        428⤵
        Drops file in System32 directory
        
        PID:11444
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        429⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11528
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        431⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        432⤵
        Drops file in System32 directory
        
        PID:11612
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        433⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        434⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        435⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        436⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        437⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        438⤵
        Modifies registry class
        
        PID:11860
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        439⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        440⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        441⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        442⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        443⤵
        Drops file in System32 directory
        
        PID:12080
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        444⤵
        Drops file in System32 directory
        
        PID:12112
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        445⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12168
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        446⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        447⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12248 -s 224
        448⤵
        Program crash
        
        PID:11336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 12248 -ip 12248
1⤵
PID:11308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bahdob32.exe

Filesize
55KB

MD5
e84c8db1573713ff2d0453d6a59659cc

SHA1
75449ae09de97b4f3e64fa5dde89af1a2f34e596

SHA256
4d8679807fdbd94f1153a7dbd910be3b8401c59dad7856651b10da938b873b10

SHA512
e6f0d9964de11bdd1c2d12f52f3c51f843df736b9f67eb94cba53e8a9052f97bf9ac45ffea5d2e52dd666a3319642c4b5f1da851dac216f4445b1658d03bccf5

Download Submit
C:\Windows\SysWOW64\Bgpcliao.exe

Filesize
55KB

MD5
9a7f1e395729152044cf2874213437d1

SHA1
1adcbb953fa94ddcde200071071b88334be391e7

SHA256
62809ac4e07cc9cfb1a1a10ffa33ae49ed3c1f416d486cb133eaeb8deafca19f

SHA512
a39f9b2b3eabb0a846c9778751fa63cc319743cfe05c12f7477f5c562ea5b9ac69e340be1a6a5b1f5f4739002ee5e00bb7dc5a3ff8f1ced23a154dca7015e21b

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
55KB

MD5
7a7b6adce41dcb28ed5cc0276320790c

SHA1
bc88b5b1cfcb21d3f542cab891931eb448bdd30f

SHA256
a9c5d0194675f9d006b06a2521d1afa9498e958ea80cdb6c56736b3d4c8220f2

SHA512
62551b68974df8d5794d3c6ff93185c4a4e578d57c1f90c3696f5eaa2e8149258e7988424a07ac2efa4a39d23b1b9334e0d7ccc2ad294acb6820a7e9007f3497

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
55KB

MD5
cfaf0d6717a4c1e16275cc032d815e6f

SHA1
d162eef847930a14aa5588f9e454b5f2485cb8eb

SHA256
0ed466c9f062d7c8cfa7e2dea6f482eabc816a13d47dbc35392d59fdfa4a9713

SHA512
9292b3ee65e3941f8027a29b01375f627dc745c0d3b320f98da5fdbeaff5aac863e6303c1bac9a824a92e43c8641214b47a21c316ee3ac6c1cb9e00ca9b244ab

Download Submit
C:\Windows\SysWOW64\Ckmonl32.exe

Filesize
55KB

MD5
4610a3636792d34a583a90da191b9249

SHA1
ae18e6c6c6ced18e28949c0bb3e063d44feb5be4

SHA256
fe31c29134f98e73f97d483bba6a3a30672de8f78d28f2c7d3b4e75765ec3be9

SHA512
fc8b9e983befb51c2fba0c872f7ced2603412d62edd3fec3d8414324f84bef1130722085873d62ece1f31a26fbff39f66b795738d9454c00bb06a470f4bb7246

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
55KB

MD5
426b68824d52369e4dbbd79c4b0d6c9d

SHA1
ccb93022b24863d7d39637ed6bbfa3c5bdae5f2d

SHA256
a10c9ee3b5712e78f4e6866129e754b9eb299d1d90837241053356c5abb8d4ac

SHA512
5d31d98472c2546571274589a946f1f9cd735e40d49ad51e9e38bfa9f1a03b451211e3348f90f4f8e99a918fffc0f794e50da083528abba5e18865df61b968ff

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
55KB

MD5
45bcfe294cbf446208dfe8dd553b5729

SHA1
5084e17276d85174248ec9939b958d3ff66d9db4

SHA256
eef3cdcf85397b309005cdc0e2720424df6e499f3f0a91f915454374677f1697

SHA512
33c030f829cdd8f9fdb6e9c0aec69d48ea386946268b28341dd2f37dbcdddd41e20131ce679970753c3a2f8c1ab635379da7bb08b9fbb4bf873e0d1f17f74c2c

Download Submit
C:\Windows\SysWOW64\Dbnmke32.exe

Filesize
55KB

MD5
b287ba8743f2007aa40fa7e057fcd0b1

SHA1
8b835c5d9227a7f0960bc9a398a92f8160211655

SHA256
149fe623fe7b699402515cf14c8a91a2343dc048245863c891dfb725995baa76

SHA512
7cf32f4d35243cd1280f7101285168c80418df90a4bb83e4fa87b3550a680eb472d0bdbc2a02fb08f5f92e36a87772f4a220667451dac722a4de68bdb1915de6

Download Submit
C:\Windows\SysWOW64\Deqcbpld.exe

Filesize
55KB

MD5
ecc8b030a07976160b563fab2e4614ca

SHA1
bbf23f6332a718c61be3b375ee8a5bf0b7994142

SHA256
8541393fcea192320cb0b4b474abe0c5620d717d35ac4d668892fadb367629bd

SHA512
c7911da0978a7dd505ca763ef5fea2e84b969e71d8e64d9957cb8160c4f8cdcb59ec298687cc807d52925359bd52e2c7288241e5576620a48440460bbbe5a0b2

Download Submit
C:\Windows\SysWOW64\Dflfac32.exe

Filesize
55KB

MD5
8223d400bdcb818399741b1a8163badd

SHA1
7b18794e21ad3327881b8ad9fdcd1db0b40b0e6b

SHA256
3fcfcd338fb21100470f3755f7726c931e8265c6c9dc265347d4e4b80c20cec4

SHA512
540358fdd789922264751c62a1a63d857434b1b72cc075aef754d6fa9987cbd50b505f2b8a20f0e84c92214c1de2e0d9ec87928c316ce69bbac79dea59edc62f

Download Submit
C:\Windows\SysWOW64\Dhikci32.exe

Filesize
55KB

MD5
999d13dcd74a7ba761f188a07c33aee5

SHA1
f5b4558bf3cab1169c6db9bf5a04635ed3da9bbf

SHA256
cee3125d99e9cff363666978b20a283a1ba38661625d05510fb320cab60908f9

SHA512
b12ad66aaa7fa9db2b2c74e94c61e1e988beca48330ea7c74faa91e02c352c8aa12830a7ac6e8542b47cb19dc87d7b28fb292ea2500e0cedaa9ad3965c48d277

Download Submit
C:\Windows\SysWOW64\Dijbno32.exe

Filesize
55KB

MD5
1fcab5caf03493f66fc213cc6cd7c0c9

SHA1
884472385b9ad12df5b860f4ba3793db44c78e23

SHA256
61d6651e37d6830cd6ab65b61a4fd99b328c01e57e5be8bb701e0d5251a7236b

SHA512
3d09e5fc44ecb80b22c4c5390fba0f51523eb50ebffd4bb6d259891723611a24afea20aa9adb55ad4735234abbb7eb25c1fabb348a7d5b19fe7d60f651a01f48

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
55KB

MD5
0e16ed9f26964f1b0417a234b0c63602

SHA1
9fe79f24686ad6ea1caf89483d495626f9942514

SHA256
778aba42836f3cf2de3821e5fc3da4dc83345b10f6bc0ef3903352f934262c70

SHA512
27acc525ac4a4b7a92c066bc274ac2e1255e9194d44f296e295766864fd155efee0f9badcb52396c4dc391e5f101b6b9a7e2f2392d44a0cd6f6aee8be5269701

Download Submit
C:\Windows\SysWOW64\Dkokcl32.exe

Filesize
55KB

MD5
2e935667fa4bdb97d22a7973a285a633

SHA1
698f10b2789ae806bb5ee39dce4abd7d6963845f

SHA256
f9f06931f6791dbf4f13748ac2d071319f5faad1d0fdb622e9f2aa800125926d

SHA512
0f8e0247caf1d9d7d5d787df691589bbd754d0dc16577209ab7ff5d3e63d48267c5ca09824423e793cfb7aa24ecc16a0f68021c4173512231e1062c3681209b4

Download Submit
C:\Windows\SysWOW64\Dmcain32.exe

Filesize
55KB

MD5
fb23fdce923dd9e33c9dc863413097a2

SHA1
7ed16ccbe2f5f087ea3a61464be64fad42d7da2c

SHA256
1f84c2f443adce39fd4994a0bd2925ac00c812ac37d7e7b7b12904f8fd0c9680

SHA512
87853b64ebb9ab5f4a9e805126e10039ff4856cd68090ebebb481303ad64b1ff623ec87990ab6db8c0126b5d2a8504f57fdce6cb774720bc62487662bb5c0922

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
55KB

MD5
b2f412e75a1e6e41f8f2f955a04a2a7b

SHA1
af228ba6a3add4ea3d493178e9cba250f70eb44a

SHA256
bf6e3d2f90b387b5f9a9044708c00d60ee4ea990cab4a89f2c7c5c6665bb2567

SHA512
84e4b479271166b45845f3b838285de39b8e516628c2f35a7788f3dccfbf31641376de2939eb8f0555f0d61487516cd606ac5ed0b28a2890f745a6a86843e367

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
55KB

MD5
cba9901b239ae8dfeee7bbdf09d06ddf

SHA1
b270cb25a4008b2dd4fd10149427633a44788c54

SHA256
fb841cb6d5e2d072be5e1f50ac87e931040d87cf3ef732c402a3643372e49434

SHA512
2ea32bd008a2b8dc06d824930a9774de23173326a26980c0f5c351f151c692b257dde5c96b675e87c34c6d35aaf09cfff620dc1f23379dbcd8053c5ad7a906de

Download Submit
C:\Windows\SysWOW64\Dngjff32.exe

Filesize
55KB

MD5
9eec04aac4e9e364f8ba480784298077

SHA1
a3f98e7aebf4221ab7c17949429b7e0ff083520a

SHA256
e7d39aede6f94c4156111d3f9fe10921edb1af32fc70cc685e92b2b66d85c569

SHA512
6a549d1d07535452b3dfb90841b0cc3db158fae6ffa95b0da8e291d3a268276362921e3af552c4c290885061e2ef8e6f021d52d91a1d6cea6ac62da8507dd811

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
55KB

MD5
33d37822f9e3a7b4081e0f49d581d4f2

SHA1
9f2e3782dab8afbeba2197871cba506e6148fdfb

SHA256
f6bbe0587c0ff6b7fd534c1aa10bca6739976498c1f1026651a8d631d882373a

SHA512
a0211219908ed446a3026f9be33f54651c9a55287ac39abfbe636edc2359cd8f8667f36239506eb63a2004e8b9bf0a7f42fe7abdb5cb431cd9c0b21d3792486c

Download Submit
C:\Windows\SysWOW64\Dqpfmlce.exe

Filesize
55KB

MD5
e7af4cd7f6a1388632a17a060c6d573e

SHA1
f6c6f4186543612daf080237fab9d8399026c968

SHA256
879f3d24e05fa994c19e04eb7912f01332a52093ac38895ae59cccfd6555c2df

SHA512
343befb74af6d05f0b8b181989f08bf20c57b833a9e9ae0fe147db71145b6283df15064f9c542b41c3003334115784a49f75cfc4e58a2fdf13eb13a77f456427

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
55KB

MD5
44706d7d74807bd1b6597bbe2fcd802b

SHA1
2671b3e0cd8511a8d936db31702822d6d127c407

SHA256
3a941c9041f22f12b7c23294166c6b85b6ad5ad00a64527c9e375394028716b1

SHA512
f847416c99cf155357c6ac07748dff83d0abd9150d14bdd988cf643a39ffde1c119eac013ef16b79c0f231b543fcc1fca443b8028fd288e98b4d4c6481c89ce2

Download Submit
C:\Windows\SysWOW64\Ebnfbcbc.exe

Filesize
55KB

MD5
bc06d6c28f2041aad0423deb8e0d49a1

SHA1
2585b8ead221595b83aaabaea7393024303a9ab1

SHA256
912df392f4e5b4052761b49c7ac512dde9a6c2db6bd464d46f34fca88f05bae4

SHA512
67e490b9b6d904ce83bc10bc88b43790d57c886521f946e572d0aa61246e22fbed07e71d0aceb45e6dcdeef51496c4270f48a4089dbe84093451eea2132b943b

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
55KB

MD5
2cbf2bf03d51c263ecf3208ef1ba353b

SHA1
251b80362ca6310f75a4fabb134218ef8d24d7d7

SHA256
f54128ad8d75188988535052f7181f76de0ed71c4a457cce70fde2bd17a8bdaf

SHA512
37b5d9f132e04458204af6b84c209e1a48c92498d98690b9b0f0f65a35c64d0c335bdc2e6de7101bb1d67528d77c575efaa27397d44a6dd7020e78132e101617

Download Submit
C:\Windows\SysWOW64\Eicedn32.exe

Filesize
55KB

MD5
fc9f52ca8356917847dd80bd33ceaa08

SHA1
2bb8d3f13af497f85ac0e794c04d652cec3acfd8

SHA256
83b3c3d2ff9ed17eec25a1573a1754a38e4ad7d7417f59cd681368fb60517ed4

SHA512
294e7626d212aeb9f773b0031c0f415b0c4352d320b46512aecb8e577a7769011b94052367a954fab16828edfd152fdbc58681024150d2cc1882f391834bda84

Download Submit
C:\Windows\SysWOW64\Eifaim32.exe

Filesize
55KB

MD5
5b714b182f37ab6f98545bdb4ef61f14

SHA1
64bcbd9096f2b1d2375e029c23ce58395985c3d0

SHA256
81658622dcf4aed85458d94214429e16d3daa0391a62316bbf3d32c2a7da2355

SHA512
6b9e00f0fc9f36bf41f95a024b8ae227227fe09b738e1592ab6eaa8c9a84de8b8faa4fcf90d86f5ccc0b98fd758b35c0169f3aa2a1abf850b15aa8e31e4d445f

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
55KB

MD5
dc2913812d3b451b18d6bdaf11a3c388

SHA1
50d0933ddf68f5ad385bf871e82f59b2a8638707

SHA256
fa5571b804794cfb24154c78b2fe031ae13085ed8fd0178b60e986c9b41fb6cb

SHA512
cc628d6e6dca55f836d2a074c5b083ddff02f48a2fa54e48b77bd5de4e3d48af25f30f5377f5fe99d6a2ba45976007049086f2ba0369020ade86c803c7218fb9

Download Submit
C:\Windows\SysWOW64\Enigke32.exe

Filesize
55KB

MD5
912764238ddaf95716d36c5d429192c9

SHA1
6363ec09798f6fc84df3faf05e6da26db8dbcc13

SHA256
cb61dbaff08f6d541abf3fc5eb5922d62b876fe852f3d29120c7ddb1e396f872

SHA512
a11b0984c5ab730da9e5b28775177900a14b2d3690d0d9b8ac2f5c0447eeccf83cf591c074dfede770b3247b4fbd48d6e5f4afcbe375eced05dc6ca37a751520

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
55KB

MD5
c89c023db48d9a580e43e71d3fa8deb9

SHA1
f2ed38dde53823fcb56715babef2017b834a1c66

SHA256
58be3de11538b73d070ab2b1be19da30418fc0daccca072a84424c46788ef714

SHA512
719e2e5d74a6b4c06c9bcc3cdf8631390bde0753af67b4b778350246d5b61285e79c84fb234f06b0543c1819b506b9580d402a4ebf4098acc18aea3f5e46a1ed

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
55KB

MD5
cc4f22ed59f8d64db39848e0f9195505

SHA1
8718f16625e0f1fec3d1b34427922935b6d678a3

SHA256
02d8ca936bd8a714cc956e4d471ec0c8f5851cae5495343a0ab5b50538ba4dee

SHA512
a8c5620fb67d5083c2ce049f67f64b85316d21782c2831e3a5fc70799d8aa4bce32a279e06524073fc0691988e3aed9a1a57195ce5106f33d663dd298fafc118

Download Submit
C:\Windows\SysWOW64\Enpmld32.exe

Filesize
55KB

MD5
0c6324a4b2022bda0b94ebc0400752fa

SHA1
c50b2f05a4853147d72dbd7a5344c51e120d5799

SHA256
b346e37953c942b106db3f750bf8d6ff7410be478b9da3deeac2f21aa8c51398

SHA512
54956063f3a5cc304337903604f11dcffffe2242dcd49ab4047decbcb864fa96c19f1677230404adf05d12e793bcab1f6ad3a501b8cec5752524fe4ae5cced37

Download Submit
C:\Windows\SysWOW64\Eppjfgcp.exe

Filesize
55KB

MD5
3bcabdc45dcfb61647edb01415b64ba2

SHA1
75bd46c8a67685adea096547cea008aa72b8def1

SHA256
7958c7fa1d471de03036eae0df32843d7b796ed8f32591358dc3491a187655d9

SHA512
81beef72658004566b5ef6b6e11df587e141af1c6a3a118faf6eb28eadeca9c2b7946445a9fc843c227fdfcea457fd00097670f0a2c1256d83754c623fd1d544

Download Submit
C:\Windows\SysWOW64\Fealin32.exe

Filesize
55KB

MD5
db6ef84c9e45161c8ded7a86eaf00acb

SHA1
d160e272f9cc3ff7048500f0e923228f72f115b0

SHA256
913dafb809926ccd92034f083a5ae0d99a0383d1d0b94c3edfdeaa2a4c2ad262

SHA512
e7ec6de5df400f3dcd4a05c93d5549a7356bede5fa8d76dc59c1674d591a0c52c7c48b9a952c2ed8e3800b8a1c9a27d37e556593b64d14751be8da0db42b48a5

Download Submit
C:\Windows\SysWOW64\Feenjgfq.exe

Filesize
55KB

MD5
882d5a1ee2080b7b6faee78a5103bc11

SHA1
7fb8b340a06a5c379d7c6e0ac80a8e0ddcd8f079

SHA256
239f93791381d4d06f3092197b06174e21e07651cc19a6d207348ba235c51a6f

SHA512
5927f0c88db3feccb204e1797a85a20eb22bea6020b5b86aaf1db8cfd7b76d24d437ce2801703897dbbbacaf857c75928239cd6a092836066b5d834c6f4427be

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
55KB

MD5
3352f54825000fba854793979034688b

SHA1
2f4074d04fda9dd6047d094e174de29b1cc85fa8

SHA256
858b13ca8cdaa71e0bfc52e83f71ce225c1ff060ace91a21d1a00e7d46049c38

SHA512
bc75cd039d582ef495d9a7509582ed2d4776fe08d2bbfb8a6ba21043fbfee7a7656a39a5e69632be7fc325e0fe6422bbae8c3c5db4bdc43c4900ac08ee0a11ef

Download Submit
C:\Windows\SysWOW64\Fihnomjp.exe

Filesize
55KB

MD5
2c856dccef605269d08c369da83f3e9a

SHA1
a44dfd682e9cfc5bc8d72195f9666657e3ef80f4

SHA256
a72d51da811632b92d6ce1509f98f644b80f8b0f3f0b4a16525fe5bc3371d779

SHA512
3f11d9be08d0487ae4e016bdd80bcbc3504739d1957f6f857c76e8bde2f486a4b34d136e8e7f922f96a6c87c8a3fe39c9820b35b86940e1ba0d5b79f24a939fb

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
55KB

MD5
a1c2569b251a69c77b1cb3b3067a0ef0

SHA1
da3b1ba8424a88945b1d572b3388397585512d50

SHA256
030b7f60d0721e9ec0623e7ce3ebd4eeef2276125855d45f7aa9f30d3da0751f

SHA512
962f23048f4c23968c65968cd6e34f45f7e8b628f2211020345f79d871fb51630ba008168ee79e1ca50fddac8e496139b46c562ad113f29d725cc953035578f1

Download Submit
C:\Windows\SysWOW64\Fmhdkknd.exe

Filesize
55KB

MD5
009d67664c4120f693cdb742fee97961

SHA1
0aeac2f99b3d29dc5aae400eb3da68961d374d42

SHA256
81eaa22eac4a43ce08cb89fb7bd814dff85ede3eca5bbe4ebe01418f70756053

SHA512
ad79999fbed677164fe3a1083de84cdae32b27f71eaeb9c965e74b9a9866cfc9f9f6bcadaf41314aaa90453257accc91a224e644cb65757c9bb9dc0147fcaca7

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
55KB

MD5
88977b0b79adcc8db00fb199e34164e2

SHA1
455b2fdfd6ba83269690f0c2d5e62fefa31b233c

SHA256
b2c4259738bc61c7c07be547a8bbcc9117717a4e7c3d6f70bc70d0d3b56d7e6c

SHA512
54aafff5c51b9fb08067a7218df5cf4d24b30abcd6dd3515d6a5ecc30277cc9f690c536ff23f994579131554d92b01178e2eebe3b7597bb88df0d830d62837d2

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
55KB

MD5
b52dcfcfdbdb2f46d635f5150d691303

SHA1
3c347948e247ee5265ed5013bec966d7a2c3332b

SHA256
c048506c78de0700d516d74ab8c138e10279712c6ba2b75777601721bc36d872

SHA512
a8acec42c99bc5bc0f249dc1ca7fb7f3d39e520f36d04163b5bebcbc95930d078f155c7f0aafd0446cc006723b6c94b6a3ddc3b8bc88a6e5208892644704b82b

Download Submit
C:\Windows\SysWOW64\Hifcgion.exe

Filesize
55KB

MD5
6e1909b36da6f97732d2f6b5ce9f3d66

SHA1
8f857020126ba8d4e8b0ce489fca2f4f81778363

SHA256
23bad9ca94347c21d6cccd67f21e9ed51129d60832a2cf88ecf7fabc7759244f

SHA512
7182d2cc666f9dd556827665a3c85e92470019f40ae255566de8535a61064d30ec143b1c4fd48efcc7bf158339cf478c571e5b2f7a4d344a69c70762f02d42ad

Download Submit
C:\Windows\SysWOW64\Ibaeen32.exe

Filesize
55KB

MD5
f3f4a2595acc34366b976dc381fd5f30

SHA1
e0e3011aec30e2c96747c7fdaaa3cca760244102

SHA256
13772f203974e064271c8cbbe28332226b39543b85f472c21fbfd97328c1bfb8

SHA512
b66fa4197004308d47918190dd05c05757751b3129709be46ae4594b86f52bdff4c2707bd0cde7643981fcd39fd17b5fa5c05060e827a643216da7e661d50d30

Download Submit
C:\Windows\SysWOW64\Ibhkfm32.exe

Filesize
55KB

MD5
1ac76f4a812ef747b2366de07bf37f8e

SHA1
a7186cae0edbc1bb73dc08990f402acaa2b14925

SHA256
268e0c08bc1a16e4145e0eeffbe9152ac17357281a045df99c876c96f1f98f20

SHA512
c6ff2c5fc236c7589ef81502a51448ed405ff85131b48c2420ccb45b73d8655ca1124f39f3610583e8bac3f84b225d7d0b7d926666c7c45729838c82fc50d62c

Download Submit
C:\Windows\SysWOW64\Jaajhb32.exe

Filesize
55KB

MD5
4b7196caa4532bbfb828e164cdbadb6a

SHA1
07f9724d7f5915f59a0a5a3d6b046a4d77629dea

SHA256
f7065736df6601508196ba0b622901d981475d6a78be3e8a848f9d199ab73e5d

SHA512
0abf97e77075aa19e1198e9abfc736a2d5391d29b54311032e557c53c0d57aae54ef7d935478030e2edd6cb5937147945644f1d9777d95f0a07dadb43691c245

Download Submit
C:\Windows\SysWOW64\Jlgoek32.exe

Filesize
55KB

MD5
5059a5ed2861a62489e9a34c4ffac4fc

SHA1
04d02c452192e67bf93c005d8607afb0e68b1ce5

SHA256
9108d7a5e20d57e3e14380a92e9d1c62c1c0d90a90d29a540e9438e537fc83f5

SHA512
ac0a5f86e77ed0fdffafa44f62dc5222d0c5c774d550135b487965caf88f27c681a88450778391dc5520fb34ffed19c48ec1d2d78e162a2d5431d42e1d62ad1c

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
55KB

MD5
149384df4fd075d6162ca80dbb990ca7

SHA1
5284f2bdfef4e8bc8effe9f98009ffdb62997aa4

SHA256
abdd6d91a457aec784aa5ee9981083e3c8c362990fce4f752d0110dbf9234c7f

SHA512
de4f8cec21f1e80a8d28a93817481ee72f9408022d81fe2248e957ba957dd98bab24b5d9c9f3a0e2be3524897bd05d80c957be3b370ae5ed74772e56a03c42a7

Download Submit
C:\Windows\SysWOW64\Lgibpf32.exe

Filesize
55KB

MD5
f577491740aedc4222d82f0104da53e5

SHA1
0f9bacfb1828e5e56860ba3350e7dedf1ab43b58

SHA256
50a116a001488cdc4100e99319cbc891a95f15df915681aea97f937b373ea9d8

SHA512
9679be08c2cb0abd59f78cd28e7103a2c15c096c9a7e5a3c102c2112efe9241a789a675eea25e601db420f04f263d67b364eafa31e800792bb32f9e26aaa55ca

Download Submit
C:\Windows\SysWOW64\Ljbnfleo.exe

Filesize
55KB

MD5
695ec3e89c59aea96a851bce6f10277b

SHA1
63a25c41d5b0d275aad796e8943ca525e017176c

SHA256
bd8e6ac2f975698af46601559d0037e72c5f624754e30e4c527c965550d35a9d

SHA512
56d88fe1a4c7d349c375d7393733bc4c7f048f75ac7a2c2eb4a3ccdade8a1ce3e54b0b7472c32d93cf44bfdfa465e9ea74389dc9f6d19f1880a3b0cc06198ea6

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
55KB

MD5
8a5df048dcfff4c54fedef23aece73b9

SHA1
3edde00d37788394c7e40620a47de5650a8ddd02

SHA256
ac1d372e115b94841dd2d649b468787e87b6cfc161a9b996d6160981b17b8080

SHA512
78bec69cde3adf25d3af3651d5a1d5b540a082378586666ee5a967d8ee9c2a0b7636e8161d6ca5576407e76a1a103f60c2c927046162d490f7872e75fa868a85

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
55KB

MD5
ab3ab369d03fc9c3bff0873dc4add158

SHA1
5648c117938eb17c64951013036f0560ff9f1081

SHA256
34aaab0ed182125ec7088445bdc2f361551f4d7ee2481ebda3c647123fd12d80

SHA512
830cfe56033878bf98956477918f0ae16e4dfb5937dae0768eb5fee5d55e84d47ecf3933ab9f91757186d60890b8e9d4917775811fe7cdd2357a9319ea58385d

Download Submit
C:\Windows\SysWOW64\Mbibfm32.exe

Filesize
55KB

MD5
0ef5ed5eedfb3fcd79038adad8199989

SHA1
ac3d0ad1fb7cfa4e6b654f2695282a58111f58f1

SHA256
d870c3db6154fc3b0eb2b5d91492c3ae78a7111ade53cb790004999b1bb1d91e

SHA512
256d8bc31327bc9bbe5b8fdc1d1144908c63e6d4e3904ce862837c9b6f03cf370c6fd82947f4e60947f7f5ff5b1d71d437f426df429307bc6b4dca870dc58135

Download Submit
C:\Windows\SysWOW64\Mcgiefen.exe

Filesize
55KB

MD5
67020b3266ce69866784c12c85b439c3

SHA1
457745ff235e4b40f2694d0af1bd236cc2308825

SHA256
b9c0b767df2c7c470dc9c4338a74414e86c9f1c0cfc005c2a02a5a7c3633e6a8

SHA512
d59e76ba741d5e2a3fc04a57f66699a3ec315ff27c031f9d4e95d0991537197f0c27ef2dba61c3ef8d49d76d5b2312d52b5a445608dffd6d285289240ba2a4e6

Download Submit
C:\Windows\SysWOW64\Mfkkqmiq.exe

Filesize
55KB

MD5
3e18fcc860aec5c0d2a020f1947c51fa

SHA1
dc786da22c70e119e48b463065e59e5f8ca2c838

SHA256
f7b43815059fec08cd298ea775551933fbbcb061a91123c09ae66f2e0fb6aa0a

SHA512
2acae8fc570d6381f93bccc065784405d6b844f4cf1de7691e62683a9e0a211df9d751a01343fef45edfddc009a4385ec71f6fd553368195a6688f6b8fe3f67a

Download Submit
C:\Windows\SysWOW64\Mjlhgaqp.exe

Filesize
55KB

MD5
7f744fbeecf1386fc012961bebe48796

SHA1
f4b176e897a7c6b41de5a7fc688cf4645aa9b7c0

SHA256
5d5e9c9fec491b495011fc554f5481cc7daf230c3b493e62dd07e294d59fc0b5

SHA512
a187fc36d1c0ee403dedd053ed4dcd914eae0ea118e0209e6d6729c3d204b8a581187e20ee1feb9f1806d0be2526e347dee2f4569ec478b702a7a088589df13b

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
55KB

MD5
cf388c64dd9969786bde7c490f0bbd11

SHA1
eba6709590da5933ceef1a15c1fe91c2c9e229d6

SHA256
983ebfd91088701d3d4824e584fcb9ef01dccaaa027da1933df3a66b917f0b34

SHA512
afff00dc6c52381ce99b5fa2e6679a357904705cbf8e60fa968363e4633819d78765fc04801a92b544c379dc861a18e28b3d3696408c1a3799dfa1c098f28b0b

Download Submit
C:\Windows\SysWOW64\Ofkgcobj.exe

Filesize
55KB

MD5
bc5d652e0c3dbf2f45f05b6f2f558fb8

SHA1
109e6b517d79101065cdac361421388232061692

SHA256
8f6ea7b642977698097856add2a8f26bff568e002d6d50292dc10715f66d0482

SHA512
0c3625825c02c29f22efa2b216f08993bf12c1bfb895d35aa4b437d837a1a94f50b9dfd7dacc41dc87ca7e2a06c6826f11be3ac20fe1b5fac6fd491db5adaf95

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
55KB

MD5
80117f23a97444f878e14af92f604067

SHA1
8e150c59c1585ae49b8fa9bbc8b0991e101e35dc

SHA256
89601998a9839300576fcea551a3b1d4b5ef2b3ec1c8ebc03b853265863d1374

SHA512
f78bd170f6a5c549a614fdbfc26a1378c36dd3202c4ab3f0a3f0453c1e2b6ae84b7c38257dd3fcdb1e4670f587a578b6eb997ed9b22b77e63433bf86c7cd5d98

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
55KB

MD5
011dd1bd1cf426b51a1c9079f463fb91

SHA1
e4d6b268036e5c9405a8e62fb7726e8c8cec8d7c

SHA256
0d749de73151a675cea61e2f87e7c1220ee72588c2922fda982c6d9344c81581

SHA512
2d3cfefbbbac58844851a8593394392f4874d2d2631517927c0c6d680ed7d5585305573cfdf7bd3866ba8812cc6a8909adbb6521c37c1cef42779d7c1ee02109

Download Submit
C:\Windows\SysWOW64\Pbekii32.exe

Filesize
55KB

MD5
b78ab0d03b5bed16776ba79a408fb0f7

SHA1
2fcf998527481b327cec0a11bb3475b15c0a29e8

SHA256
560e46e5daba49d7315d1451684dfa6693910d52ee36662188270eeb210f3146

SHA512
fd1851c61e6ce1012a8bc951ef4e78fcb58a762afdc3a9fb27c721459d81ae0095e42d1a1c4a7cb2a21cdec97f421e8117a63114b95b35a6ccf1241e92e03ac0

Download Submit
C:\Windows\SysWOW64\Pcegclgp.exe

Filesize
55KB

MD5
91954ba0490ad17f851a26d4bb297fc6

SHA1
a5ec4a43a7be918833574cb23f94d044f6e57893

SHA256
c5d32fcc117c4588fd52966a03898e283cf6b7352c5a34997fe911c5a538a773

SHA512
abee0880d21ef2b349f2d051f3915ac1e766624ee5c6179ab06f96da40d42be9f0d6c05671ed97c143e904a7a7ce6ee7eaaffea93aafb986c316afbd4772ca4c

Download Submit
C:\Windows\SysWOW64\Pciqnk32.exe

Filesize
55KB

MD5
86e0358e5581bb004a78a93eec4e3540

SHA1
cf4da47cba4bfb70f600fc12d1fe0069daf43364

SHA256
4bdfbab1392fcab657f7efa91367589b9a11364cd6d8863bcd01ad13efde16cd

SHA512
5aeed9669c29870e7e74c6bd0469d50656d7f8bad495abe2abd9543ed97b2c12fcff0cefbfceccf9148327544fe72bb5a5f29d97ef69405ffefebc61e00a6734

Download Submit
memory/396-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/400-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/460-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/508-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/856-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/856-534-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/856-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/868-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1012-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1040-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1120-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1192-444-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1796-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2488-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2500-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2548-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2756-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2856-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3276-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3364-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3612-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3612-579-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3832-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-547-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4868-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5016-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5132-581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5144-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5180-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5220-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5224-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5268-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5320-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5360-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5396-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5456-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5492-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5548-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5616-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5672-516-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5724-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5780-532-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5840-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5916-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5952-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6016-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6060-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6104-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11396-3062-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11444-3061-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads