7e00a3ff2d54d86c22a8e26f23c1090abadcaa4f012091e5af9336b4f5cc270e

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe
Size

128KB
MD5

fe142cc2ff2ebf8fcae8963b0bf73c60
SHA1

5b8253162221dc117867a6a722c954965a683437
SHA256

7e00a3ff2d54d86c22a8e26f23c1090abadcaa4f012091e5af9336b4f5cc270e
SHA512

ffb8d1de56d8bc913354b6e75aa548d9f6558bc2a1a642737d0b37299422300f3d052de53d90df8235b4666bae2a8bf4f0f8254ea2f70f12070205bc0084b230
SSDEEP

1536:SfRFJp9PNPQwiacE0qQVphx0WITHLWMAJ/dRQmUEh44mjD9r823FmUI3kV3oBKi:SRNYhPE0pYrwemUEdmjRrz3TIUV4BKi

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpiecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohhnbhok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjgeedch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckjbhmad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hplbickp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kckqbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmlddqem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcmmhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knalji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahilkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhahaiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcegi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblpgjha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Efgemb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lobjni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elnoopdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pddhbipj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Emmdom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enbjad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inqbclob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kqfngd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmlpaoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oodcdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pddhbipj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqpcjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknmla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dokgdkeh.exe

Executes dropped EXE 64 IoCs

pid	Process
4288	Cbbdjm32.exe
1900	Cmhigf32.exe
3240	Cofecami.exe
4796	Cfqmpl32.exe
3632	Cmjemflb.exe
2952	Djcoai32.exe
2552	Elnoopdj.exe
3708	Eblpgjha.exe
2656	Gdobnj32.exe
4432	Gmggfp32.exe
2944	Gbdoof32.exe
4608	Gingkqkd.exe
564	Ggahedjn.exe
3336	Hmlpaoaj.exe
888	Hiiggoaf.exe
3916	Hpcodihc.exe
4352	Iljpij32.exe
1200	Injmcmej.exe
336	Idcepgmg.exe
3184	Iknmla32.exe
1624	Iloidijb.exe
3264	Igdnabjh.exe
3512	Innfnl32.exe
1724	Inqbclob.exe
692	Jknfcofa.exe
4648	Jdfjld32.exe
228	Kmaopfjm.exe
208	Knalji32.exe
3500	Kcndbp32.exe
3904	Kglmio32.exe
4120	Kqdaadln.exe
1220	Kqfngd32.exe
3032	Lmmolepp.exe
2736	Mkjnfkma.exe
900	Mchppmij.exe
4792	Mnmdme32.exe
2264	Mcjmel32.exe
3528	Mjdebfnd.exe
3896	Manmoq32.exe
1516	Nlcalieg.exe
3120	Njfagf32.exe
4888	Ncofplba.exe
1672	Nenbjo32.exe
644	Nnfgcd32.exe
1484	Nhokljge.exe
440	Nmlddqem.exe
452	Nhahaiec.exe
3236	Nnkpnclp.exe
4104	Ohcegi32.exe
5000	Oalipoiq.exe
4636	Ohhnbhok.exe
1268	Ojgjndno.exe
2540	Oodcdb32.exe
4556	Okkdic32.exe
2144	Pddhbipj.exe
1016	Pahilmoc.exe
3828	Poliea32.exe
4560	Ponfka32.exe
4244	Blqllqqa.exe
2804	Cnahdi32.exe
4452	Coadnlnb.exe
3272	Cleegp32.exe
2400	Cbbnpg32.exe
776	Cdpjlb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kpanan32.exe	Kjgeedch.exe
File created	C:\Windows\SysWOW64\Ondljl32.exe	Ogjdmbil.exe
File opened for modification	C:\Windows\SysWOW64\Efpomccg.exe	Ekkkoj32.exe
File created	C:\Windows\SysWOW64\Ocoaob32.dll	Gpnfge32.exe
File opened for modification	C:\Windows\SysWOW64\Nqbpojnp.exe	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dnmaea32.exe
File opened for modification	C:\Windows\SysWOW64\Kjgeedch.exe	Kgiiiidd.exe
File opened for modification	C:\Windows\SysWOW64\Cfqmpl32.exe	Cofecami.exe
File opened for modification	C:\Windows\SysWOW64\Elnoopdj.exe	Djcoai32.exe
File created	C:\Windows\SysWOW64\Inqbclob.exe	Innfnl32.exe
File opened for modification	C:\Windows\SysWOW64\Dfglfdkb.exe	Dkahilkl.exe
File created	C:\Windows\SysWOW64\Pqknpl32.dll	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Fngcmcfe.exe
File created	C:\Windows\SysWOW64\Binlfp32.dll	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Gdobnj32.exe	Eblpgjha.exe
File created	C:\Windows\SysWOW64\Nenbjo32.exe	Ncofplba.exe
File created	C:\Windows\SysWOW64\Ojgjndno.exe	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Dkahilkl.exe	Dokgdkeh.exe
File opened for modification	C:\Windows\SysWOW64\Hibjli32.exe	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Ekfjcc32.dll	Iepaaico.exe
File created	C:\Windows\SysWOW64\Hebqnm32.dll	Ifomll32.exe
File created	C:\Windows\SysWOW64\Kngkqbgl.exe	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Jknfcofa.exe	Inqbclob.exe
File created	C:\Windows\SysWOW64\Knalji32.exe	Kmaopfjm.exe
File created	C:\Windows\SysWOW64\Ehkaqc32.dll	Iebngial.exe
File created	C:\Windows\SysWOW64\Iibccgep.exe	Igdgglfl.exe
File created	C:\Windows\SysWOW64\Ojnkocdc.dll	Mogcihaj.exe
File created	C:\Windows\SysWOW64\Dgfpihkg.dll	Opclldhj.exe
File created	C:\Windows\SysWOW64\Bhkfkmmg.exe	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Iebngial.exe	Ifomll32.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Nfaemp32.exe
File opened for modification	C:\Windows\SysWOW64\Ondljl32.exe	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Almoijfo.dll	Kfnfjehl.exe
File created	C:\Windows\SysWOW64\Nmbjcljl.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Bpfkpp32.exe	Boenhgdd.exe
File opened for modification	C:\Windows\SysWOW64\Bmjkic32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Kqfngd32.exe	Kqdaadln.exe
File created	C:\Windows\SysWOW64\Dejncidp.dll	Dmennnni.exe
File created	C:\Windows\SysWOW64\Hmpcbhji.exe	Hplbickp.exe
File created	C:\Windows\SysWOW64\Hmdlmg32.exe	Hfjdqmng.exe
File opened for modification	C:\Windows\SysWOW64\Igdgglfl.exe	Iomoenej.exe
File opened for modification	C:\Windows\SysWOW64\Jocefm32.exe	Jleijb32.exe
File created	C:\Windows\SysWOW64\Eelche32.dll	Kpanan32.exe
File opened for modification	C:\Windows\SysWOW64\Nfaemp32.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Gdglhf32.dll	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Pbmmao32.dll	Gingkqkd.exe
File created	C:\Windows\SysWOW64\Dnbakghm.exe	Dmadco32.exe
File created	C:\Windows\SysWOW64\Aablof32.dll	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Dapnbcqo.dll	Poliea32.exe
File created	C:\Windows\SysWOW64\Emmdom32.exe	Efblbbqd.exe
File created	C:\Windows\SysWOW64\Cmcgolla.dll	Gblbca32.exe
File created	C:\Windows\SysWOW64\Iomoenej.exe	Imkbnf32.exe
File created	C:\Windows\SysWOW64\Ncqlkemc.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Cjceejee.dll	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Aonhghjl.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Dmmcnn32.dll	Kqfngd32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhnbhok.exe	Oalipoiq.exe
File opened for modification	C:\Windows\SysWOW64\Ojgjndno.exe	Ohhnbhok.exe
File opened for modification	C:\Windows\SysWOW64\Iibccgep.exe	Igdgglfl.exe
File created	C:\Windows\SysWOW64\Kcmmhj32.exe	Kpoalo32.exe
File opened for modification	C:\Windows\SysWOW64\Mcjmel32.exe	Mnmdme32.exe
File created	C:\Windows\SysWOW64\Efcagd32.dll	Mjdebfnd.exe
File created	C:\Windows\SysWOW64\Abklmb32.dll	Chnbbqpn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7156	6976	WerFault.exe	301

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmkdjo32.dll"	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keldkigj.dll"	Ohhnbhok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmiadfmi.dll"	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfokn32.dll"	Gbalopbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ohcegi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojnkocdc.dll"	Mogcihaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgjimp32.dll"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmjemflb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcjmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhpjc32.dll"	Cleegp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddligq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accimdgp.dll"	Iidphgcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Keimof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fboqkn32.dll"	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifaohg32.dll"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Manmoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Galdglpd.dll"	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iidphgcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iepaaico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Elnoopdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmlpaoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oibqpk32.dll"	Nhahaiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcbfe32.dll"	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenqhaga.dll"	Djcoai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Igdnabjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgqin32.dll"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmcpd32.dll"	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmpcbhji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Idcepgmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkjnfkma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oodcdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mogcihaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekppjn32.dll"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkngke32.dll"	Jleijb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjcgjio.dll"	Jocefm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aablof32.dll"	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdjgko32.dll"	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njfagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglkdbfn.dll"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epopbo32.dll"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mchppmij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hpchib32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4288	4392	NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe	85
PID 4392 wrote to memory of 4288	4392	NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe	85
PID 4392 wrote to memory of 4288	4392	NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe	85
PID 4288 wrote to memory of 1900	4288	Cbbdjm32.exe	86
PID 4288 wrote to memory of 1900	4288	Cbbdjm32.exe	86
PID 4288 wrote to memory of 1900	4288	Cbbdjm32.exe	86
PID 1900 wrote to memory of 3240	1900	Cmhigf32.exe	87
PID 1900 wrote to memory of 3240	1900	Cmhigf32.exe	87
PID 1900 wrote to memory of 3240	1900	Cmhigf32.exe	87
PID 3240 wrote to memory of 4796	3240	Cofecami.exe	88
PID 3240 wrote to memory of 4796	3240	Cofecami.exe	88
PID 3240 wrote to memory of 4796	3240	Cofecami.exe	88
PID 4796 wrote to memory of 3632	4796	Cfqmpl32.exe	89
PID 4796 wrote to memory of 3632	4796	Cfqmpl32.exe	89
PID 4796 wrote to memory of 3632	4796	Cfqmpl32.exe	89
PID 3632 wrote to memory of 2952	3632	Cmjemflb.exe	90
PID 3632 wrote to memory of 2952	3632	Cmjemflb.exe	90
PID 3632 wrote to memory of 2952	3632	Cmjemflb.exe	90
PID 2952 wrote to memory of 2552	2952	Djcoai32.exe	91
PID 2952 wrote to memory of 2552	2952	Djcoai32.exe	91
PID 2952 wrote to memory of 2552	2952	Djcoai32.exe	91
PID 2552 wrote to memory of 3708	2552	Elnoopdj.exe	92
PID 2552 wrote to memory of 3708	2552	Elnoopdj.exe	92
PID 2552 wrote to memory of 3708	2552	Elnoopdj.exe	92
PID 3708 wrote to memory of 2656	3708	Eblpgjha.exe	93
PID 3708 wrote to memory of 2656	3708	Eblpgjha.exe	93
PID 3708 wrote to memory of 2656	3708	Eblpgjha.exe	93
PID 2656 wrote to memory of 4432	2656	Gdobnj32.exe	94
PID 2656 wrote to memory of 4432	2656	Gdobnj32.exe	94
PID 2656 wrote to memory of 4432	2656	Gdobnj32.exe	94
PID 4432 wrote to memory of 2944	4432	Gmggfp32.exe	95
PID 4432 wrote to memory of 2944	4432	Gmggfp32.exe	95
PID 4432 wrote to memory of 2944	4432	Gmggfp32.exe	95
PID 2944 wrote to memory of 4608	2944	Gbdoof32.exe	96
PID 2944 wrote to memory of 4608	2944	Gbdoof32.exe	96
PID 2944 wrote to memory of 4608	2944	Gbdoof32.exe	96
PID 4608 wrote to memory of 564	4608	Gingkqkd.exe	97
PID 4608 wrote to memory of 564	4608	Gingkqkd.exe	97
PID 4608 wrote to memory of 564	4608	Gingkqkd.exe	97
PID 564 wrote to memory of 3336	564	Ggahedjn.exe	99
PID 564 wrote to memory of 3336	564	Ggahedjn.exe	99
PID 564 wrote to memory of 3336	564	Ggahedjn.exe	99
PID 3336 wrote to memory of 888	3336	Hmlpaoaj.exe	100
PID 3336 wrote to memory of 888	3336	Hmlpaoaj.exe	100
PID 3336 wrote to memory of 888	3336	Hmlpaoaj.exe	100
PID 888 wrote to memory of 3916	888	Hiiggoaf.exe	101
PID 888 wrote to memory of 3916	888	Hiiggoaf.exe	101
PID 888 wrote to memory of 3916	888	Hiiggoaf.exe	101
PID 3916 wrote to memory of 4352	3916	Hpcodihc.exe	102
PID 3916 wrote to memory of 4352	3916	Hpcodihc.exe	102
PID 3916 wrote to memory of 4352	3916	Hpcodihc.exe	102
PID 4352 wrote to memory of 1200	4352	Iljpij32.exe	104
PID 4352 wrote to memory of 1200	4352	Iljpij32.exe	104
PID 4352 wrote to memory of 1200	4352	Iljpij32.exe	104
PID 1200 wrote to memory of 336	1200	Injmcmej.exe	105
PID 1200 wrote to memory of 336	1200	Injmcmej.exe	105
PID 1200 wrote to memory of 336	1200	Injmcmej.exe	105
PID 336 wrote to memory of 3184	336	Idcepgmg.exe	106
PID 336 wrote to memory of 3184	336	Idcepgmg.exe	106
PID 336 wrote to memory of 3184	336	Idcepgmg.exe	106
PID 3184 wrote to memory of 1624	3184	Iknmla32.exe	107
PID 3184 wrote to memory of 1624	3184	Iknmla32.exe	107
PID 3184 wrote to memory of 1624	3184	Iknmla32.exe	107
PID 1624 wrote to memory of 3264	1624	Iloidijb.exe	108

C:\Users\Admin\AppData\Local\Temp\NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fe142cc2ff2ebf8fcae8963b0bf73c60_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\Cbbdjm32.exe
  C:\Windows\system32\Cbbdjm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\Cmhigf32.exe
    C:\Windows\system32\Cmhigf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\SysWOW64\Cofecami.exe
      C:\Windows\system32\Cofecami.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3512
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1724
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        26⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        30⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        31⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        32⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4120
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        35⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2736
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:900
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        42⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4888
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        46⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        50⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        54⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        56⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        58⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3828
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        61⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        63⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3272
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        65⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        66⤵
        Executes dropped EXE
        
        PID:776
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4252
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        68⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        69⤵
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        70⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        71⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        74⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        75⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        76⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        77⤵
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        78⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3204
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        80⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        82⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        83⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4896
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        85⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5016
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        87⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        89⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        90⤵
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:756
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        92⤵
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        93⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        94⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        95⤵
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        97⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        98⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        99⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        100⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5408
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        104⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        106⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        107⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        108⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        109⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        110⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        111⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        114⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        117⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        118⤵
        Drops file in System32 directory
        
        PID:648
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        119⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        121⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        122⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        124⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        127⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        129⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        130⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        136⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        137⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        138⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        139⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        141⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        142⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        143⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        144⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        146⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        147⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        149⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        150⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        151⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        152⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        153⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        158⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        159⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        160⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        161⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        163⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        164⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        165⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        166⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        167⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        169⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        170⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        171⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        172⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        173⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        174⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        175⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        177⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        179⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        181⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        182⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        183⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        184⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        185⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        186⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        187⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        188⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        190⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        191⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        193⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        194⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        195⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        197⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        199⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        201⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        202⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        203⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        204⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        205⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        207⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        208⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        209⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        210⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        211⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        213⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 236
        214⤵
        Program crash
        
        PID:7156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6976 -ip 6976
1⤵
PID:7132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aknbkjfh.exe

Filesize
128KB

MD5
ae00b254e5ad5d0b8dda006a1df2c0db

SHA1
1e129cd750376e3d0ed5eedd7ed369304c86a0b7

SHA256
3d8eeade96d10af2b5a2c2b0c79737589a6f735ada8ab39834070a68dc2f018c

SHA512
4b4625b742285b4290665d2b9fa870fbcf43b1d83be86bf4497181df805d0a2263300440c017e8c1639d008e46008ba64dcb310bf0f4056259c8fb4c45342ab7

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
128KB

MD5
b3d14ac4cf5b004d4f2a82594dd2e09a

SHA1
7d2a70c24e076f2c14136e11a73c9cbc095ee180

SHA256
e1a41159fdeb0e96c554d2c052162b5f1a69425e11f7ae5a49a73d0852c49364

SHA512
4c8947d297e28732ce74b5e3b5a486a742aea161ba2112ca60e05dfff540a21f8f2c2aa1f748e701828034ece22a80585aa1137b4b6c707b3cc4692a619cc06f

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
128KB

MD5
f1d602b5d02a66c132fd0280434a154b

SHA1
969fab389f9f6330b62844bd99d7796254b91faf

SHA256
5f867dc809d6b5a0b7167041d150a8c2bf87e68e813009969ed890b20969b2f5

SHA512
ad0fa0bf2c83963abaf2e4b17f7461a8d35fcc25fcd191fd34b7aa9db5e027d02d3a0e8da734711f0b8a908638b0d1a7e44093e7341ed75e3b438d7ba1656e60

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
128KB

MD5
a2d99ce7488faf560152f39535ba703d

SHA1
935b6145d10011735ffb66c14be5df5ff3f5a7ca

SHA256
3b1c90e7eb420be2847ce09d6a4b6651a0c22708be0a49012caa1ffe70a05821

SHA512
9d562af78a110b511ee26e71750030ad768f97a447eb0f348f178cdbc2e57f333d9e489c53dfc6c0fd9a7aef314b7b31b3ecbc7b03a9d1c47fef827d9c5a98e0

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
128KB

MD5
a2d99ce7488faf560152f39535ba703d

SHA1
935b6145d10011735ffb66c14be5df5ff3f5a7ca

SHA256
3b1c90e7eb420be2847ce09d6a4b6651a0c22708be0a49012caa1ffe70a05821

SHA512
9d562af78a110b511ee26e71750030ad768f97a447eb0f348f178cdbc2e57f333d9e489c53dfc6c0fd9a7aef314b7b31b3ecbc7b03a9d1c47fef827d9c5a98e0

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
128KB

MD5
b4c42b51244b452ccea93f3d207e34b8

SHA1
9289bf99d24524e8a3ed919110d10a0a83f2e756

SHA256
eb6af45dbae4cccf528e9c642394e9bded051c25a08f909fddc863628d1d1c1c

SHA512
e124722c6244f0ea87ce200ee99ec8397cb49b024d5cf63dd255b56b29443fe764edfa60e5ff82465758c6a8aaea9a70001571b8f04be435416ebacda860bb3f

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
128KB

MD5
b4c42b51244b452ccea93f3d207e34b8

SHA1
9289bf99d24524e8a3ed919110d10a0a83f2e756

SHA256
eb6af45dbae4cccf528e9c642394e9bded051c25a08f909fddc863628d1d1c1c

SHA512
e124722c6244f0ea87ce200ee99ec8397cb49b024d5cf63dd255b56b29443fe764edfa60e5ff82465758c6a8aaea9a70001571b8f04be435416ebacda860bb3f

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
128KB

MD5
943e72a633c97bbbd376c515ef08d71c

SHA1
5055cdf0f2d6353af176d0551c575a547444aa1e

SHA256
c5472345eb73d6de4dc840ccb18c3d057e2ccf5cba6d84164bcdfb3620926866

SHA512
82a056ed7daa52db4163dd5f33b7e3b53d8ed90272321bb43b75a60e04d912a8d66149c9a00246da8b29b617643afd45e0e2be6c7cd78ddcc181f2dd2ea18953

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
128KB

MD5
b7df40e5573f95f03c1004f9b9fe070f

SHA1
41dc7ce9252c57abea9b71ad84dda0d9b94f0e6c

SHA256
4e23295ad009a4de4213902f35698568b707c704f21312e3bccc8e2cd58f287f

SHA512
b7a50216a49e2f2e1784165e1f68ba479fcd3f567ea5855fa8e9d11a46731df59fe322c3d6bfdfbc2259edbf7024faab64f80c222df258e17d2217605416cac1

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
128KB

MD5
d7604bbc531b09bff6937edae9062db9

SHA1
45ad48e2e9d7f5144aca3a633864410c3e70c104

SHA256
b5a5e4f88a5536cf03cda8020921b0ce1876b627204c66e1b9ad19ce095f37b9

SHA512
6b579804957da92f76e56aea7a1be8aaccb202600ca5eeeb47e551dcb399bdf689f6dc0ae905d9414a448ff85dce653bbd2932eb13b4d0c07fb2f41946e90df6

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
128KB

MD5
d7604bbc531b09bff6937edae9062db9

SHA1
45ad48e2e9d7f5144aca3a633864410c3e70c104

SHA256
b5a5e4f88a5536cf03cda8020921b0ce1876b627204c66e1b9ad19ce095f37b9

SHA512
6b579804957da92f76e56aea7a1be8aaccb202600ca5eeeb47e551dcb399bdf689f6dc0ae905d9414a448ff85dce653bbd2932eb13b4d0c07fb2f41946e90df6

Download Submit
C:\Windows\SysWOW64\Cmjemflb.exe

Filesize
128KB

MD5
b383e03ca12c57241a23a179ca30d9d4

SHA1
426eecc8e048f05ccdbf019b77e3a580ef280f86

SHA256
a7a730b6b09a34955e634873b3c882441fdf2b201a8642e484189ae15641df20

SHA512
958742c78d9daeaac44efcdeb291c24ded5a33be6feb0de376fc027dde936fbfaec9b0ff9684492f9f2c23790702c94c2a786ed9121e7ea12a00bb5d5cc10923

Download Submit
C:\Windows\SysWOW64\Cmjemflb.exe

Filesize
128KB

MD5
b383e03ca12c57241a23a179ca30d9d4

SHA1
426eecc8e048f05ccdbf019b77e3a580ef280f86

SHA256
a7a730b6b09a34955e634873b3c882441fdf2b201a8642e484189ae15641df20

SHA512
958742c78d9daeaac44efcdeb291c24ded5a33be6feb0de376fc027dde936fbfaec9b0ff9684492f9f2c23790702c94c2a786ed9121e7ea12a00bb5d5cc10923

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
128KB

MD5
f639d6517830893e8dd95bc6ef2d3f1d

SHA1
e61abc0216d165021e8ec6295069b2dd465dca93

SHA256
fb23788b13986ad03da3fc097232cbb64e28a9965477b21e6c3e0ba3361fbad2

SHA512
392837da08d9e85a5f872f0150581aac822f54d0bb35f9ef856eba40ee9420317d085e6b098cf4c9c6854164bc5b8d63cd665de44875a0f6c0340a844e0d685e

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
128KB

MD5
f639d6517830893e8dd95bc6ef2d3f1d

SHA1
e61abc0216d165021e8ec6295069b2dd465dca93

SHA256
fb23788b13986ad03da3fc097232cbb64e28a9965477b21e6c3e0ba3361fbad2

SHA512
392837da08d9e85a5f872f0150581aac822f54d0bb35f9ef856eba40ee9420317d085e6b098cf4c9c6854164bc5b8d63cd665de44875a0f6c0340a844e0d685e

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
128KB

MD5
6b2a577b31a2ed1eefe68448de5fb17c

SHA1
7e8ac01c65f86e25fa2c4e6f7819d270fb20f237

SHA256
72def1d72643a0b769f3a3c62099841f3ec3371f51c6c8a9f97504d32a785b4a

SHA512
967f5844fc4330e5236b86104dfba38850b065d29b14478576e676683f05bcc7c35c12c19fe8a61c1f3778b8c893c09917a57b2b31bda94b29a7c16627ad2968

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
128KB

MD5
b383e03ca12c57241a23a179ca30d9d4

SHA1
426eecc8e048f05ccdbf019b77e3a580ef280f86

SHA256
a7a730b6b09a34955e634873b3c882441fdf2b201a8642e484189ae15641df20

SHA512
958742c78d9daeaac44efcdeb291c24ded5a33be6feb0de376fc027dde936fbfaec9b0ff9684492f9f2c23790702c94c2a786ed9121e7ea12a00bb5d5cc10923

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
128KB

MD5
ac201a505c45e02706e822d95e039052

SHA1
705cc382a2e5460b46c7314cd1d7e9e1eaa71b5f

SHA256
5229fda35d557cabfabb11a4defd7d8230176ed802c06a3a0ea12548ae5cde1e

SHA512
94bab156f124ba93d13790a831c5660ff1b68eb04c8fcaba9db84a3912944d2d034a7af4a4ac56f3395fe599ce3614ef777d6262443e5dbfd7aeac31a23b3a8b

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
128KB

MD5
ac201a505c45e02706e822d95e039052

SHA1
705cc382a2e5460b46c7314cd1d7e9e1eaa71b5f

SHA256
5229fda35d557cabfabb11a4defd7d8230176ed802c06a3a0ea12548ae5cde1e

SHA512
94bab156f124ba93d13790a831c5660ff1b68eb04c8fcaba9db84a3912944d2d034a7af4a4ac56f3395fe599ce3614ef777d6262443e5dbfd7aeac31a23b3a8b

Download Submit
C:\Windows\SysWOW64\Dnbakghm.exe

Filesize
128KB

MD5
401412e22a448c088fbde761138b1122

SHA1
198cd578c9da91d98fbce18841ee25de7e9d3a6d

SHA256
9a336e8e9329c2d77b245ba581c291641c8923676ab97cb5669bcabba4b96ba6

SHA512
8c618ede31ded6b03a8c3fdcad731d27253117032e77c7b8faaa9431f5a362dc7e88426bc10c4b0f347b7c35e737cea8ce87bd923a4b3449180166d1cf8417d6

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
128KB

MD5
b908f109ca7b0350c9a3d7e2942bb42c

SHA1
f70a2fa76e0a7a4ab3c3b917647849c2f845156b

SHA256
980ec6d7a6b7d5c7455e9888a29171c10969474463076a11ce9af2ff9ee74626

SHA512
f64419d2abbea6c35909d61f0714179605edd2298dc996a5f65dde77c9e9044dff27282fc2b0260db45d7dd8103f3b3eb782e239cdd2a8c2fafbb25775b0d079

Download Submit
C:\Windows\SysWOW64\Dodjjimm.exe

Filesize
128KB

MD5
b581cd40fe34167d0e6be6806d5a8997

SHA1
57379fd343719b199624826696fc04563169fc37

SHA256
0292f08255b6a35f3743a59f1da4f9f9a2c361470562ca77dbc9566ea833dd1e

SHA512
9d2862e95ff3ea83911a4dbf5b54c24497137cddf60ea298f3654a6f36250e5445c7017240bdacaeb57b6b8a6d3aa63d87aacec791456868c9fad80d64aa942b

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
128KB

MD5
f66f70daedddd8352b512480d05dfd35

SHA1
21dedca38ea359767e88b30bf95a6d8d92475ef2

SHA256
6cbdd15aefbd00a23487f84f703758489444ae80ce82cbdded2735147866fe4b

SHA512
5e2be66cc86c97799be7e245fd9b6c6485a1d74e9b07ad860238dcfedba5193cc8c68967994513c6c2ec530d0d35607b39c392cf48e9982a076ec33893475d25

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
128KB

MD5
f66f70daedddd8352b512480d05dfd35

SHA1
21dedca38ea359767e88b30bf95a6d8d92475ef2

SHA256
6cbdd15aefbd00a23487f84f703758489444ae80ce82cbdded2735147866fe4b

SHA512
5e2be66cc86c97799be7e245fd9b6c6485a1d74e9b07ad860238dcfedba5193cc8c68967994513c6c2ec530d0d35607b39c392cf48e9982a076ec33893475d25

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
128KB

MD5
136f52c780199b142b752971e73f6c9a

SHA1
34f6ab1fb1c87a66cdbd4d5b3f419b9ec0ef6e3d

SHA256
1ead0f8d4fd44cfc611306e27ff53aa7c4a65fad3fa13549ab19d939c1b9b07a

SHA512
61bee9f702e7903f62f71aab6c68391d5722711a7b639ad2415bdfca5a085dca3193e2919504872bcb79f2216bc6903519eb4dfebc80a3fe7cd3feb4b5dc9042

Download Submit
C:\Windows\SysWOW64\Egqbff32.dll

Filesize
7KB

MD5
df57f55810e8e90644d829c65dafba06

SHA1
12c83418d99c38245c9f0b7053b04d07237ff224

SHA256
2d6802dcbaf7121709fbedc6184a6a0de6aa94f5c29e668fba8d2de1b8aab4c5

SHA512
042e6352cdad00fdb1a055ae8efdbc693247d657d4047294fe2f7307b76993613f94416162f3a9a8d4658ef2eb5637cf29c772210e72de46347e346aa1bb74bc

Download Submit
C:\Windows\SysWOW64\Elnoopdj.exe

Filesize
128KB

MD5
c0920490d0ce95fec4644d6722c295f5

SHA1
a7ef7279b20f310b23e51b3cf34a2c0dc6a685fa

SHA256
81d8141682ba3667e63932ab429f5c86314894dacdef3fb1bd4f686b179c37b1

SHA512
23dbc8a9cbaceeab592d307ce77a8683d3fc00e03b57b6730515ba88c148f36f24be277cb3eb10eab866836ba506ca7532c521038e29fe43e9c49bb32415d9a1

Download Submit
C:\Windows\SysWOW64\Elnoopdj.exe

Filesize
128KB

MD5
c0920490d0ce95fec4644d6722c295f5

SHA1
a7ef7279b20f310b23e51b3cf34a2c0dc6a685fa

SHA256
81d8141682ba3667e63932ab429f5c86314894dacdef3fb1bd4f686b179c37b1

SHA512
23dbc8a9cbaceeab592d307ce77a8683d3fc00e03b57b6730515ba88c148f36f24be277cb3eb10eab866836ba506ca7532c521038e29fe43e9c49bb32415d9a1

Download Submit
C:\Windows\SysWOW64\Fbpchb32.exe

Filesize
128KB

MD5
94d88779aaabe6cf66c8f2538d798718

SHA1
a77a6b2e116ac36a54a173ac91f207099b644846

SHA256
98adfc785cec5203b2b3d4584d93ddad6c78939bf21d1f83dcdbfc0faf841eab

SHA512
06a51e6a04e82fa9cb49b8dae6486fad9a659ac4d86c2c8a3ce7a17b99a8b423cb0ee90c37d8969e4af629e7b8f15e4eac512de22b2d4179b99d73b8c9c8cc9c

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
128KB

MD5
4de9259f41fba4eb070f87097cc63ebc

SHA1
57326b05700588a93ccc565c6f318a91c89ef487

SHA256
664d47b3c548a3c778102f1bcb72041e2426e526f30a03dcc2026c67a88fee93

SHA512
e15b50eb27a930da2fe0af8b53592388b92cef835e5af2e5422e3487e9b0491b07858e33bfeaa4a2194f4b95fd101c8d3f40287727546a38627d3acb2299489c

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
128KB

MD5
4de9259f41fba4eb070f87097cc63ebc

SHA1
57326b05700588a93ccc565c6f318a91c89ef487

SHA256
664d47b3c548a3c778102f1bcb72041e2426e526f30a03dcc2026c67a88fee93

SHA512
e15b50eb27a930da2fe0af8b53592388b92cef835e5af2e5422e3487e9b0491b07858e33bfeaa4a2194f4b95fd101c8d3f40287727546a38627d3acb2299489c

Download Submit
C:\Windows\SysWOW64\Gdobnj32.exe

Filesize
128KB

MD5
d43fc13524c09a1e0e92983f3ea5ed57

SHA1
b18e237464698ed5c9f581ae4f5a9a6e9cc6161b

SHA256
61fb8082983568e94b7b1f53564b724b6ab1703259d9c9b6f36194c098a63b34

SHA512
27b7ad96f06f13f22a7cfb5aa344ae572ffa2abd76c9ea664faac978ab56bcadf6b58784c00db3a0c0c2cc2b3225a6c621ed6a14667ae9e2f2ed6267299e8fd3

Download Submit
C:\Windows\SysWOW64\Gdobnj32.exe

Filesize
128KB

MD5
d43fc13524c09a1e0e92983f3ea5ed57

SHA1
b18e237464698ed5c9f581ae4f5a9a6e9cc6161b

SHA256
61fb8082983568e94b7b1f53564b724b6ab1703259d9c9b6f36194c098a63b34

SHA512
27b7ad96f06f13f22a7cfb5aa344ae572ffa2abd76c9ea664faac978ab56bcadf6b58784c00db3a0c0c2cc2b3225a6c621ed6a14667ae9e2f2ed6267299e8fd3

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
128KB

MD5
bc86d1f30ba5696804b8d3694505c79a

SHA1
0834d44d7c9ef247bb73b838a32799946c60e99a

SHA256
6db7d3c699c677c2bb224b3d20e77ba1f2c202be5d9ed1ecf689ab8e18e492c6

SHA512
b5554abe155b2958179036fe6f87acdb2e44c07df5813acb3ed680e17a00931b27bd3531548511234bc42c594036392848f9c0a24fe3bf97ef114ddb27fb3c74

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
128KB

MD5
4dfad7225a18355b5ea2c63a7fbae292

SHA1
f6e3569b0d30a76de0b78b30045c063ea3597ce3

SHA256
e5ce1374db6232589ffa580f5803b9f43876eb99691cb71c62a71f4cdd29c243

SHA512
e7b72b2a0b33698115fbc3b557b31ad7512c089e5b9a74805926437313d0e9afe9496e2d91cab73775cc67ce550d348740eeba6c956ef38034fd2dbfc118b217

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
128KB

MD5
4dfad7225a18355b5ea2c63a7fbae292

SHA1
f6e3569b0d30a76de0b78b30045c063ea3597ce3

SHA256
e5ce1374db6232589ffa580f5803b9f43876eb99691cb71c62a71f4cdd29c243

SHA512
e7b72b2a0b33698115fbc3b557b31ad7512c089e5b9a74805926437313d0e9afe9496e2d91cab73775cc67ce550d348740eeba6c956ef38034fd2dbfc118b217

Download Submit
C:\Windows\SysWOW64\Gingkqkd.exe

Filesize
128KB

MD5
13a033a6ac98f9f860956b2d4c54c192

SHA1
cfc58552b8ad2fde0dadd6c4c231f5c9bd2b0e6a

SHA256
18395f72859458957b574d9c921b1d80077d1c16e4d0c8bfcfdeff24b829064c

SHA512
8f51f33cfc450a304180145cd9c82e7bb760536ae6a0d8db14ce1361da4842e6be068aa969cbba47b643986ae97409090d3edd790133743b5019328b33771d89

Download Submit
C:\Windows\SysWOW64\Gingkqkd.exe

Filesize
128KB

MD5
13a033a6ac98f9f860956b2d4c54c192

SHA1
cfc58552b8ad2fde0dadd6c4c231f5c9bd2b0e6a

SHA256
18395f72859458957b574d9c921b1d80077d1c16e4d0c8bfcfdeff24b829064c

SHA512
8f51f33cfc450a304180145cd9c82e7bb760536ae6a0d8db14ce1361da4842e6be068aa969cbba47b643986ae97409090d3edd790133743b5019328b33771d89

Download Submit
C:\Windows\SysWOW64\Gmggfp32.exe

Filesize
128KB

MD5
b2e36a6424540b480e80c1f4909ecf22

SHA1
51521499ebacf8e3cd76dd161e1c0a8b07c81628

SHA256
cc906851e389043fd047373ab0314f903f0c7d6d52484dc32785506a3143cac2

SHA512
3af8b37e8f8d4f0f41a4b6ee95a32c019ed3703236a56815516b2f4ccc6b8c0e3ddb55523d25c23112657f9765fd4d1eeba7d13ca96ff5ed3d0823de81bee83a

Download Submit
C:\Windows\SysWOW64\Gmggfp32.exe

Filesize
128KB

MD5
b2e36a6424540b480e80c1f4909ecf22

SHA1
51521499ebacf8e3cd76dd161e1c0a8b07c81628

SHA256
cc906851e389043fd047373ab0314f903f0c7d6d52484dc32785506a3143cac2

SHA512
3af8b37e8f8d4f0f41a4b6ee95a32c019ed3703236a56815516b2f4ccc6b8c0e3ddb55523d25c23112657f9765fd4d1eeba7d13ca96ff5ed3d0823de81bee83a

Download Submit
C:\Windows\SysWOW64\Hiiggoaf.exe

Filesize
128KB

MD5
f46889e858b1513babe5d24a96c2c239

SHA1
ffec6c77aec0a676a00101c1805c17b28103eadf

SHA256
31d87198f133a41c73825590cd21c783fdd284f9c04b743bc331f4f0cba9c09d

SHA512
4c71b7e8773132a3d9fb41fd4782d827c6b25983dd6d84a1b61391c14a3518092647cf4a7082fbf7bf3c4559066af3033d7c942386ce6da26b40832c404595b9

Download Submit
C:\Windows\SysWOW64\Hiiggoaf.exe

Filesize
128KB

MD5
f46889e858b1513babe5d24a96c2c239

SHA1
ffec6c77aec0a676a00101c1805c17b28103eadf

SHA256
31d87198f133a41c73825590cd21c783fdd284f9c04b743bc331f4f0cba9c09d

SHA512
4c71b7e8773132a3d9fb41fd4782d827c6b25983dd6d84a1b61391c14a3518092647cf4a7082fbf7bf3c4559066af3033d7c942386ce6da26b40832c404595b9

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
128KB

MD5
f1cba758010575b5f651f5584c62d6ef

SHA1
f724c9c4fcfa82e4f90d4b67f3a716218ba24990

SHA256
8b78e6a3c26a122f4805ef1c864770ad0f80a5bebe799ffb5c8067b7f4270476

SHA512
9c2587795c9c9ca2106b441554e9d83d78e50819be4d04a6df071cfa2adbbed8136f6cad47dd316cc140c744661f551ce8907bbddfd2fb072f3b564581330c90

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
128KB

MD5
f1cba758010575b5f651f5584c62d6ef

SHA1
f724c9c4fcfa82e4f90d4b67f3a716218ba24990

SHA256
8b78e6a3c26a122f4805ef1c864770ad0f80a5bebe799ffb5c8067b7f4270476

SHA512
9c2587795c9c9ca2106b441554e9d83d78e50819be4d04a6df071cfa2adbbed8136f6cad47dd316cc140c744661f551ce8907bbddfd2fb072f3b564581330c90

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
128KB

MD5
f1cba758010575b5f651f5584c62d6ef

SHA1
f724c9c4fcfa82e4f90d4b67f3a716218ba24990

SHA256
8b78e6a3c26a122f4805ef1c864770ad0f80a5bebe799ffb5c8067b7f4270476

SHA512
9c2587795c9c9ca2106b441554e9d83d78e50819be4d04a6df071cfa2adbbed8136f6cad47dd316cc140c744661f551ce8907bbddfd2fb072f3b564581330c90

Download Submit
C:\Windows\SysWOW64\Hpcodihc.exe

Filesize
128KB

MD5
11436fa467ec8ba68b638ef5d295ad48

SHA1
a072520ed52b6f732eb33a010e59f39a6c325464

SHA256
ad8b5734ae108694beae8b8d6e26f9eb10ef2a1f943f186ed5630d650519dc46

SHA512
bf0e7dbddf315ea31b9e9be0e7b21b38ec8286700db69702d44e54c04d5d8f31f05fbd3c06e7aac1869af2bf1801dd77f690000d03b15440a58c40e7d4415e62

Download Submit
C:\Windows\SysWOW64\Hpcodihc.exe

Filesize
128KB

MD5
11436fa467ec8ba68b638ef5d295ad48

SHA1
a072520ed52b6f732eb33a010e59f39a6c325464

SHA256
ad8b5734ae108694beae8b8d6e26f9eb10ef2a1f943f186ed5630d650519dc46

SHA512
bf0e7dbddf315ea31b9e9be0e7b21b38ec8286700db69702d44e54c04d5d8f31f05fbd3c06e7aac1869af2bf1801dd77f690000d03b15440a58c40e7d4415e62

Download Submit
C:\Windows\SysWOW64\Idcepgmg.exe

Filesize
128KB

MD5
a44c5be5c3a25f44ec42e8cf32019274

SHA1
251c16a1f8a0ba525b2e29d90a3f6362f076c2d5

SHA256
1045c4478e8e90e34027658fd591df8d4178c5d3abff50952d8792262ca13eaf

SHA512
ff2173eba49b9b0ef024b52537d01fd4c3d02db9405c921d74fe2cc6b956db7757531a170747a2de412a6c7a6c435ca41d23f03220f891bb948f0056ed083d7c

Download Submit
C:\Windows\SysWOW64\Idcepgmg.exe

Filesize
128KB

MD5
a44c5be5c3a25f44ec42e8cf32019274

SHA1
251c16a1f8a0ba525b2e29d90a3f6362f076c2d5

SHA256
1045c4478e8e90e34027658fd591df8d4178c5d3abff50952d8792262ca13eaf

SHA512
ff2173eba49b9b0ef024b52537d01fd4c3d02db9405c921d74fe2cc6b956db7757531a170747a2de412a6c7a6c435ca41d23f03220f891bb948f0056ed083d7c

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
128KB

MD5
ca7bb11cab462791b4b02e8cb379ec29

SHA1
b9d06b714e40787d1d9a3dbb68580684b92cb9a7

SHA256
30cd5ad7ab41a405eb40b8196dcee4a1c6291bfd52c8402fca50868ade614798

SHA512
6c01495363ab3f18f41568a9c9a58f73cd1d54c83d31452a822097cb8ed23765c1e6a8a371fde9960453b03ea5ba15b014e7163083396a5fc19914b20645b433

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
128KB

MD5
ca7bb11cab462791b4b02e8cb379ec29

SHA1
b9d06b714e40787d1d9a3dbb68580684b92cb9a7

SHA256
30cd5ad7ab41a405eb40b8196dcee4a1c6291bfd52c8402fca50868ade614798

SHA512
6c01495363ab3f18f41568a9c9a58f73cd1d54c83d31452a822097cb8ed23765c1e6a8a371fde9960453b03ea5ba15b014e7163083396a5fc19914b20645b433

Download Submit
C:\Windows\SysWOW64\Iknmla32.exe

Filesize
128KB

MD5
9c34697996ee9c9f8b8720131e4603f6

SHA1
e353de6f45bed78a3558404054c3527e13340aa1

SHA256
dc58ff2ce6ae39c6658a4471985ab889e756c2fcbf2834a67179a0d14bb7ae31

SHA512
d2b107e2b22fbc04a540c03faf7091c2d18277c6461ddc1affa6c5c5b1141a6ae0a7c59bcc1e4479ee9be308a83b44bb98114168274adf6335b4eb019f8fa752

Download Submit
C:\Windows\SysWOW64\Iknmla32.exe

Filesize
128KB

MD5
9c34697996ee9c9f8b8720131e4603f6

SHA1
e353de6f45bed78a3558404054c3527e13340aa1

SHA256
dc58ff2ce6ae39c6658a4471985ab889e756c2fcbf2834a67179a0d14bb7ae31

SHA512
d2b107e2b22fbc04a540c03faf7091c2d18277c6461ddc1affa6c5c5b1141a6ae0a7c59bcc1e4479ee9be308a83b44bb98114168274adf6335b4eb019f8fa752

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
128KB

MD5
105e14dc478fa8fb4bc9eadd1dd06de5

SHA1
b284b6a05ac80033f488c609d2b8ac32a1571356

SHA256
fb02b5a781217e0b2b9ed270cfb5d99ef9765c564ff1c7e59fce5e49ce2d81c7

SHA512
99bfa67e4f8bd6cb60da0ab44cdcf739c72e831f6bfc0f9ce6c82f122c2290e37a26d06c115f4b053213723d7c271c30bb516cc7019ada0a306181158f99693e

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
128KB

MD5
105e14dc478fa8fb4bc9eadd1dd06de5

SHA1
b284b6a05ac80033f488c609d2b8ac32a1571356

SHA256
fb02b5a781217e0b2b9ed270cfb5d99ef9765c564ff1c7e59fce5e49ce2d81c7

SHA512
99bfa67e4f8bd6cb60da0ab44cdcf739c72e831f6bfc0f9ce6c82f122c2290e37a26d06c115f4b053213723d7c271c30bb516cc7019ada0a306181158f99693e

Download Submit
C:\Windows\SysWOW64\Iloidijb.exe

Filesize
128KB

MD5
b5c840c2546c1966921b7ae073bed488

SHA1
7788634fd71eeb989c7596fe83b97b342faac6ec

SHA256
a73d81b868ced71cbddc877d8616f4006a6f77f0a74febf338eaa2ad5849eb34

SHA512
f76a97be97ab917c2ff31aabeeb00ed0194a025929566c477b22cb34306f8729cfc159deee5a3b64d926c08dfc9bad5f64b6420409e86b646cf3f1e03a5d0413

Download Submit
C:\Windows\SysWOW64\Iloidijb.exe

Filesize
128KB

MD5
b5c840c2546c1966921b7ae073bed488

SHA1
7788634fd71eeb989c7596fe83b97b342faac6ec

SHA256
a73d81b868ced71cbddc877d8616f4006a6f77f0a74febf338eaa2ad5849eb34

SHA512
f76a97be97ab917c2ff31aabeeb00ed0194a025929566c477b22cb34306f8729cfc159deee5a3b64d926c08dfc9bad5f64b6420409e86b646cf3f1e03a5d0413

Download Submit
C:\Windows\SysWOW64\Injmcmej.exe

Filesize
128KB

MD5
bd614ab59ca71fdf43c11d65759648c8

SHA1
0f3bf756e9d8c1fdc3db435bf715dac669425d90

SHA256
9583ce91a3e4daa35efe276fdff890936508adb62ab5e23a67e11bbef26f985b

SHA512
ab52b5acc335e460cbc59dda56960d35ca1da7278d494ed38298f28de4c59bf56d9b646560ff1999d57dab4ba8fb8ba4b7a80d9908adf5a21808b0f4025fdbf6

Download Submit
C:\Windows\SysWOW64\Injmcmej.exe

Filesize
128KB

MD5
bd614ab59ca71fdf43c11d65759648c8

SHA1
0f3bf756e9d8c1fdc3db435bf715dac669425d90

SHA256
9583ce91a3e4daa35efe276fdff890936508adb62ab5e23a67e11bbef26f985b

SHA512
ab52b5acc335e460cbc59dda56960d35ca1da7278d494ed38298f28de4c59bf56d9b646560ff1999d57dab4ba8fb8ba4b7a80d9908adf5a21808b0f4025fdbf6

Download Submit
C:\Windows\SysWOW64\Innfnl32.exe

Filesize
128KB

MD5
e4f6c9b88d04441787310301a672bcaa

SHA1
ab6e124cfb36f7dc8191133f5d49b68405760ec0

SHA256
fe4b2d29602ab53d503f9cbd0121b22971f662d6046af72ba39f69a3abb81679

SHA512
ad6d148e888d2e220cf8fd7d465bdc64f0394edfe980f074585faaab2d8e7bbedf07d0ac605228c7ff9ed5f0d13fb27262b088754cb66d939fdd17b60c817f61

Download Submit
C:\Windows\SysWOW64\Innfnl32.exe

Filesize
128KB

MD5
e4f6c9b88d04441787310301a672bcaa

SHA1
ab6e124cfb36f7dc8191133f5d49b68405760ec0

SHA256
fe4b2d29602ab53d503f9cbd0121b22971f662d6046af72ba39f69a3abb81679

SHA512
ad6d148e888d2e220cf8fd7d465bdc64f0394edfe980f074585faaab2d8e7bbedf07d0ac605228c7ff9ed5f0d13fb27262b088754cb66d939fdd17b60c817f61

Download Submit
C:\Windows\SysWOW64\Inqbclob.exe

Filesize
128KB

MD5
5b83d48fcda2a37560b37e6e82ba9a69

SHA1
d27361ffb84226d1fb15c4ab91ca5272c6ec60f5

SHA256
5544ad3631916f2f4e255d64a8d67938e54310f0b98fbc67ddaedc4ad3936064

SHA512
c7e49fd2d612b701803220200324292aeeb6523069cf867dc269f8492191561e0e21a71f2553ca501318508661eb4ca6ad8e07f19811a5ecbb3735a49e4b0ee8

Download Submit
C:\Windows\SysWOW64\Inqbclob.exe

Filesize
128KB

MD5
5b83d48fcda2a37560b37e6e82ba9a69

SHA1
d27361ffb84226d1fb15c4ab91ca5272c6ec60f5

SHA256
5544ad3631916f2f4e255d64a8d67938e54310f0b98fbc67ddaedc4ad3936064

SHA512
c7e49fd2d612b701803220200324292aeeb6523069cf867dc269f8492191561e0e21a71f2553ca501318508661eb4ca6ad8e07f19811a5ecbb3735a49e4b0ee8

Download Submit
C:\Windows\SysWOW64\Jcfggkac.exe

Filesize
128KB

MD5
589fcc62ae76eb97661e169f56b54ca6

SHA1
e1a133349b03b22b64af8893dc317f817b75719d

SHA256
2d2e623f2ccb7097a62d9b4c1e5c6d8fc197278b5caeca1339cbb4aa2428033f

SHA512
83da995da08e1407ca0d9a0e59bf35a42f8a37a4f48ec78de5eb1b8d0ea7be4dbc53f46c979781bc16d6d7a127f9250cf9022d33d97d38bf8099c57e58e44d40

Download Submit
C:\Windows\SysWOW64\Jdfjld32.exe

Filesize
128KB

MD5
2290c546b723ca11ccf8a0d7be3e1512

SHA1
8adbae151ab706a0b1ae46a479e0d12e19c4bc65

SHA256
28e0f66529db56526e04dc472f50511d863e616f464a7aff2add07a0f3875ace

SHA512
b6e42f9e1b6fddd245a49547c7c1c71d0ee3eb0d3c775d75b2350d174623a1bb882df901f03b39b89b9b41f2828e1a8a3518ce5a8f542b9cbf9212022673129e

Download Submit
C:\Windows\SysWOW64\Jdfjld32.exe

Filesize
128KB

MD5
2290c546b723ca11ccf8a0d7be3e1512

SHA1
8adbae151ab706a0b1ae46a479e0d12e19c4bc65

SHA256
28e0f66529db56526e04dc472f50511d863e616f464a7aff2add07a0f3875ace

SHA512
b6e42f9e1b6fddd245a49547c7c1c71d0ee3eb0d3c775d75b2350d174623a1bb882df901f03b39b89b9b41f2828e1a8a3518ce5a8f542b9cbf9212022673129e

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
128KB

MD5
e01863da3149c4bad0e00d5b33b54a36

SHA1
a4bb19be9440fc84e7d29100bb7b68d8fa768cf0

SHA256
f1c1f007a646bcc60560c7c1eac38e653901e7c0b0299ef58f0d0350dcdee1b6

SHA512
5d74cab56b3c84e4912db3da6c55f798f2c258b404c6189147db7dee7077e9964be1fed9bd767e1a62962ac128df6137be86eb3f03948329ca6b4a269737ad81

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
128KB

MD5
e01863da3149c4bad0e00d5b33b54a36

SHA1
a4bb19be9440fc84e7d29100bb7b68d8fa768cf0

SHA256
f1c1f007a646bcc60560c7c1eac38e653901e7c0b0299ef58f0d0350dcdee1b6

SHA512
5d74cab56b3c84e4912db3da6c55f798f2c258b404c6189147db7dee7077e9964be1fed9bd767e1a62962ac128df6137be86eb3f03948329ca6b4a269737ad81

Download Submit
C:\Windows\SysWOW64\Kcndbp32.exe

Filesize
128KB

MD5
de0210987831ce711e8a779a95b20621

SHA1
202b1fcdc7c200162e987888e67ce7e5e06b7ea6

SHA256
2f88de84fd4f77f8890ce04b423a3d7650c1f30a6d5a48204d9630a55be24b9e

SHA512
0a6cd1260d689adfe0037648ab6396106b307936465ead4fe6034d9d1c91b503e567afcd203e9a9a7ccf8d81247e7eae4b9c2ffc02fb4ad7d731df3fec55354e

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
128KB

MD5
2325f4a54ddf506d044605f8cfd1b5da

SHA1
0b49f0eef5a804eb1bf5a9db14e86aee928f39d2

SHA256
e603fb356124d5697e6f395813e4e2ce75858a3196f84c07d0156bcd77d79bec

SHA512
a97d94b436154e47aec84d2e55209f29f50b4e5f1aec585a934e2b55b755b05bc4909165b5ff907474adbcb680adb2433242fadebb1e8599defd389e8db9c63c

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
128KB

MD5
2325f4a54ddf506d044605f8cfd1b5da

SHA1
0b49f0eef5a804eb1bf5a9db14e86aee928f39d2

SHA256
e603fb356124d5697e6f395813e4e2ce75858a3196f84c07d0156bcd77d79bec

SHA512
a97d94b436154e47aec84d2e55209f29f50b4e5f1aec585a934e2b55b755b05bc4909165b5ff907474adbcb680adb2433242fadebb1e8599defd389e8db9c63c

Download Submit
C:\Windows\SysWOW64\Kmaopfjm.exe

Filesize
128KB

MD5
2a8d5d0a5d7b8aa70ee5e2cb48e7c14c

SHA1
6ba06ff65173280468fa4e47fd0528cb83bc0e7b

SHA256
2125af8d93cecddbeeb298a2845a8808027d2e7205555ca3284082fa80238429

SHA512
7f59e3c3ec8270c3168639ca32e7bb292e4f803a7446b676987038c74f71931c88a6181d0811a0ce98dab4206a15147a63e54bdf43d941fa32e968334ab55b23

Download Submit
C:\Windows\SysWOW64\Kmaopfjm.exe

Filesize
128KB

MD5
2a8d5d0a5d7b8aa70ee5e2cb48e7c14c

SHA1
6ba06ff65173280468fa4e47fd0528cb83bc0e7b

SHA256
2125af8d93cecddbeeb298a2845a8808027d2e7205555ca3284082fa80238429

SHA512
7f59e3c3ec8270c3168639ca32e7bb292e4f803a7446b676987038c74f71931c88a6181d0811a0ce98dab4206a15147a63e54bdf43d941fa32e968334ab55b23

Download Submit
C:\Windows\SysWOW64\Knalji32.exe

Filesize
128KB

MD5
ca781bedc30641b2319cc8d487e81e40

SHA1
a84f0caf9e95e89bafeabb3cfa5782676d23c78a

SHA256
419f55f7fd43b705270d562c9491575dcf2f0d02b94c39b1c06500c31e236aba

SHA512
d0a14cd63497f29c5b99f44c9cbe4f45ee44f97786cb0ba582292d67e87619fd33a47b80f6e887ae5aef18e5a295fc2f643c8201ad65087113d6ee349e05369b

Download Submit
C:\Windows\SysWOW64\Knalji32.exe

Filesize
128KB

MD5
ca781bedc30641b2319cc8d487e81e40

SHA1
a84f0caf9e95e89bafeabb3cfa5782676d23c78a

SHA256
419f55f7fd43b705270d562c9491575dcf2f0d02b94c39b1c06500c31e236aba

SHA512
d0a14cd63497f29c5b99f44c9cbe4f45ee44f97786cb0ba582292d67e87619fd33a47b80f6e887ae5aef18e5a295fc2f643c8201ad65087113d6ee349e05369b

Download Submit
C:\Windows\SysWOW64\Kqdaadln.exe

Filesize
128KB

MD5
7fa8720c2c41a134ac560ff93426948c

SHA1
a83c71cd7c232c78b5b1edb85146cd2bc7751f30

SHA256
794dc9914685e38b72077d50e9a433a8af0d93083b7d8ee0439dd88e85fe5ffa

SHA512
273e1c334d7d4127ff8b88071906f53ba4279345a0b6406e0f17970641603d7fa4df5e9cf66eb3082d9bdff550f1621fb63e3dbf6e8dad3804a3e5c4011776ea

Download Submit
C:\Windows\SysWOW64\Kqdaadln.exe

Filesize
128KB

MD5
7fa8720c2c41a134ac560ff93426948c

SHA1
a83c71cd7c232c78b5b1edb85146cd2bc7751f30

SHA256
794dc9914685e38b72077d50e9a433a8af0d93083b7d8ee0439dd88e85fe5ffa

SHA512
273e1c334d7d4127ff8b88071906f53ba4279345a0b6406e0f17970641603d7fa4df5e9cf66eb3082d9bdff550f1621fb63e3dbf6e8dad3804a3e5c4011776ea

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
128KB

MD5
925c54eb4a7d3df03ae2669f3b4a824b

SHA1
b7380e2935c0c4d71da215ade5fc10ac31a7a7e9

SHA256
a54eb7375c639b34a8a74580ea8824cb30b11fff2b88d07d94b6d65e4a828f75

SHA512
d67909d86d3d780b6b1ee59fed8cf2b39ae05bb4e1b34c4b4d3196f96b6ee2b5bae223a4249bf28aecca469be77eae6ff2a59b50d77ea1a7d2ed56fc9b68efa9

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
128KB

MD5
925c54eb4a7d3df03ae2669f3b4a824b

SHA1
b7380e2935c0c4d71da215ade5fc10ac31a7a7e9

SHA256
a54eb7375c639b34a8a74580ea8824cb30b11fff2b88d07d94b6d65e4a828f75

SHA512
d67909d86d3d780b6b1ee59fed8cf2b39ae05bb4e1b34c4b4d3196f96b6ee2b5bae223a4249bf28aecca469be77eae6ff2a59b50d77ea1a7d2ed56fc9b68efa9

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
128KB

MD5
d090a1e70c01b441b78722e10b19745d

SHA1
656ab423d13cb19f91d343d25318975fe4de8f39

SHA256
3033b8926ed3094068146ea2fafc6fc0b29f07ffc30b541df546cac2f891f818

SHA512
6049ddab8bb1848c0c8a335fb51cd2f115c5e7da6da55f4225fe85dd9bf1a29daa37d9fbe03da76c8afdf7cecb6422db13eade09a9873403bdc7e04ce29c3140

Download Submit
C:\Windows\SysWOW64\Lqmmmmph.exe

Filesize
128KB

MD5
e3e21ff92b2ea778098e0569777c83ac

SHA1
2bb415910d5b3fa51cebd7d63ad291a137c8e47d

SHA256
087ff2c9a8580ba0488759e69127837b87f1035ad10150b8203b9b37369214ec

SHA512
950af7e66cd6f1fcad440c7a040ff9becdb8b14de486f85c151a667273c75628ef45f78b6ea5b70295d72567513d3db48b33af80fde1cec72ad99a793c884196

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
128KB

MD5
78956b064fca9cf42416786e4b34d195

SHA1
e94fbab7a86becaeae86160935d3cf3ca26d6eae

SHA256
2d6e57f9cc912cb3ac8f235e1ec3e1545b7c7e28987ca0bc8114bfb35ede4596

SHA512
a1e90e3c62448af49fa47fc99ded509da07151c14dbe8ba6956b95b4d080378806074d8cd38ea8364cfbf632eea474a969f2ce346bef2afcb869c1f397b6a729

Download Submit
C:\Windows\SysWOW64\Ohhnbhok.exe

Filesize
128KB

MD5
e369fcdb49e4ce61c342dabbeef9b969

SHA1
a97306a70fdcfe4ad540214126c855cc177a271c

SHA256
ea6167ba21a6befb0ef3c107b3710628c39f9a22a33c72321c834a89c483d249

SHA512
aeb099725d7b8643a1992a2201ce9b5c3bfde33e97ca4d5a3294d51e9ce2946a364bff7d1e03db67a09f7cb7ee23701c2318014f5ef9873610b1f3cf40eb241e

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
128KB

MD5
f2107d226ab8d8301ae8f864682949a0

SHA1
faec8fb31229cf5b822c68af6d4f52a8e43cace4

SHA256
ce23dbfb0228b20fd540dbc39f0071e72b6ce9ca16eeb51288604f46cbfb08b0

SHA512
0f12338149155dd9fe3aa037d10ed8ebbf4a9247c936490aea66ddafb1c55c5b8f8459a8d743d6b49ce5d0c33f4d7e7aee10c9a75cbd7a4a4931e0ba543cdb75

Download Submit
memory/208-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/228-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/336-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/564-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/692-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/900-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-191-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2144-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2656-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2804-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3120-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3184-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3240-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3528-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3708-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3828-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3896-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4608-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6252-1483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6356-1482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6584-1493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6648-1472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6676-1492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6732-1491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6792-1490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6820-1471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6844-1478-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6852-1489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6924-1488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6936-1477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6972-1487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6976-1470-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7048-1486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7112-1485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads