3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe
Size

94KB
MD5

63b071649e94d81f70138efb6a07e73b
SHA1

9ed3a941835a99699cae010a32ed95f20e708e78
SHA256

3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668
SHA512

4f511b3a3167b64cde19585b11acafa7bf50178a2df4b0b4a1aefaa023247e50e09392c3695b1663407da9863cc66e2ea57c3652012e5447f2c79d132ccc5236
SSDEEP

1536:e6b4jxKKR2j6r5uNC0T/t4h8Xwcv6C7CLN2okVfKe++y7BR9L4DT2EnINs:/4YKd0T/toMbHQely6+ob

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnkdhpjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbmhlihl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddojq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaejf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdialn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odgqdlnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojcgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehimanbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhcpgmjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbpnkama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajiknpjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndobo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heapdjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe

Executes dropped EXE 64 IoCs

pid	Process
1792	Oqdoboli.exe
5016	Occkojkm.exe
2056	Okjbpglo.exe
2276	Onholckc.exe
816	Oqgkhnjf.exe
4516	Ogaceh32.exe
3064	Okloegjl.exe
296	Onklabip.exe
1160	Odednmpm.exe
3408	Ogcpjhoq.exe
4360	Ojalgcnd.exe
1664	Oqkdcn32.exe
4560	Odgqdlnj.exe
2368	Pkaiqf32.exe
4044	Pnpemb32.exe
1952	Peimil32.exe
3220	Pghieg32.exe
60	Pjffbc32.exe
3316	Pqpnombl.exe
1704	Pcojkhap.exe
4580	Pkfblfab.exe
2348	Pjhbgb32.exe
3988	Pabkdmpi.exe
4008	Pgmcqggf.exe
3356	Pnfkma32.exe
2524	Peqcjkfp.exe
2956	Pgopffec.exe
4880	Pjmlbbdg.exe
3944	Pbddcoei.exe
3008	Qecppkdm.exe
1108	Qgallfcq.exe
2744	Qjpiha32.exe
2856	Qnkdhpjn.exe
5112	Qajadlja.exe
4688	Qeemej32.exe
3084	Qgciaf32.exe
1836	Qjbena32.exe
3716	Qbimoo32.exe
3424	Qalnjkgo.exe
2592	Agffge32.exe
4908	Alabgd32.exe
3428	Anpncp32.exe
4036	Aanjpk32.exe
3948	Aejfpjne.exe
1824	Aldomc32.exe
4892	Ajfoiqll.exe
852	Abngjnmo.exe
4776	Aelcfilb.exe
1216	Ahkobekf.exe
3080	Ajiknpjj.exe
4928	Abpcon32.exe
4088	Aacckjaf.exe
4192	Ahmlgd32.exe
2040	Alhhhcal.exe
1040	Abbpem32.exe
4784	Aaepqjpd.exe
1064	Ahoimd32.exe
2400	Ajneip32.exe
512	Aniajnnn.exe
3200	Bahmfj32.exe
3552	Bdfibe32.exe
1028	Blmacb32.exe
4484	Bnlnon32.exe
3204	Bajjli32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cbcilkjg.exe	Cliaoq32.exe
File created	C:\Windows\SysWOW64\Cibifp32.dll	Hcdmga32.exe
File created	C:\Windows\SysWOW64\Mgagbf32.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Qajadlja.exe	Qnkdhpjn.exe
File created	C:\Windows\SysWOW64\Chpada32.exe	Cafigg32.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Odqjbebh.dll	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Ojoign32.exe	Ofcmfodb.exe
File opened for modification	C:\Windows\SysWOW64\Fdialn32.exe	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Ojhnmh32.dll	Kimnbd32.exe
File opened for modification	C:\Windows\SysWOW64\Llemdo32.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Nckndeni.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Ifbbmf32.dll	Ajfoiqll.exe
File opened for modification	C:\Windows\SysWOW64\Hobkfd32.exe	Hkfoeega.exe
File opened for modification	C:\Windows\SysWOW64\Imdgqfbd.exe	Ibnccmbo.exe
File opened for modification	C:\Windows\SysWOW64\Ogkcpbam.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Oqhacgdh.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Meknidfo.dll	Qbimoo32.exe
File opened for modification	C:\Windows\SysWOW64\Ehimanbq.exe	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Jpnchp32.exe	Jidklf32.exe
File opened for modification	C:\Windows\SysWOW64\Kimnbd32.exe	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Aelcfilb.exe	Abngjnmo.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Kedoge32.exe	Kfankifm.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Cacmah32.exe	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Hoiafcic.exe	Hkmefd32.exe
File opened for modification	C:\Windows\SysWOW64\Lpebpm32.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Mdjagjco.exe	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Oekgfqeg.dll	Hcpclbfa.exe
File opened for modification	C:\Windows\SysWOW64\Bjdkjo32.exe	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Ijnlbk32.dll	Cbefaj32.exe
File created	C:\Windows\SysWOW64\Ddmhja32.exe	Dekhneap.exe
File opened for modification	C:\Windows\SysWOW64\Dddojq32.exe	Deanodkh.exe
File opened for modification	C:\Windows\SysWOW64\Edpnfo32.exe	Eemnjbaj.exe
File created	C:\Windows\SysWOW64\Fafkecel.exe	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Nmpmkplp.dll	Jcefno32.exe
File opened for modification	C:\Windows\SysWOW64\Mdckfk32.exe	Lphoelqn.exe
File opened for modification	C:\Windows\SysWOW64\Pjmlbbdg.exe	Pgopffec.exe
File created	C:\Windows\SysWOW64\Ajneip32.exe	Ahoimd32.exe
File created	C:\Windows\SysWOW64\Bnlnon32.exe	Blmacb32.exe
File opened for modification	C:\Windows\SysWOW64\Ifgbnlmj.exe	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Abckpb32.dll	Jmhale32.exe
File opened for modification	C:\Windows\SysWOW64\Klimip32.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Lcoppd32.dll	3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe
File opened for modification	C:\Windows\SysWOW64\Fooeif32.exe	Fkciihgg.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Flceckoj.exe
File opened for modification	C:\Windows\SysWOW64\Gcddpdpo.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Iiaephpc.exe	Iefioj32.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Kiaefcan.dll	Dlijfneg.exe
File created	C:\Windows\SysWOW64\Fdialn32.exe	Ffgqqaip.exe
File opened for modification	C:\Windows\SysWOW64\Heocnk32.exe	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Nljofl32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Cdkldb32.exe	Cehkhecb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11000	10844	WerFault.exe	509

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogcpjhoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojalgcnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habmmpbg.dll"	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnqmalhn.dll"	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejfanad.dll"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icpnnd32.dll"	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imllie32.dll"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aogmoeik.dll"	Faihkbci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phaedfje.dll"	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaqfok32.dll"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goaojagc.dll"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Okloegjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Himldi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdpie32.dll"	Bajjli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aihbcp32.dll"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdainc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhondp32.dll"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Heapdjlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bbnpqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfbcpl32.dll"	Chbnia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakipgan.dll"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcefno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qbimoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmhhehlb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1792	4724	3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe	82
PID 4724 wrote to memory of 1792	4724	3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe	82
PID 4724 wrote to memory of 1792	4724	3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe	82
PID 1792 wrote to memory of 5016	1792	Oqdoboli.exe	83
PID 1792 wrote to memory of 5016	1792	Oqdoboli.exe	83
PID 1792 wrote to memory of 5016	1792	Oqdoboli.exe	83
PID 5016 wrote to memory of 2056	5016	Occkojkm.exe	84
PID 5016 wrote to memory of 2056	5016	Occkojkm.exe	84
PID 5016 wrote to memory of 2056	5016	Occkojkm.exe	84
PID 2056 wrote to memory of 2276	2056	Okjbpglo.exe	85
PID 2056 wrote to memory of 2276	2056	Okjbpglo.exe	85
PID 2056 wrote to memory of 2276	2056	Okjbpglo.exe	85
PID 2276 wrote to memory of 816	2276	Onholckc.exe	86
PID 2276 wrote to memory of 816	2276	Onholckc.exe	86
PID 2276 wrote to memory of 816	2276	Onholckc.exe	86
PID 816 wrote to memory of 4516	816	Oqgkhnjf.exe	87
PID 816 wrote to memory of 4516	816	Oqgkhnjf.exe	87
PID 816 wrote to memory of 4516	816	Oqgkhnjf.exe	87
PID 4516 wrote to memory of 3064	4516	Ogaceh32.exe	88
PID 4516 wrote to memory of 3064	4516	Ogaceh32.exe	88
PID 4516 wrote to memory of 3064	4516	Ogaceh32.exe	88
PID 3064 wrote to memory of 296	3064	Okloegjl.exe	89
PID 3064 wrote to memory of 296	3064	Okloegjl.exe	89
PID 3064 wrote to memory of 296	3064	Okloegjl.exe	89
PID 296 wrote to memory of 1160	296	Onklabip.exe	90
PID 296 wrote to memory of 1160	296	Onklabip.exe	90
PID 296 wrote to memory of 1160	296	Onklabip.exe	90
PID 1160 wrote to memory of 3408	1160	Odednmpm.exe	91
PID 1160 wrote to memory of 3408	1160	Odednmpm.exe	91
PID 1160 wrote to memory of 3408	1160	Odednmpm.exe	91
PID 3408 wrote to memory of 4360	3408	Ogcpjhoq.exe	92
PID 3408 wrote to memory of 4360	3408	Ogcpjhoq.exe	92
PID 3408 wrote to memory of 4360	3408	Ogcpjhoq.exe	92
PID 4360 wrote to memory of 1664	4360	Ojalgcnd.exe	93
PID 4360 wrote to memory of 1664	4360	Ojalgcnd.exe	93
PID 4360 wrote to memory of 1664	4360	Ojalgcnd.exe	93
PID 1664 wrote to memory of 4560	1664	Oqkdcn32.exe	94
PID 1664 wrote to memory of 4560	1664	Oqkdcn32.exe	94
PID 1664 wrote to memory of 4560	1664	Oqkdcn32.exe	94
PID 4560 wrote to memory of 2368	4560	Odgqdlnj.exe	95
PID 4560 wrote to memory of 2368	4560	Odgqdlnj.exe	95
PID 4560 wrote to memory of 2368	4560	Odgqdlnj.exe	95
PID 2368 wrote to memory of 4044	2368	Pkaiqf32.exe	97
PID 2368 wrote to memory of 4044	2368	Pkaiqf32.exe	97
PID 2368 wrote to memory of 4044	2368	Pkaiqf32.exe	97
PID 4044 wrote to memory of 1952	4044	Pnpemb32.exe	98
PID 4044 wrote to memory of 1952	4044	Pnpemb32.exe	98
PID 4044 wrote to memory of 1952	4044	Pnpemb32.exe	98
PID 1952 wrote to memory of 3220	1952	Peimil32.exe	99
PID 1952 wrote to memory of 3220	1952	Peimil32.exe	99
PID 1952 wrote to memory of 3220	1952	Peimil32.exe	99
PID 3220 wrote to memory of 60	3220	Pghieg32.exe	100
PID 3220 wrote to memory of 60	3220	Pghieg32.exe	100
PID 3220 wrote to memory of 60	3220	Pghieg32.exe	100
PID 60 wrote to memory of 3316	60	Pjffbc32.exe	101
PID 60 wrote to memory of 3316	60	Pjffbc32.exe	101
PID 60 wrote to memory of 3316	60	Pjffbc32.exe	101
PID 3316 wrote to memory of 1704	3316	Pqpnombl.exe	102
PID 3316 wrote to memory of 1704	3316	Pqpnombl.exe	102
PID 3316 wrote to memory of 1704	3316	Pqpnombl.exe	102
PID 1704 wrote to memory of 4580	1704	Pcojkhap.exe	103
PID 1704 wrote to memory of 4580	1704	Pcojkhap.exe	103
PID 1704 wrote to memory of 4580	1704	Pcojkhap.exe	103
PID 4580 wrote to memory of 2348	4580	Pkfblfab.exe	104

C:\Users\Admin\AppData\Local\Temp\3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe
"C:\Users\Admin\AppData\Local\Temp\3a30d93eab28ffcf0e8508c2fe3aa256bfe5a0478da490aba1c8ba00131aa668.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\Oqdoboli.exe
  C:\Windows\system32\Oqdoboli.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\Occkojkm.exe
    C:\Windows\system32\Occkojkm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\Okjbpglo.exe
      C:\Windows\system32\Okjbpglo.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:296
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        23⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        24⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        25⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        26⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        27⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        29⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        30⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        31⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        32⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        33⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        35⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        36⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        37⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        38⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        40⤵
        Executes dropped EXE
        
        PID:3424
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        41⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        42⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        43⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        44⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        45⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        46⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:852
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        49⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        50⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        56⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        57⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        60⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        61⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        62⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        64⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        66⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        67⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3684
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        69⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        70⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        72⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        73⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        74⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        75⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        76⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        77⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        78⤵
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        79⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        80⤵
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        81⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        82⤵
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        84⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        85⤵
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        86⤵
        
        PID:788
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        87⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        89⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        90⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        91⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        92⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        93⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        94⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        95⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        96⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        97⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        98⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        99⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        101⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        102⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        103⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        104⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        105⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        106⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        107⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        108⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        109⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        112⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        113⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        114⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        116⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        118⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        119⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        120⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        122⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        123⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        124⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        125⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        126⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        127⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        128⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        130⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        131⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        132⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        133⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        135⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        136⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        137⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        138⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        139⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        141⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        142⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        143⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        144⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        145⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        146⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        148⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        149⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        150⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6632
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        154⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        155⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        156⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        157⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        158⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        159⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        161⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        162⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        163⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        164⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        166⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        168⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        169⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        170⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        171⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        173⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        176⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        177⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        178⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        179⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        180⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        181⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        183⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        184⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        185⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        186⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        187⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        189⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        191⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        193⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        194⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        196⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        198⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        200⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        201⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        203⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        204⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        205⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        206⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7476
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        208⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        209⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        210⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        211⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        212⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        213⤵
        Drops file in System32 directory
        
        PID:7732
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        214⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        215⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        217⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        218⤵
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        220⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        221⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8104
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        223⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        224⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        226⤵
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        227⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        228⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        230⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        231⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        232⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        233⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        235⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        236⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        239⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        241⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        242⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        244⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        245⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8124
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        247⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        248⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        249⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        250⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        251⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        252⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        253⤵
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        255⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7892
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7296
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        260⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        261⤵
        Drops file in System32 directory
        
        PID:8216
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        262⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        263⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        264⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        265⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        266⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        267⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        268⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        269⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        271⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        272⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        273⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        275⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        276⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        277⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        278⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        279⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        280⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        281⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        282⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        283⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        284⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        285⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        286⤵
        Drops file in System32 directory
        
        PID:8264
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        287⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        288⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        289⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        290⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        291⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8672
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        293⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        294⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        295⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        296⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        297⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        298⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        300⤵
        
        PID:612
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        301⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        303⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        304⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        305⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        306⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        307⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        308⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        309⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        310⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        312⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        314⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        315⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        316⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        319⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        320⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        321⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        322⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        323⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        324⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        325⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        326⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        328⤵
        Drops file in System32 directory
        
        PID:9208
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        329⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        330⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        331⤵
        Drops file in System32 directory
        
        PID:9228
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        332⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        333⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        334⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        335⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        336⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        337⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        338⤵
        Drops file in System32 directory
        
        PID:9572
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        339⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        340⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        341⤵
        Drops file in System32 directory
        
        PID:9728
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        343⤵
        Modifies registry class
        
        PID:9844
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        344⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        345⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        346⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        347⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        348⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        349⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        350⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        351⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        352⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        353⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        354⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        355⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9424
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        356⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        357⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        359⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        360⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        361⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        362⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        363⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        364⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        365⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        366⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        367⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        371⤵
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        372⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3584
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        374⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        375⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        376⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        377⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        378⤵
        Drops file in System32 directory
        
        PID:10196
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        379⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        380⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10132
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        382⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        383⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9568
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        385⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        387⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10300
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10344
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10388
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        392⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        393⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        394⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        395⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        396⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        397⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        398⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        399⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        400⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10856
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10900
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        403⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        404⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        405⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        406⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        407⤵
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        408⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        409⤵
        Drops file in System32 directory
        
        PID:11208
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        410⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        411⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        412⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        413⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10496
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        415⤵
        Modifies registry class
        
        PID:10588
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        416⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        417⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        418⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        419⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10844 -s 420
        420⤵
        Program crash
        
        PID:11000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10844 -ip 10844
1⤵
PID:10932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
94KB

MD5
4f569fd7c74e5517d6bd4fff637ee3c2

SHA1
63c85598f5d11188e44e094b94533984a63c5594

SHA256
f8f7e5e3be53c0d3a93b43c626aee848cf4274dce0dee8d23752ce67f000eac1

SHA512
a7bc10bcc05ef3220cf17f2f70cc8b4b26ae68b18844ad1f274cf6921fe27d8c5aa204c6eca4727049955111fb3d06da5a74231d4fad23cb36a5e1a41049101d

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
94KB

MD5
94a3076c89523d630a8c067daa43d877

SHA1
ab32eac75d05883650822646484d3961d7cd8b0f

SHA256
9cabb8dd2b5ed6854f81abd2570178e45e9e26ed51efb0b8a8eab1cae083ee15

SHA512
be5f496618530e224b15cc5bf98d7b6e8feedaa824716e28374c09cb836a2be4e19032e75fbf98f8e0740a340b58dafb7f809f17f2d45ca65da0b75fd58e5ff5

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
94KB

MD5
6f89f63b2de1a7bbb123865fd062b6b2

SHA1
9a06321c9c479d7cfdb904c706bdd97e9622617e

SHA256
8fb1bbaa86e9f04dc797dcb6ba8eadf249a7dd5ea534b50a63a6e5d58ea5662d

SHA512
1ffbcd7d56455ac2cae894cbd005ae022f6521ddc7b7660cb85c09bd0870e9e57cf45c662985250e35f9a746ab5cc160719d0e41e4f0a707b8cb8dfd6a96507e

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
94KB

MD5
1fe5f8779c4d5e6025e44df4c13691fa

SHA1
6fcaabd8e1225535f23c5653e5dc134092d3763f

SHA256
aa27277e308cbb97535790b96e87f08368bc7312aab2a9622e9528245995c513

SHA512
6b8d061623b8391fd31b6017abd5b21ff924ca53d586d18dad1d6e644f318fd87512c555a04e5cfcb85a2e92b1fe4ed986c6d92fda2ee47503011155354bd543

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
94KB

MD5
62e4124e22d24f912b10e5c3116d0154

SHA1
bb6d980f2545b1d967afbbca0157aa083a6b7d8e

SHA256
1376175139575d4629859547b084e21c0613e85712e3d8a8993bcfcd3e3d46a3

SHA512
56e929bddc48c5d4868e9b3a95f937330e86b769a563d5429dae3abf44ea3a569aa87fe2c412566a9bde194feaaed53b6fb9773f5db34c2cf1275d1fe1693083

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
94KB

MD5
0c8be6021fd81b8c2ec7a3e6d00b458e

SHA1
50e123e9d16a3fc95d2d8b948b08f7b41980d964

SHA256
de3e9ef5cb997a6f03ae4a5fbce1d6e9ef02e1e1188f4bdde44ece824fecbbc3

SHA512
9d27e288d8ee5dd38b71861f63763b3358b692b15b423c9ae0b964c6bb28d3205f2c09c8887b3dc189b6168f1fccf22c4e765f0cb00fbaa2457a77bbac9d2b67

Download Submit
C:\Windows\SysWOW64\Blmacb32.exe

Filesize
94KB

MD5
4d34198ffd7371833478c4dd29e3e6cc

SHA1
6712a6c5cedc581e7653c053a0455cd56cf05e06

SHA256
a236dee13d375f9768213133a7e47513fd659c6e8a0a0d3eae4f99d4b6ef4170

SHA512
10dce1483d014cb5c03681558e3df9ef0898a422c4b98a5fa527f097b8c2e41582b077458aa3937d74fe31e9e36a54698c6019d06f02c92c29a281d6a545bc45

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
94KB

MD5
6cf2b4045d9c909ef62f6e5f8542ac7a

SHA1
5b96f3110bbad3d365d41fbc0b40a597b3dca6e1

SHA256
c315f619bf56a228cfb1bf697a25b5b2bf63172b3a0d30dbf6622028f82623f5

SHA512
a3708f95dc9c990039cad56372ee7f8c9f6576b0ef216f21737e055d35c6074b0f30a7f9c5f7af815d160a3e1e8b3961f81d529f83211550cbfdf122967ddc65

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
94KB

MD5
7f6446ddccf3c7b28e2098e68b056007

SHA1
044fd7e14d3884450174f0cfe83cd9be7b3a3956

SHA256
e6dee88c7c7d807d0e2bea58d51c58f903e63fca21dd7a339056713655689c4e

SHA512
e6ccb53c2cf34d345c2df5e5963ce0c01a26d4432ba7461a08dfe5a1fdf4c9d2956ac30b52190c4699927fea8664caa2c7f30f628defbce89c88c7cd6e4774ba

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
94KB

MD5
ba1dc4b4e4685c20da4a89d831618f79

SHA1
df9a4a2ed6fc900f70d0f59cf000a955ea38647d

SHA256
cf2e38d29e33a5bdcb01cd8ab2cfe2edd03942ccf19f0fef828242914437508d

SHA512
2ecc2dd57ae85c3ca6c4a0a47beefc58ade4f08ba259c269339616f5bc1c872472f73085915e1cb23e7d1a0554778ae6aaa44d8dec8a4a7e57726a0c365b6253

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
94KB

MD5
1d2b0c564eb3837354df07e0b47def12

SHA1
d6177b67267dd7faa1cb7821d565241c555718a5

SHA256
249dd6624fdd5a4acd508bc8725b8af7043106ec826048add4ad3be93bed1682

SHA512
6bc0b0341e06fe64058b9edb16d5661e1eac5ef02821501ce6f98319c7b11061535d5242dbbce078dbe739da46c3d47c024c99b38385f50d5f84dfe1d0d8153c

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
94KB

MD5
ed8486b79495287e95b18205513fad4a

SHA1
4267664a81644fa44098e9d0ff975ed5240d5c64

SHA256
e302b7752a2d7c92314066d5a8692b4c9e35e332c26c5a05a97c817c7d8a1a24

SHA512
621bb6cb6c51c31647df201bede698cd9ca35b41b47e720bbecee07fbfde8f6163426dce6406f583950713a2c3806f618750f2eab233d47725f86073c7f01b72

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
94KB

MD5
5f75cba7c1cfbf80ac85702be64b7ddb

SHA1
c4aa76a5e86c6fa799b1e7c4d77da7d6da6f6bc4

SHA256
69ee1d05f01796ef3a321e8681de5c499de014616c8c5d477c486bb5b64444ee

SHA512
7b504d745316d09f9dc383a5eb69f4f9914eb5563dddc4099882e4e4b914342d5ee02bf8658320aca49d3cebb0cab6d2020832d723e9467734e486181b5ba4fc

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
94KB

MD5
1d20b350ec3ebba71ac33861b6f70b6f

SHA1
464ec3fa6d2cddd39a0585e38f0c8207339ddc65

SHA256
42b544169f3d14c253ac64cee0a147d3ac36a7e0443bb0be2e7122512d99b9ec

SHA512
0d6da9083cc27428b6d12a332a556e879e879d188324df0bb9cdfe505f50224d8fac2dcec64079898dca13b1ae8af6ecd7059936868f9f7076f05f9e3c6dcf65

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
94KB

MD5
20b552517e1d0dcdc6a3a86a6d17100f

SHA1
8670f719f51f6c0fa4677ab4d58b967f7af0ae19

SHA256
b44fb0896c4bc084f880b67200595ef3814afb61de1daf9639cfc051916abd23

SHA512
707812304a09b5bc0bf5f100928e1dc135be1e75f3f58bea1dea01f66eb7bd0f928422ea206d0dd17b8fa04d80d0365791d097ae65907b383f0290a0f3593396

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
94KB

MD5
64008f777d3b5dbbe59c5cbf9102204a

SHA1
1b5d4ff429799cca9df4f10aeff27aa6d1693eb7

SHA256
cd73698903de166ea6020c73410e364a49b85ce1104febcfed2d67b1f75ce64e

SHA512
3f581f5863fb9626bb1bcc3642926b9217fc035a45351b64d879bc1330b1bbbd0d9cd1da6ba2fd96c2946a80ae848a463ac88c5f4dc3fe0f2e4b1b62074db46d

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
94KB

MD5
a450ff54f9d28b5aece4c559f079496a

SHA1
80bcc099a36a599f3b71f2104135d0efb6ee2b60

SHA256
c32e817a289424c93f111958e6c886ad4295aa78a9f78535f16c40e5594b731e

SHA512
5481bb027b1219ae2e6ce1b83e6160a223f0f6d4db034ae4e079cb8d9dbaa11ed148baa2b93c57b4512a1b986b1a604075845b559a0c6774816f5a6c74ceb1ec

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
94KB

MD5
b595386f70bc28d19d4fdde4c1f82c05

SHA1
becd5b52e72377385a22f68bcdc20ec8b4e50df2

SHA256
0cf7b80bd04f1683b95bfbd204aef734d8d5b5da70e7d389bcf407433532082a

SHA512
e8fa81276e1af5f167ee6610acb4e17c1678f2362087702131abd77c1bcaa7eeadd82eeaa7fd7cc3cee42132086894f8cb5a7921b718fead95ac69f36eda9893

Download Submit
C:\Windows\SysWOW64\Gdjjckag.exe

Filesize
94KB

MD5
201af8042d029a9ef00d11cbdc3162a7

SHA1
77a17ee9b8e51d1042522f4f9ce81986b34a2e1b

SHA256
b74437a33e7e177349f512b04966858197782508dbb0903c2ee4f92952d254fc

SHA512
f20b1900e6b375d738300f0db19d7065d39e32f9d0f3ec6e9ba81a17efd2cf1539083dc540ccb8725069e92f88703e5f4233fc1d23050f6c7e8c8b98b2e3d65f

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
94KB

MD5
2b39f9ff14eb18538a09b9d1d3fc351b

SHA1
d17d74e1d0a31574e7ab80e1d500f1f6f1dc8494

SHA256
85ee9a172f3162eea6d7750b66befe518ab238c4009f5d5611ad42c190f409f4

SHA512
63e5a2b4afa2ba0881cd6f41e38651202ccb687cbb8dd001c1ace5113589986742a9e4cb2023a00f9233eeb893f33b131686c4980735d9e14c343e8eb6da0ed3

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
94KB

MD5
90257ea00b90c5e04ca5641666fc8f98

SHA1
3903abdc006c7f6b0980e76a658f8c7a021c64fc

SHA256
afb68fcb66e8af721578b44956390629fd8d99330bd3112ebddacdbeeb1b67d9

SHA512
d08e7c1f3c324c0b45b851447eb6eb96c568478e20146e5e0e82cac4e819367c98698753eea451849a4132aceb9f8d65b00f00bf9e18226e56ef70b75a8a71c9

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
94KB

MD5
729cfb3f2539edae7e0dbe72682cda68

SHA1
c7bc1558a3220ab096dffcc82b12657f57714556

SHA256
7588f8c38268b76ce9984ad985c13788b1a27d7d2c057fcbf8e147e02a8fdea8

SHA512
30163b6eab1f3448d0e61aa83f2403b356c14f5c0114b190920ac79095a569b0bb01e8a77c3e3771c13790b7278137d4b5a599978537bcb95eb84c6a2000a061

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
94KB

MD5
8974bfff136e6238c07b9645f3a3c587

SHA1
63b329498c4c8759bb0b32137865e799663498ca

SHA256
2f9fe3403501ab4a7215f71c34f7b1a5fbafe27a417284940f8e04611f7245e7

SHA512
9ab22561272dbc7ff7a7b61a74b6e72de5d4d0cbd364d347dc3ade905bc7076acfb1ec6633c0f59e201dd805daea925baa40a3594515fd9e4b13c5277eae5ed7

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
94KB

MD5
df629c7c53239047bce1ae4f00048c47

SHA1
3d625610f658150a156ee9da647a33534195c9af

SHA256
8b73bae269382ce805989c945895c501c45f1e6648176531f93357ec3148ce6a

SHA512
4d29ec74111dd15b1dbdf89751f0ae63d7442769c7f1cda2aadfcb7629835b74209ba2ca76dc16756e738a37a3e2be5676695893604d640db6fb2bed33a22192

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
94KB

MD5
a0f1039f1009a2e396d61a702ee66893

SHA1
25e77f9960e2a3448cd177162ad892b0354b7374

SHA256
19cad8f6a832bbab8fc6ffdba628db599b1521b2b4ff20970374c7830be2060d

SHA512
dab3f248d5ccacf0ae646f4968551bd077e8574371d8eadcfe2064681b8b11f16ace9d29c3ad578fb7d1740aa9392e1c24f0b36c6548d99263c288527ce0d43a

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
94KB

MD5
12d790bc105f5dee4d199170844d9783

SHA1
0e36029b143aa6f47f6e0e9b7ab554f10ad1d8bc

SHA256
c156b9c71440cb7e6ef222441e63e241aea85f4e875e785825bd29698512b6af

SHA512
e9fde4fcbe0db8731ab21e46cfaa2e5450329fdfc468cc7807bad9e89769472dc170101af6d04c21bb6569a7216f0f90794ec7d52001107eb3161ccf03550f7f

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
94KB

MD5
5a5b0ed3c4a70872b1665535c83ceac6

SHA1
4aed09665630ad4f575e5b8f88e4fd9d78e6ce9f

SHA256
a9d1c81a2867d375df762cded3071717fd3303ad67b581b36aae1506c0f55050

SHA512
9d2e8337fd07a0498a8cb6f14b376e87b6f0d02fe30e05a1e1993c0ebaf7b4f02f097ad6e3454ace7f5e8121974b0c4a91074a6e1adb76b6e42e1abf116ed940

Download Submit
C:\Windows\SysWOW64\Immapg32.exe

Filesize
94KB

MD5
220c0d71d37c59e0da9cddaf670d3fea

SHA1
6855e6861736d745698e2184a2e83e285f9813c4

SHA256
d105951667499c90bbd01a2881e88b0fce3e88a16e507fd49ded7121a3721ef4

SHA512
9a8a011d67efb661ba19b786620e6bf9e9618ba65a434ffd3dda0fb941c89e9ae2a583f3ef3714cc16e4a841204b675404ab9b9bf58be2604763428d0be3313d

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
94KB

MD5
16ac81a75578cd05a6e0412fcf2e9bf7

SHA1
77b131949d01fc89ea3966941a5e0e7cc24f421a

SHA256
ca95c342127038da89bb2bb4232a47a9567102dcdea7555f3e2d99663b06c146

SHA512
f426db1b8a44bac0dbbc722032bad7ecf4c1317b53b0cc6081d4929243693981d215f7ddc361ad10ac8b5fe8903dcb62a372556bc2b642ed0b404a7b4e67913f

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
94KB

MD5
f8ff605e0094ae3b0cc08ea9d995960b

SHA1
cf045643d48c328e4dc54dbba3c8a077da12811a

SHA256
00eab8cc3e0ae82553672ae1b918e5cc3b2c27ebe7e7ac51867d2a1c4ceaf1ba

SHA512
b265cc79ddec199c3edbf20b5312f2151261199279f45f0f2e3abff575fd366e9ccd7b371eb0d9df618d8fa95f255ffb403e84620f17e33c4f33425c68da8c0a

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
94KB

MD5
722c32afc04ac7e5a1de943eada23f90

SHA1
2ddc3fb9471bd4fa9c28e588b2f1fa6e6be8f0a9

SHA256
c45314d30b7f3ad8c33ff88400cf743aa45af168f49f8aa6228ca0f2af72800d

SHA512
880cbd031d9599ee67aa93228cf93506c4df09f7bbe8b5b9dbfad3af5705b63ab82372e2e11be94f38681a2e6541cac315f0c416b76a151814d1b6e8bb7c44e2

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
94KB

MD5
38abbabf7b3b6819add12cdde1e6e544

SHA1
1f2ed4bdde7a86b99c9382a40767f8d04b1e93fd

SHA256
47db151f8dfaf409e9fcf60493409d624eb73ef2b15fd1635bfb7811b9ab9faa

SHA512
0a1d39db988904f5d88f5a5d5d858facb152c352aa0970d8d909a92aa5e0d14305e1fceb9d829c308bdcac559de2df431d7f8ccb8b3737eed2601234650fb10d

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
94KB

MD5
b8c1c1883e45da32f5c2efd69278ff33

SHA1
1f1c7deeb3b1a16a00b4bc138357a3e8f6310745

SHA256
96cc9b16ab3785b27b5d9e3d6f310173bc275fc822ac18ae8beacb1a448dca07

SHA512
2c941ae30bb84ab6aacc3f4bc747b204e96eb70b8ff39dc349ae2e05eb990c779bd8c320233461290cd1549a55a9cd1069883894d370a93da30e7132481c5f95

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
94KB

MD5
05327de36de62774800c340e9de026b1

SHA1
89415a6745e4c8e656455d4059cde435e5cc46f6

SHA256
31a5f809bd2dc0c4738ff21423cd50604764aad859d9b2031fe50684cfa1fda2

SHA512
1ff7cd438b55573e35bd2b4152c96601ff070e02b9c0bf86abd32c8dfdcc52398ff7bf29146af0b12217684ed3994336e13372f6a90388e8c106cb064e63e82b

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
94KB

MD5
b60982fa309b72004afd9fc5e4dddf5c

SHA1
3e738d413b36c21e1aa0878fb9ec47798f5767cf

SHA256
7d82f787740f27d664a0690bc803fdaacfdf69276620673afd8f22bf81087e76

SHA512
5c9cae488c5fc9bf3247133ac49b29f700047667711085b9bbe8bbde0ab8dafd6f98eacf9707c47952fb1ca1d8580bf7bc54df27752dabab57e38cb6f52e3767

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
94KB

MD5
08ad1670335a71c3dd8633153f0e6b22

SHA1
d5311cec28c5757e45f64adfe6697a64dceda4d3

SHA256
abaf1bb12cc15959ed3797b2496d5123ccc242f2c7fda9bc6079b28061f9bcba

SHA512
4153f74ce7336316509605d3b44bbcaddb3872c820705f0d1c5310b113ef3661bea51a4b3a8d59b7c5cbe5baa89b3ceccb56e0cde558aa2085517edf12a9bcb9

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
94KB

MD5
a725d2868c78c417afea654094757120

SHA1
d2df4d0b3f3c5acdc3dbab8ff37f039e03dc6c7e

SHA256
e4779269840c5249b92006431b0ddf75457bccc8c5c399c0cb6b9d3c86afff34

SHA512
7288f4711ed9a5bed40db23d772869ad3ca3f2b8df855832230b366b74b2470b17ec12a19d559ab4ca9248e92104bed4d21bcb2a8435077a40ec235af7c85003

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
94KB

MD5
b1fc1ac41ca19d54c0dfffba58ae1e35

SHA1
38364432751031cfcf0010ec7a6294e5348988b9

SHA256
d32520f33c89800ec9964810e0280e6442763abf0e1b7766bc03d9db7cd3394f

SHA512
507f406915cc8d8a08557ca70af4242f999989a143fbcc0356d841f75ec60596cd7c8bdc47ba13cd9d93645773307fd08035f9a77ca6ed9c5fe4cd5233360265

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
94KB

MD5
a1dbf47fd0bbb180dc3bacdde5b13c86

SHA1
c7e6c024337a26e839588ad3ea6be833aa320e07

SHA256
f138ae9925ea4bb6be82ea6fd8d9b72c1cd921cc2a80978776e747559d58ab19

SHA512
798660b4ac73d129c2cd4aec7d7f9dea8f8fbbc7507af4e9ca5e2a938354b3a363770310ef9addfe63c1a8a1be91231258eca85dcb2a5fc3c015d11306e10268

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
94KB

MD5
b611f9631e95b346c7076a39bc5fe544

SHA1
20ec905bb7a33a909884d326b7b99ded8923255b

SHA256
644e92bbd1725facdf50ee155dd28caa67124830a0ec329f45acd8f2a1bf460b

SHA512
7300e2efc14e871d1848044bb73d682932cd535fcb4f2903dc73f1081dbdac5ed68995c82065909f3968469a25818645ac0e7d7e3dbab91214fc99391b75493e

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
94KB

MD5
87df5452e1e5a79e89af0a8d928bab2b

SHA1
f718f6427e2e7f16481a67fff1cc931786e9529a

SHA256
f6939b05a6a72711769615d43649812ee11b8ba441f6f4a9a409e5f430871f10

SHA512
8815305d215645d9df114b478cdefe7a3e939f298a32d09de33d1889468207b87faf2d138ba7d9d11afd9ac81375e2a2e14fb319ad8f0f1a49254a5dbe108b15

Download Submit
C:\Windows\SysWOW64\Mmbfpp32.exe

Filesize
94KB

MD5
b01f630345f36a08298464f786cd12d3

SHA1
0c17e661ade2d9166e701431bb2b8cb7de9cf28d

SHA256
a9381cdcc4728ab6597f50194079c36aa1b264ce89d2687ad72a47c3ec462209

SHA512
ffee59b5c89d23c54a428dc6dd998992ec8c7bb0721fb4fb33982398b4f4abb24d1ba88e121f7abad3960446072bb3c3c4891ea137fee4b5e462a4112ea47ee8

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
94KB

MD5
1c19a9b4eb8b8583f306c167a1d9afac

SHA1
ab3773f3eebb6d2702fefa532cb92d52a0c1b62c

SHA256
379839e2d8832bbab856eece6db169403c3f19b96eb887a2ec168935776b1ab1

SHA512
8518f438d5dda2665e3c026c658b18ab0a442baa5a647cfd036e8eaa46e86038f3f3bd68aec022ecf56d21fea1e4a0cb9c351fe4a72a8bb3589dc8569bebcb74

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
94KB

MD5
058fd84e84e1ac1763f929075c156530

SHA1
bec7371500bb4151e8edcd72806e3c8b7b472ec2

SHA256
cf29bbc4fdfc4d3f01178bb69a908bfc7898ecb28cb8f8d685ba8e4a316c8d04

SHA512
6874de75e729767cf828508f4b3bb52984a211c5d023e137e302a707c9be1a30bf0916ed56bf3f2d81aa18e55dd8c7c5d4b44519441029742365169b54b433fc

Download Submit
C:\Windows\SysWOW64\Nmfgdeof.dll

Filesize
7KB

MD5
6e6755ed68b67e990b854066793e6eee

SHA1
0b7f1747a7544e597c1530b16ad64055ced4ef64

SHA256
452177dd7720c7b68af0f92cb42e6fb6aeb19f61a66db519f6523a1634496fa5

SHA512
650ce56cec18ee5656402f3c2de29e78bfcfe2ecd634308b0bb6fbcbf4f20d6ec0a4e8d0461af1e6bf3580bd665c9531f83b3dc4aecd8ba2b905cfb3f681cd25

Download Submit
C:\Windows\SysWOW64\Occkojkm.exe

Filesize
94KB

MD5
a368a398f2d3252fb46c9bcd16f74449

SHA1
b570b9545502c47d8e50815df8de4f90245d0bba

SHA256
b160180194050e4154a161757536875d1d68c808e32c4586d0b2fec8fa65342d

SHA512
942091781cb338125c53180ca71581b99415a3f786cc4648ec88bfddea0a03812078bf53e836fa9568836ef36c2fce01f5250ac4df9338c77cf9e81c4daac0c1

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
94KB

MD5
62c3a063b262c955435b544dd4920ed0

SHA1
b7658e971cd3c303922c7180b9eca9f9917a92b1

SHA256
596fb16419a1634f1df952ecb5305b6f63403c75ec30476e2e886ef76cfb6ace

SHA512
a4c45be8cd24a33e89d0d67af0106cb22c6f147eb2067375ac5b652847ff332f956e461c9b84b78e01596528c1fff151c42d95933b10bff99209b56910e869de

Download Submit
C:\Windows\SysWOW64\Odgqdlnj.exe

Filesize
94KB

MD5
bf0114b13e23ec80a20632e8d74ab693

SHA1
30922eee6fd1ba027e8e9341b8e882d291892902

SHA256
ffdd3dae8d8c6bbb5ed980c5df2551f7d1141a8c1d0a822f243ea2463305bd3f

SHA512
4b760674b76c7b3e3260ceee1ef79c776f0e3724a6471b81abe101f9cf20d703a8cf376dfd136ab12f9e21c452b814396e22f716d3fae77b5a88b177b43d6353

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
94KB

MD5
ead241fe0ce7ca358105e5208e054e17

SHA1
631ed187e2d2fad3f5bf304ae94159708aa04b53

SHA256
83c91c0d435f4593eab152291a66f3ffbc47d9f6a3e0793cf4eaf08d8d4caf11

SHA512
4300e1cb90e25c7e03efd5b57468afe3c90255bb7b31ed3a91dca505ed9f688fff88b00a879651c88825b43e46d2eb9833d0ee6f487c56bec6ce674ca4f89ebe

Download Submit
C:\Windows\SysWOW64\Ogaceh32.exe

Filesize
94KB

MD5
30bebc5993ba1afbdebef16cb6097098

SHA1
d1c5e4e78870a1c4b759e325e22e51babf29f10c

SHA256
f96fed44ccd7c78c1a1e3b0f841325e0a9e342a5ab7844f4b46dc47358ba82d4

SHA512
190d590151b47e588e2d6434f3afcd66064f8ac70bed9299194fb70d38dd0ae92730a3cb25e5ca25710f180c8ccac4faff3d1ac73d9ee84e5c5dbfab83f879a0

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
94KB

MD5
294168ded33b870f5cdf8cce65d6de53

SHA1
129b53d3fbfe8b6416de8bb025f3c600f31c9a87

SHA256
7c2541c82a997124eb9891d1906023136d7beeda10c18b823fa7cd1aad7bae8d

SHA512
e64f79aeeb214666831fe068346ec9df82cc2e95cab4c7de9186f6067a6534a2dee07ab1f8e9335dfd59011d4afda15549ffb6335c2f1876adbdce763987b1a7

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
94KB

MD5
b3add5f36e142554cfe8cb5ae2167497

SHA1
7ab24dbc89926f1af1d9fe8e39eb3de82ad1b558

SHA256
db3df7746aa6d4120fb73b94c3f9bc672af7abd1dc3eeccca13121a33a193ecd

SHA512
50c12b49adb2c3bb345076b5e1f924ae737fa2dd69a12e255e3eb8ee0663a4ddf8bc8f172b1f1c75215eaee156631bc75eb25766c950bb038782519e86bbac95

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
94KB

MD5
fc9d9c2b7a4851c80ad88a789b8a877b

SHA1
b3c262c64ac1dee9d759dd3062d679266cf59da8

SHA256
1de0974c5e5be89a38c424f4a3f14a12380d02da1a733f6163a3e750878e327b

SHA512
7cb2788c1d8b65d7583f3264a38d73fac719d34203b9b5348d39004993949386c54cf8d0c8b30aeedb8dfd731e020abf79d6e84b4404e9d1661e674e8a5bf32e

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
94KB

MD5
b2de15663a2048b5bb7788121e713732

SHA1
51b2c06abaa3505eee69054dad8bff4da8b33e78

SHA256
0d5371d1ee4ae4c3fa848b9336f5fad134bccfd0334afdf52c37c54dd6bd73df

SHA512
67cfc3fbf1214c92ccadb22cd1e6c2f0d233c8a8ff6be50bf93f2fc53363132dfef4b015d4c9082260d2a92d12905d4f56abd918a285f7124bf05e39b86fd076

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
94KB

MD5
fae67be30211abe28a3d970e08fe6d9a

SHA1
b6b8c0ff262f111688dfe7a4dc0ff6977f841c2a

SHA256
4fd4bbce12d7b2ee2e6767f209c43e1a23c95368b6a73452bde4f0f45f6ccaaf

SHA512
0eded026ba508a6eefa63fb2e8eddf5325e9e61b20992ef18ada1c504ccd62d826263ba1f74cc800f4eff6ff75b0aaf1def9666764e91e34f6470102694e733e

Download Submit
C:\Windows\SysWOW64\Onholckc.exe

Filesize
94KB

MD5
5d2814286b1244b9959e6d137256a526

SHA1
1309a03994a2d19747622c06a67637f064860e66

SHA256
1c5dd6aab7db367fea7cd6ef94a76b9ef8516599b4b02fdd7e886e6eda0187a4

SHA512
52491367e040ce89e075ab6ec73109c877963b0ede8e0114dceb7cfe61bd827dcb5068f974d8056b0289e41d24d5b3aef5e2a0d2aa255b8af32dc22e360deff3

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
94KB

MD5
5f473864c381116cb11eb1f3df40322e

SHA1
ab9e6a179b1e1a327893dcd187ffc99f516985ea

SHA256
7bf182a89475733d0918e14d27c0e5e2ce42221a0bb22f9e3360a89fe517f5bb

SHA512
d08e412fe66b6c4662c176d65c61fc64971ca9da322ca63139f3e03e2c2ca419926907454b8d2158c01b7987a5bff6eaa0d62968b0aed8024e4ee53d5e315ef9

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
94KB

MD5
4702e4d91b8b221de2278d94cd36d7f6

SHA1
6317bbb6d951699ca6a057924a6b1abab358609d

SHA256
4c65f713b95b7d927d22279b27c9357487add03b320629f806d1d58a9b8fe8af

SHA512
3ba2635ec2d3246e60557c0f5622f1f15e3a70313fb4d93521f91c1066f35ab911d6ac6d10723fb0cecdcc97a7cc40bc4d6433ce934d2dfc19a0d4fd5eb5ca49

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
94KB

MD5
75c0705e5906c7ac7e5103e3899a8e73

SHA1
87a8f4f5047ca1f77daf75cbb3132789a90b5234

SHA256
075fad4dbc218c9ea843196331742cd9745717dd94476497e9e9b2057b5a9faa

SHA512
08cf57eedf913972d55fa1fb57b6a37021eddb0935fcab160e0bbbe33dc4ab497eacd96ef27094b52dc26a81ecce9f4045dc850fb940f3b9f0f24f545aa6dec3

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
94KB

MD5
1e7bd10f52675000ceb97f10a6dc41b4

SHA1
158b5c6019002127d527f51d02635ddbd75b2e01

SHA256
290b7d448dc40a7244739f27f21709f37c361e4355217d9cbd6a9204de12180d

SHA512
b519e1ef502fa8edfc859ebeb6e895c08516bf0aea40727a75b1fdb458a86ee7afc32e88f38c8d4fdf572f86d57f46a3fd33c280187dc28cbbd69557f1ce990d

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
94KB

MD5
0b3beb2473cdd3c2bb1352b09dbc1832

SHA1
b4f1acb7fbf10759f56325e60706875b9c59000e

SHA256
120c2e889278c08ae9887df0f03da35cd2341b43471bbc933dabf6cce4ae586b

SHA512
746f22f6b0d0e812e903d835de9adc32e949c2fd87e9d8c4a8f28d624fe1c6af0d3122e2808aa3a9d907544be46c2c9294714b1285c04840fa1ca38cede709c0

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
94KB

MD5
6b74f3028fc59fee77e97c49512344b2

SHA1
bf760016b0b5a3bc4a03b54ed780f6f5ad257bba

SHA256
22dedc898eb1c430bfe7a662ace22009446a93fa69fa72e90f9e782e9e9ebc26

SHA512
af6a6aa8f84100c75df1a60171b445d4a70817c6924806d13de3fbbf21d063cb2cba3de216ad6a9c0345dfa3d5aa599554a7837716bac3cf7794f96fc8047dad

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
94KB

MD5
c198392a7791eb07b66076bbec55a186

SHA1
3a36d9bd01568986a441a83ae7f9a2a6ef0a5753

SHA256
5b95054cc32b23ca3c8bbe6611d9eb0577613f451f8c131297c5c0ac20f5b634

SHA512
322c8033bc1517baf9a1c0cb0f60c5ad92bcb94eb29ce7d003fb2ea113a8cbfaea91a45f485c9f36c3416cc2c51a0904a37dfa3f8aa87b8e83b1c834bc871d04

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
94KB

MD5
87d74d75d44223cb7ff89bc209f8c719

SHA1
fe12f5f8e12bae26ca387520489d547c225790a8

SHA256
aa36a0e15cf9f11eb754bfb1ab816c249d12b150fcca8139a5478abfadda5381

SHA512
0eb9b54727c99b82957afb532470a10e695f72ec3310c3be18d4d808b1f9465d2e6702eb7e10d9907327f2a9d8dd812ff03530b1b93de2e39b24b3aad8844cf2

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
94KB

MD5
71df60624a58959371cc197ebc7e8cef

SHA1
5ab128546faba1a1e61811d6832e6e07a39576ac

SHA256
65197cc92a0484ec5b029bf46ef267001ad93b8d84e9bc41791573948d9d68d3

SHA512
6c6f2635ee88528df88f45365179a32e8ea30728690ac407b273f075351a368864e379161760fd21dea39fb391152312a71d7af562ba457f513c590ef917c4d3

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
94KB

MD5
6466b56f1e3060a793dd1d5837c86abe

SHA1
c60dd0ca27f1cc517161a56be33dbbd67eace9fd

SHA256
0fa719764c4171ed6eeb0a69166d9e41c93c50fb6277232392b3ee3dba3d4aa1

SHA512
3ee0441af1a4ee580dfd7534431451df8228f86e4cd03e8449b725ed0191007adada6850c4d0b7c833751aab8862a7b559b5f388a72401546993f121821a5635

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
94KB

MD5
ab43d8b658d04949ea40a0c4c6fe33cf

SHA1
ba640385cdae74942badb578a5d8066f48570145

SHA256
99e7c99cec03e02286cfd16b7f6e653b048754978f590a5a8f69cb53ddb79521

SHA512
af84255aa145a5afabab679c98bede04e09ee2e6641cf8db74ad27ed1153b7cc94621ce911fa3f949ff17a2d0a1079ef7cf46d611c9cfcd9b3ad9ed91d890ed2

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
94KB

MD5
06a4bacf4caf22d25c312de41508479b

SHA1
3890b96e9c44fcf9099f3c39ad3d486f56640c71

SHA256
2410a62307825e2bca9b15f2142f6d7515559b2328aff21ea8ce40ebeda6d1ab

SHA512
3c8e2af97bc0990e3dd821feb1ac195aba7f3a48e659b530cf5effc91a5111458fac27ae74c3c75d3853e473e330218588f729ece0ae80a375a9895037333377

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
94KB

MD5
5ff0854b2cb395e943af68dfaa0eea6c

SHA1
0e0d6ad834ef0a842a259e8799d99c9f1195ffc8

SHA256
25d997e9de579b1859d374e0bd8a65318eaba5e99964324e2c1279d9fe5cc663

SHA512
0fb944cdc68d3cca617e8db562e22ce414149c9ec351d496d36b028a826309af4c35eb498e9429ed30ea2e9af149672112c4c6ff44c7843df6e192fc6f742a72

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
94KB

MD5
56516f1d6307d8c58f5db14caa6e5d08

SHA1
b50de23d44d1c1da8363dd98eb52ae1c82cf7ae7

SHA256
ba57d01add5bd5d26572b93bea58499ead00c49855f19ca7113e657271ae8e4d

SHA512
6cb2ea08fddb7d7745612741edeee3d290006cafb3bdb9cb21cd6981b4dee00d7ab02a0a2c61510cbc74452420dc0f5880463d96e2ec0de2c79d36bc530c432b

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
94KB

MD5
5cd4fff970b4f83bc0342455609385d1

SHA1
8454cdca4ef681fc2c462d78c87d3d5e0d4f2037

SHA256
41e9cd6cd2a8f06e2ab000378b997f71d5e3db9e90afce822f4fc2b99bfe2ec5

SHA512
dcc4383305b488d87d4876ef3c10f8646e91837a16d6c79e9126c47070f1f97785a2d04ef58fa6d34e398b9cef75ecefe5e91a1fe7fcbb0b6dd31f6463187597

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
94KB

MD5
e9bf0265e0702e79efe2f95568b2528c

SHA1
56d545e8815fe360133e4d307a88176761bd7b91

SHA256
e0037ab857ec708ae5e4189be3bb6cb8076846d4f32f3315517736e194a0727e

SHA512
d80ff1c3ddb439003b600313df4084ea6278304942f056c75db250201fbd7ba73ddab46a9062a42bcb8afd8df9fa833bee98882d91849ac93eee965a979cfa14

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
94KB

MD5
9670d4d05cbaf74138d6596d7bc9e94f

SHA1
e1abd1d5fb05a7690ac1b6e293129fb82a5c3bc3

SHA256
e2febc9660e1178bd34ffcdd9f361fbf370b0e92b1ece97102ff78e3f35324d3

SHA512
e84499f19aace9069b7659d28dedbdbf03abd331db6d5737a598fe2060c5cf71148d91370fe9a7bbb30f3d59814135af2e6da563ff88675eec1d0d794eec6388

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
94KB

MD5
c6560970e518c18b30169b0bda975972

SHA1
ed5186aeb9007b992590610fd480ec72b47de7f9

SHA256
52fcbca988a7616adc4eda50ff393516b17ff61a9c7b5d95b355ebf4465083e3

SHA512
fd607e61405cc6f1ca273256735c563097504b3dfddde73ed3b4a4778d99d2e1a6d62f084eca1ae4d4a8d660ba49a1ae75ba51bed3bc8af7b160932ad7d8cc84

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
94KB

MD5
9a0fbd3ecceef37f5f2a59c7dee52396

SHA1
5cbeeafd69c76bfdaedf433d9875d1d6b50b3c8d

SHA256
d635eec16e4336e8669bf3d06a6121496a6da8ec4d3746a92cfb414096e6243b

SHA512
9236f185dbd1490dd616ba71b02c9819cf4982ec496c4c4ae5e5070a76f61f567fff6aab8778a1ad8db62a4f6283f1db63279bbe813e538196e284d1409a0f3c

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
94KB

MD5
79001c3808772744b07c7927ab490c93

SHA1
0b28246d8c12c53f6eb17e8bc8f6668e7523c1fc

SHA256
f27daf2ec4be5a86acdb0594d02fc09ac681034d6c60dd27d26d5289abfe8fb9

SHA512
c99b880a3dfdc3d827d6ae7d24390bf199eaced81708a422f185647f2ada817f4572188d88b29765334e4c7fcef2d0ad28643f3c324aec62ebbbdbc12ecb549e

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
94KB

MD5
6cd41e0846b7990fe41f569fd06c72a8

SHA1
b7c12fbf6ace2f77fbb5d040509b2286d838e51f

SHA256
a2e45da7d467888b53edcb79924e6eea11d9ad3f6bbeaf778419d30d3b1e4c69

SHA512
47c6ad1b29a909ba8347dda35d9d349d4d5b0b9f67c2d53683fc217e30b01f4f4c47c5f1476b0c9b2b26bb8f819e2113a21fffb555a835e30e3e76cf243e586b

Download Submit
C:\Windows\SysWOW64\Pnpemb32.exe

Filesize
94KB

MD5
3297fc2d74c4ca7cb0ac96996254d318

SHA1
cf6233d136d62a74f59103a2db6ca417d2663e25

SHA256
1c35a0a0047c49ff62f905fa6d294b72f09b6c27fe35971bcc97edbdd01f0302

SHA512
aa3adb9cb7535d6dc662db68f96626da9e424e2d807b1dc81eb885e37dc6b70b9447ff5b5402b103aa17fd0d3ee9926973063b929285c332800732df180052ae

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
94KB

MD5
02a158bb8d5061a10d41e9aeef352243

SHA1
cee0c66050bc6f571c5db53c9545afb3810b223d

SHA256
a77164857c481f3655e97b65410c63f86169ebdabd562462ea83b343bbe31fa2

SHA512
efd84db563263e2c62e57b247dc5af23aaef39871955038c1e8a0a3156af9fab53337d9c954dcaee8eb5d458a6be5995073f70198b97dd9c18d13356e51b2b84

Download Submit
C:\Windows\SysWOW64\Qecppkdm.exe

Filesize
94KB

MD5
512fa2bc3541e8605b96fa7cd90f354e

SHA1
aac0b5b697a8d82506fc6ef9a10832c512e5c851

SHA256
2711b2fff947a362ab1979a76325833f71e09863f1ebba137c1083b0e0e45acd

SHA512
a0939508900878468326b405814c8d03677b3630d0d0a9eb6bb733c93e516ceca1ba3d5c113db7d9b240c4a9fb1a25c629e4bf84e95807d5631091661d834bae

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
94KB

MD5
b80d292b05761c7f00db49744a22b24d

SHA1
263754ced7a0c1049df3fbe0ede16570ef82cb0c

SHA256
544b8006bb8f55a885db9405cba3d91e99bb60a27db041b6aec567445fc7108b

SHA512
0f228e882cb7be7861ed87210bf4cdfcae5a7094aacfb98780b0e3959775c878574d8abcef33873e61c05303b661a001a8c494425cfe1aac064e79e674f9043b

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
94KB

MD5
c76ebbf2c54e6c7d957a7f4c7c5dc3d5

SHA1
cf4f9dff95ae640a42ebcda91d338cc0a4915fcd

SHA256
e37016a5cb4ba8eec43b39a90286a31fe1833ae7328c83d645ab6d7026a67ec2

SHA512
448e79cb24c9694dd6c96ae2cc87cb1bf4eee80d735512ef710891dd4a2ec35c31a6ea91343f34d2a5042511f8b57639fcfe263d6bf6488569d4f0560c7c9173

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
94KB

MD5
a5e3dd41a463ff39eff8b08e6075a6c9

SHA1
7a2093df85a48b102a2e8e5445d187a6b6c4e186

SHA256
2b825a515a6ffaea03cd5a6ecfcb02db88a3d51f1b7c4001d2f8700f976a5fa6

SHA512
345e8f505f17ded5c39f262a300b3811bc5b3c7a91638f1a8dd158937344191c9db45e22c64a58940a5cfb52e5a35b2670d4af17c5bbdb94fd66247792f42e4a

Download Submit
memory/60-144-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/296-603-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/296-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/388-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/512-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/788-583-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-578-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/844-532-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/852-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/920-526-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1028-440-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1040-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1064-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1108-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1116-514-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1160-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1216-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1364-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1444-572-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1600-477-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1664-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1704-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1760-500-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1792-12-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1792-551-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-338-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1836-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1952-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2024-549-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2040-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2056-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2056-24-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2276-36-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2348-176-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2368-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2400-414-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2524-208-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2592-308-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2744-261-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2856-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2956-220-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3008-240-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3016-525-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3036-538-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3064-60-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3080-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3084-285-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3200-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3204-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3220-140-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3316-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3356-200-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3388-559-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3408-80-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3424-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3428-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3488-513-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3536-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3552-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3684-466-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3716-297-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3944-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3948-332-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3988-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4004-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4008-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4036-326-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4044-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4088-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4192-386-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4336-556-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4360-92-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4484-446-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4516-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4516-585-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4560-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4580-172-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4688-279-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4724-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4724-544-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4768-586-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4776-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4784-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4808-494-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4880-228-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4892-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4908-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4928-374-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-566-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5016-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5016-558-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5112-272-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5132-597-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5168-604-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads