388495b6b0227395e714e6a54dc60747068ba5a637f70b590a007ae5a5d022f2

Analysis

max time kernel
137s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe
Size

390KB
MD5

cb64c36ae3b7962877b3dca72d4bc680
SHA1

6afbead59663d8d3f2f822812eb20ca76b5419de
SHA256

388495b6b0227395e714e6a54dc60747068ba5a637f70b590a007ae5a5d022f2
SHA512

18edf00ec55f087db195c62b2ffef636acc281d0d93c02652a329758b0d8deaf8d9d0cc95bf89ff4cb082e7290cf1240c221e97bca60b4b815b009a132671fc5
SSDEEP

6144:ibX7PN1hCw66b+X0RjtdgOPAUvgkNRgdgOPAUvgkG:ib7FMUngEiM2gEif

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhgjblfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbnpqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kepelfam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odbgim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajneip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjmlbbdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgemphmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe

Executes dropped EXE 64 IoCs

pid	Process
4608	Kaemnhla.exe
2064	Kipabjil.exe
1228	Kagichjo.exe
1264	Kcifkp32.exe
3472	Kgfoan32.exe
2624	Lgikfn32.exe
3740	Lkdggmlj.exe
2524	Ldmlpbbj.exe
2084	Lpcmec32.exe
4572	Lnhmng32.exe
4188	Lgpagm32.exe
4752	Lphfpbdi.exe
1020	Lgbnmm32.exe
1920	Mpkbebbf.exe
4848	Mjcgohig.exe
1892	Majopeii.exe
3940	Mkbchk32.exe
4964	Mjeddggd.exe
4568	Mpolqa32.exe
1508	Mnfipekh.exe
1940	Mdpalp32.exe
2432	Nqfbaq32.exe
4576	Ndbnboqb.exe
1964	Nqiogp32.exe
4952	Nkncdifl.exe
1536	Nbhkac32.exe
4068	Nnolfdcn.exe
3936	Nnaikd32.exe
3808	Nqpego32.exe
2672	Ogjmdigk.exe
3956	Odnnnnfe.exe
2456	Ogljjiei.exe
1500	Onfbfc32.exe
932	Onholckc.exe
8	Odbgim32.exe
2080	Ogaceh32.exe
4436	Ojopad32.exe
2452	Onklabip.exe
4868	Ocgdji32.exe
2652	Ogcpjhoq.exe
4396	Ojalgcnd.exe
3200	Obidhaog.exe
884	Pgemphmn.exe
4684	Pjdilcla.exe
2304	Pclneicb.exe
4584	Pkceffcd.exe
1244	Pnbbbabh.exe
2888	Pqpnombl.exe
2424	Pcojkhap.exe
2020	Pkfblfab.exe
3636	Pabkdmpi.exe
4596	Pcagphom.exe
4440	Pnfkma32.exe
4364	Pbbgnpgl.exe
812	Pcccfh32.exe
4724	Pjmlbbdg.exe
3696	Pnihcq32.exe
3652	Qecppkdm.exe
1196	Qgallfcq.exe
2244	Qnkdhpjn.exe
2800	Qbgqio32.exe
2896	Qchmagie.exe
1640	Qloebdig.exe
2572	Qjbena32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ncdgcf32.exe	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Pipagf32.dll	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Gmoeoidl.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Iicbehnq.exe	Ibjjhn32.exe
File opened for modification	C:\Windows\SysWOW64\Bdolhc32.exe	Bbnpqk32.exe
File created	C:\Windows\SysWOW64\Gfbploob.exe	Gcddpdpo.exe
File created	C:\Windows\SysWOW64\Hmcojh32.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Ifllil32.exe	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Nqpego32.exe	Nnaikd32.exe
File created	C:\Windows\SysWOW64\Qgphkcho.dll	Ogaceh32.exe
File created	C:\Windows\SysWOW64\Fkmchi32.exe	Ehnglm32.exe
File created	C:\Windows\SysWOW64\Paadbk32.dll	Fdialn32.exe
File created	C:\Windows\SysWOW64\Qfbgbeai.dll	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Cddecc32.exe	Cliaoq32.exe
File created	C:\Windows\SysWOW64\Gogiek32.dll	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Onjegled.exe
File created	C:\Windows\SysWOW64\Cilkoi32.dll	Cacmah32.exe
File created	C:\Windows\SysWOW64\Cdiooblp.exe	Cajcbgml.exe
File created	C:\Windows\SysWOW64\Lepncd32.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Eckgieoo.dll	Dojcgi32.exe
File opened for modification	C:\Windows\SysWOW64\Eekaebcm.exe	Ecmeig32.exe
File opened for modification	C:\Windows\SysWOW64\Hbgmcnhf.exe	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Ikbnacmd.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Kibgmdcn.exe	Kpjcdn32.exe
File opened for modification	C:\Windows\SysWOW64\Ibjjhn32.exe	Icgjmapi.exe
File created	C:\Windows\SysWOW64\Fibbmq32.dll	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kaemnhla.exe
File opened for modification	C:\Windows\SysWOW64\Aanjpk32.exe	Anpncp32.exe
File created	C:\Windows\SysWOW64\Demecd32.exe	Docmgjhp.exe
File created	C:\Windows\SysWOW64\Lgmlbfod.dll	Fhcpgmjf.exe
File opened for modification	C:\Windows\SysWOW64\Mckemg32.exe	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Pnakhkol.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Fhglla32.dll	Eamhodmf.exe
File created	C:\Windows\SysWOW64\Clhkicgk.dll	Gfpcgpae.exe
File created	C:\Windows\SysWOW64\Hekcnknf.dll	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Dllfkn32.exe	Dhpjkojk.exe
File opened for modification	C:\Windows\SysWOW64\Dedkdcie.exe	Dceohhja.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jimekgff.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Nqpego32.exe	Nnaikd32.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Ekcpbj32.exe	Ehedfo32.exe
File opened for modification	C:\Windows\SysWOW64\Ekcpbj32.exe	Ehedfo32.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kiidgeki.exe
File opened for modification	C:\Windows\SysWOW64\Lbjlfi32.exe	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Pnnaog32.dll	Ojopad32.exe
File created	C:\Windows\SysWOW64\Pgemphmn.exe	Obidhaog.exe
File created	C:\Windows\SysWOW64\Nnambi32.dll	Dccbbhld.exe
File opened for modification	C:\Windows\SysWOW64\Clkndpag.exe	Cddecc32.exe
File opened for modification	C:\Windows\SysWOW64\Dkjmlk32.exe	Ddpeoafg.exe
File created	C:\Windows\SysWOW64\Najmlf32.dll	Oponmilc.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Ojjolnaq.exe
File opened for modification	C:\Windows\SysWOW64\Dojcgi32.exe	Dllfkn32.exe
File created	C:\Windows\SysWOW64\Aaqfok32.dll	Ifllil32.exe
File created	C:\Windows\SysWOW64\Lbjlfi32.exe	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Gblngpbd.exe	Gomakdcp.exe
File created	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hecmijim.exe
File created	C:\Windows\SysWOW64\Ikpaldog.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Eikdngcl.dll	Kepelfam.exe
File created	C:\Windows\SysWOW64\Ocpgod32.exe	Opakbi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9240	8632	WerFault.exe	420

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eofbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naoncahj.dll"	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmldgi32.dll"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogljjiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjgia32.dll"	Aegikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beeflhdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfifmnij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojopad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbljp32.dll"	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogljjiei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcddpdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjegoh32.dll"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccgldidg.dll"	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbgmcnhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clkndpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplcdidf.dll"	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhilj32.dll"	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcaee32.dll"	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaddm32.dll"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hekcnknf.dll"	Pjmlbbdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pnfkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdialn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cilkoi32.dll"	Cacmah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njkoaebi.dll"	Odbgim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fafkecel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hecmijim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjdgcbkb.dll"	Blmacb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdjlic32.dll"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjihje32.dll"	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gcagkdba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iifokh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4608	1200	cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe	84
PID 1200 wrote to memory of 4608	1200	cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe	84
PID 1200 wrote to memory of 4608	1200	cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe	84
PID 4608 wrote to memory of 2064	4608	Kaemnhla.exe	85
PID 4608 wrote to memory of 2064	4608	Kaemnhla.exe	85
PID 4608 wrote to memory of 2064	4608	Kaemnhla.exe	85
PID 2064 wrote to memory of 1228	2064	Kipabjil.exe	86
PID 2064 wrote to memory of 1228	2064	Kipabjil.exe	86
PID 2064 wrote to memory of 1228	2064	Kipabjil.exe	86
PID 1228 wrote to memory of 1264	1228	Kagichjo.exe	87
PID 1228 wrote to memory of 1264	1228	Kagichjo.exe	87
PID 1228 wrote to memory of 1264	1228	Kagichjo.exe	87
PID 1264 wrote to memory of 3472	1264	Kcifkp32.exe	88
PID 1264 wrote to memory of 3472	1264	Kcifkp32.exe	88
PID 1264 wrote to memory of 3472	1264	Kcifkp32.exe	88
PID 3472 wrote to memory of 2624	3472	Kgfoan32.exe	89
PID 3472 wrote to memory of 2624	3472	Kgfoan32.exe	89
PID 3472 wrote to memory of 2624	3472	Kgfoan32.exe	89
PID 2624 wrote to memory of 3740	2624	Lgikfn32.exe	90
PID 2624 wrote to memory of 3740	2624	Lgikfn32.exe	90
PID 2624 wrote to memory of 3740	2624	Lgikfn32.exe	90
PID 3740 wrote to memory of 2524	3740	Lkdggmlj.exe	91
PID 3740 wrote to memory of 2524	3740	Lkdggmlj.exe	91
PID 3740 wrote to memory of 2524	3740	Lkdggmlj.exe	91
PID 2524 wrote to memory of 2084	2524	Ldmlpbbj.exe	92
PID 2524 wrote to memory of 2084	2524	Ldmlpbbj.exe	92
PID 2524 wrote to memory of 2084	2524	Ldmlpbbj.exe	92
PID 2084 wrote to memory of 4572	2084	Lpcmec32.exe	94
PID 2084 wrote to memory of 4572	2084	Lpcmec32.exe	94
PID 2084 wrote to memory of 4572	2084	Lpcmec32.exe	94
PID 4572 wrote to memory of 4188	4572	Lnhmng32.exe	95
PID 4572 wrote to memory of 4188	4572	Lnhmng32.exe	95
PID 4572 wrote to memory of 4188	4572	Lnhmng32.exe	95
PID 4188 wrote to memory of 4752	4188	Lgpagm32.exe	96
PID 4188 wrote to memory of 4752	4188	Lgpagm32.exe	96
PID 4188 wrote to memory of 4752	4188	Lgpagm32.exe	96
PID 4752 wrote to memory of 1020	4752	Lphfpbdi.exe	97
PID 4752 wrote to memory of 1020	4752	Lphfpbdi.exe	97
PID 4752 wrote to memory of 1020	4752	Lphfpbdi.exe	97
PID 1020 wrote to memory of 1920	1020	Lgbnmm32.exe	99
PID 1020 wrote to memory of 1920	1020	Lgbnmm32.exe	99
PID 1020 wrote to memory of 1920	1020	Lgbnmm32.exe	99
PID 1920 wrote to memory of 4848	1920	Mpkbebbf.exe	100
PID 1920 wrote to memory of 4848	1920	Mpkbebbf.exe	100
PID 1920 wrote to memory of 4848	1920	Mpkbebbf.exe	100
PID 4848 wrote to memory of 1892	4848	Mjcgohig.exe	101
PID 4848 wrote to memory of 1892	4848	Mjcgohig.exe	101
PID 4848 wrote to memory of 1892	4848	Mjcgohig.exe	101
PID 1892 wrote to memory of 3940	1892	Majopeii.exe	102
PID 1892 wrote to memory of 3940	1892	Majopeii.exe	102
PID 1892 wrote to memory of 3940	1892	Majopeii.exe	102
PID 3940 wrote to memory of 4964	3940	Mkbchk32.exe	103
PID 3940 wrote to memory of 4964	3940	Mkbchk32.exe	103
PID 3940 wrote to memory of 4964	3940	Mkbchk32.exe	103
PID 4964 wrote to memory of 4568	4964	Mjeddggd.exe	104
PID 4964 wrote to memory of 4568	4964	Mjeddggd.exe	104
PID 4964 wrote to memory of 4568	4964	Mjeddggd.exe	104
PID 4568 wrote to memory of 1508	4568	Mpolqa32.exe	106
PID 4568 wrote to memory of 1508	4568	Mpolqa32.exe	106
PID 4568 wrote to memory of 1508	4568	Mpolqa32.exe	106
PID 1508 wrote to memory of 1940	1508	Mnfipekh.exe	107
PID 1508 wrote to memory of 1940	1508	Mnfipekh.exe	107
PID 1508 wrote to memory of 1940	1508	Mnfipekh.exe	107
PID 1940 wrote to memory of 2432	1940	Mdpalp32.exe	108

C:\Users\Admin\AppData\Local\Temp\cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\cb64c36ae3b7962877b3dca72d4bc680_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\Kaemnhla.exe
  C:\Windows\system32\Kaemnhla.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\Kipabjil.exe
    C:\Windows\system32\Kipabjil.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\Kagichjo.exe
      C:\Windows\system32\Kagichjo.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1264
      - C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        24⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        25⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        27⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        28⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        30⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        32⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        34⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        35⤵
        Executes dropped EXE
        
        PID:932
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        39⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        40⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        41⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        42⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3200
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        45⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        46⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        48⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        51⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        52⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        53⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        56⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        58⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        59⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        60⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        61⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        62⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        64⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        65⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        66⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        68⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        69⤵
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1340
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        71⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        72⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        73⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        74⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4224
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        76⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1528
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        78⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        81⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        82⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        83⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        84⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        85⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        87⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        89⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        92⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        93⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        94⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        96⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        97⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        98⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        99⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        101⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        102⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        103⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        104⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        106⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        107⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        108⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        109⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        110⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        111⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        114⤵
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        115⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        116⤵
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        117⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        118⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        119⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        122⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        123⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        125⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        127⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        128⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        129⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        130⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        131⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        132⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        135⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        136⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        139⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        140⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        141⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        142⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        143⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        144⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        145⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        146⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        150⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        152⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        153⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        154⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        155⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        156⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        157⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        158⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        160⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        161⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        162⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        164⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        165⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        166⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        167⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        168⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        170⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        172⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        173⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        174⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        175⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        176⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        177⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        179⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        181⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        182⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        183⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        184⤵
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        186⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        188⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        190⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        191⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        192⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        193⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        194⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        195⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        198⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        199⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        200⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        201⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        202⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        203⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        204⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        205⤵
        Modifies registry class
        
        PID:7716
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        206⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        208⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        209⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        210⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        211⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        213⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        214⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        215⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8160
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        217⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        218⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        219⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        220⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        221⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        222⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        223⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7628
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        226⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        228⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        229⤵
        Drops file in System32 directory
        
        PID:1764
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        231⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        233⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8044
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        235⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        237⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        238⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        239⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        240⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        241⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        242⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        243⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        244⤵
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        245⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        246⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        247⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        249⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        250⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        251⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        252⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        253⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        254⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7844
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        256⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        257⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        258⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        259⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        261⤵
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        262⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        263⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        264⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8568
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        267⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        268⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        270⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        271⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        272⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        273⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        275⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        276⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        279⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        280⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        282⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        283⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        284⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        285⤵
        Drops file in System32 directory
        
        PID:8220
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        286⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        287⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        288⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        289⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        290⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        291⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8720
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        294⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        296⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        297⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        298⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        299⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        300⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        301⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5000
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2448
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        305⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        306⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        307⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        308⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        309⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        310⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        312⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        313⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        314⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        315⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        316⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8788
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        318⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        319⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        321⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        323⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        324⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        325⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 232
        326⤵
        Program crash
        
        PID:9240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8632 -ip 8632
1⤵
PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
390KB

MD5
a4c27cc6f019f8a0026622104d63ec27

SHA1
450340a17fc84ea024b2182e36df66b57d19c7ca

SHA256
9b4c652f379e3e4ffccc6b0cf14c1e74e4c2fc6525c2daeee460c7065ac30cd9

SHA512
d8ba62fca924ea8a415958ca0742123c97faa92c15eb243cddb57cf96360b0d85e4e6aa29a80de032864f26b1de87fb86e604ed662a609ae7152ee2aac21e906

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
390KB

MD5
517eba399897f0d56d511409d6103525

SHA1
57dd1eb1e8465bc72744921e30daa60573d9f810

SHA256
a287542e22d24b4b8874d37ee9b0e0f2c722036158d4e29387ffb1513d73ed65

SHA512
e15cd958c7660d8f1f7240fdcfb93d8bdc458eefa573df7789c53085c0b30f723a91b132b3e06af8ab1729692a378fc727fb5fc9857076c95fd8ce804546fc04

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
390KB

MD5
d4aaeb12cab74accbac298dda3142cfd

SHA1
55e5add47cd202df6a9657858d5ac944320f30a3

SHA256
bf83d9b01cdc54736af526d57bb6ccec9aeadbee0b9e4057260f298d9b87c475

SHA512
7aef037891316496868af3b5f63d9eb0ca289c7aa2d4209f3da946c1bb0c049205781a6b725b73e333ba7ec5e197b2772f0372cc13802e4f40616c1a7ee51962

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
390KB

MD5
9809a459320e5e1dcf57929aea5f9f4b

SHA1
bf1b585d3d34535aab285bc963e774097596f174

SHA256
4c611a2793a7e50955694108730e600309acf7b74c193004c7127cbacc3a6701

SHA512
358aa17c8282aa81b7fdb81b959c7232589b2dd747c5832325f11b183c342032b2b77160f38580ce93150f87c327a8f4c81748b42bf6555173b543654f2a0c2f

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
390KB

MD5
7e77d67234cd07dc19d0aa84353c0103

SHA1
50323f01d4b79ef4d46df0cc739cb03aaa100408

SHA256
a3d91dd847029269557bf59f43bd9b97b946bc10a5f6163fe2475bdad4a8bc69

SHA512
f692ef852fcaca9d168475ed28f58406622a67b7416d97765e054dfce77246856e3a12edba0faec1b83809310f44f779d8bb52ba92354dafe1c822be5c09dcd4

Download Submit
C:\Windows\SysWOW64\Bbifelba.exe

Filesize
390KB

MD5
c1dd52f439217f4868af3fdfb72e4358

SHA1
fa9076fb791da491392e58e1ff2be93dfc1d936a

SHA256
9e3085be833a6f183ae1300598c04a81c60c46d31545d39d9e7eb8a790fbce86

SHA512
44e5b3b4c194f294546d44523034534c4b765c773364a730db7571cd9a2642deea57942e804d2bc46b6ba72ea8b4c4577f5e4e340d6abc2ea96d588d8c8c459f

Download Submit
C:\Windows\SysWOW64\Bdkcmdhp.exe

Filesize
390KB

MD5
5534dfe36bce0b2412c959ccdedf41b4

SHA1
0c4d4fe3c6aef8839e677347ab9fe17aa7524dd2

SHA256
9cb1df828290383f2c1da790994749ef062251c325ce5f032ec90b7d123d41bf

SHA512
14ecafc8c7cf90b57db56061e5169574c0819ad90f98a3ef1f624f4bf6e1f5b5c1bb7ad87684e81450b9437d943a2722fcc10390223eb84197df9755ce79fa44

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
390KB

MD5
03cf29f9690796419110343f8807b89d

SHA1
6574a35b26876c82cf1e96bb5d965895b9e20616

SHA256
7dc6d2090660edba987d014f99f6f39bd26d80d6e669563fb6de4c93bdc22fa3

SHA512
4e8d75154696a346e2ffde275328bc104e6d0199a01b41396cb4a6f8372fdeccbc0aa23153f882254e855d5d7587b611c78669e5a083a1f2081bba72e34aee96

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
390KB

MD5
cb53987953f92c288ccd89a6a18308bd

SHA1
46c28faf670c0b8d7fbe6137e9ca3a26103a711a

SHA256
85631112a52892bc7d77d4b40fde4794f07bfe32af0520d2008d07cf07585f1c

SHA512
78ebadbf20bf3d87a80ec87cf732b3e961cac131bc691886c7967b1a041508ec5fac44ae0355b863e36ed0400cec3b11b0b251e5ec6f62d3f2f99107c78b6d87

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
64KB

MD5
edeaeea57781fed0af8332cedfd03bb4

SHA1
4e04548d00cf96845385cf115aacb38ce6fa2c60

SHA256
4e6406f36ec10f64beb51ce88d980aef402534924950ded9a975458f9b6d5e4f

SHA512
ad62b4cdd5ed6e25639a918f41eb2030748c2ae7301365ac0116c4c3b3cd3cbb652db410c03b809cf328a007e32b49d5e3879e48121dc46b4a935d054acf35f0

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
390KB

MD5
a05fd5c68e99b4d8eeede00b2f9f1ed9

SHA1
175d49557409094b3add42692e68050cf4734cce

SHA256
c4f64fc37ddeb3bc029b421344bae5b598ecb37e17baf6c3c380d1abf7150138

SHA512
e1647e63ec0586290b28dd24c8ac61714daabae0ccd85fba510742197ef6d4683a1a1920c62933cecb7a5553b1ed8b676e7822f837d54207119781fa532ca45c

Download Submit
C:\Windows\SysWOW64\Ddpeoafg.exe

Filesize
390KB

MD5
231915f1d9866c87ecb46eb34e3b7b17

SHA1
a728b72675690779604d59d02d83620760179a79

SHA256
db467c7662d1bc407c55ecfb4bf576b1e1effb5ba1d546f5f2c59ba681a430f2

SHA512
539720b25c29400d831c1c253c092fe4bd0bb0225e79088309d1595a27b68a8103ca27711ecd534c4579b131c35c052f0aebe7dc9597f16ee94fd079d0fcb989

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
390KB

MD5
60d7002c2053659eb9d4caeb0665f11e

SHA1
d8dc951c1dd40ae017c2bc3a97225dd103b43257

SHA256
b3a5198d9f7781a815a7c193ed4ed886df073cec72fa57c4966e61d0f0a2f4ea

SHA512
eaa47b339b6c70b08bcfffb58dde75108ca5a765e800e9aa8cab8ea4320dabc5b37745c5e75d4faa904b27b6313aa854f12d36ac91e5e3929022538f690925d8

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
390KB

MD5
5ca3445e3cca68dfcccdf71dad0bccc2

SHA1
ffb2685e4585606c600f3ef66f8e7afcfa44aa58

SHA256
63014b45fb2a75ead9c7d0df730a54cfe2728affdbf64824ec499a1d6fa8a7bc

SHA512
f7b8cc7e0668e65ca19a83f8f970d078ab450c92deb98c4ef690a8e2adb6117216be173433dece74a4d860d93f4853743c275292960dd109878796df08d94353

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
390KB

MD5
ce91177ca56e7b46e05bde75b7bfa5fd

SHA1
92679cea087caa4aef69277942758aba748aa97d

SHA256
75f9eb32e26d19edab565012884d6bbf33e9492ef5fd0b6be6894309f2e65594

SHA512
b660742c652d9a675157040d41f44b0dbd47f0ce1e00e29624905f4c4b8fd3451a128c5467ddc17f02f7d881d01f6e44fdcae4429ade2998add00bd3d479ccb1

Download Submit
C:\Windows\SysWOW64\Fbpnkama.exe

Filesize
390KB

MD5
7833c554d1bca5ab2476a8168fd81348

SHA1
124c6d578e605fc9a8a52101239f0f9633d90618

SHA256
4696567299c8be8b33b6dc7d4d5113e862c71074459827d175113aa942bc7e4a

SHA512
9fde69c7a4f2c9db1796d970c21456ff2d492c1e6d512faf7c7da5f22ba37a8312259bed2ba6dd146ba8a55f1b4802e088b9b63163ce1e9db5585edf6757b635

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
390KB

MD5
cf59f3c6df27e0714e197c48cb1fe415

SHA1
579566107eb7d906ca044b3d14bdbed39d1caa13

SHA256
521a2308d8a3060ec1b4968f58647b0e1282244623c69a40b71089c104df7190

SHA512
2b96fb2085f1a5c2f5337bf32a89cb0bf499c0e2580b58efcce394fb657fe73f93bfaa4cf876259d8d179c07e2c440ddc7fd2584060749c3b043a7ee704cfc42

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
390KB

MD5
c21c59fc4774e6698ba559919fe86343

SHA1
7c7ce317a1b961eea532748556fcac375c0b2977

SHA256
ad4abe18ab332cd458dc9095454686922060e9b91b6eb7c58a9282fa1dfd4e5e

SHA512
46654db230d6ec82151e0fea0a0f337427841f93b2279471e9702243093d6e47e7af4d16b26eee04e546afcdc3f2e66cb013337b90e3b425c8c099bd417cc70a

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
390KB

MD5
a91a1ce34bf7074749a49d4e490d8c4e

SHA1
cfe7e0334c4a1a11eb64d447c105c2038bb7cd0d

SHA256
cf3c5e692fea5343ae23627670d553f2bc0072a0b865a4d11c03a06d5c2d3317

SHA512
a78e74d1ba4854be04c09c589ad6e45f705b7bc19ce2f74b989a920cde289b90ef8ec7a7a98cf27a01c8529d51f77ee3476f81be5f1e6347b5242b04ba4b8cc3

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
390KB

MD5
fab9266ac196d4a15c4efcb6090bf4a9

SHA1
0f5454f55fcadc1c1a72e6826baa14bb6e756eab

SHA256
de8b0a7bcc5dea806184b4b504653d4a4055ac87cb953550248c2856c0f05c8e

SHA512
eca832efa0a4c9d795f639f73a1d214b7aab13a00fb443dd10f301854f3bfa26821650d4a99a6cf3c5e83c2b94cc11d4faea143f4e7b2394656bb63998de2c60

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
390KB

MD5
d94ab4b905edee4545ce3d98c3109056

SHA1
1820b4eb015befd4a143b6496f5e90dc11b71703

SHA256
a3c45961500a95a33b298d3d29b96d194354599498d9c06618b0787a03a88163

SHA512
989512caaf7aaac6d57b47dae98297efa7feb1a00ddbe0d3e59a92a040c426ea9f18564a48dfe7542b1dc5cecdf0eda129886bfe61c26127376beeff58879d79

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
390KB

MD5
8c542fcd5baeee81494bf5e007f644db

SHA1
4403614cade3266fe6a36fd8e01acaabb98fdf39

SHA256
a0766e06dc7cf31262cd00e3c4ee9d1ce2a155035f4fcf01387ce3fd8328d1eb

SHA512
902d8c36bd8f8382618cc249a2641d99dba3cbc440c810727ae29bc47ba62179b1f7f422b7d1d3da597cf254444c77abed8489caa656901c32b493baaef5ae8a

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
390KB

MD5
38188150b349b7a8606f942727b74011

SHA1
0a0f9385afb988f72985afa22f74604bbe15992d

SHA256
f27e80b8e1f46800af6444efefab9db02c8e02e94e80b45abc3d7cf052c3d94a

SHA512
364a5b5522193ab906c5fc1589207ec2f3afff45b41316cf809825f1cea16f01f3dbdc5842eb96a10498e80e806cf8e0738451be4974d8bb51cba13f8e96c0b3

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
390KB

MD5
a969c567250151c072ca69c38e5784a7

SHA1
ca45883d0f53b702f527acc1d54977e2bde84464

SHA256
0d68ea9bf9879b0b60ea6a500a41ba36826a9b22ac8ebcb5ff447940b240163f

SHA512
b893bd3422a59c5bec23a2c28b95bf1d64cc4701c81ec3f10d14fe8c0d30e78c0d98600d5f12942758204d787f95a6660976278e4043929f4913b121be812e0f

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
390KB

MD5
53d4a79685cc257181b40756ced91ba2

SHA1
9761a0de49f8b075da6093f843285e17cf5bf195

SHA256
124ec27086f71fee0890bd983a7a18f96ca894d986591e86b28ad6ae4d77db05

SHA512
0d80968e1b6f121e6f0442ff615f7b60e3d653317c446a287a57301ee6334e1dbfd2ed0a1f9155ddfba9c9c2bc3aa8c29822726a5de739d982377a486c745614

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
390KB

MD5
1742ad469067848d251d0d41a1730e6c

SHA1
e3b331b486207db8ecec96bc9747d62fe3ec94e9

SHA256
67f6ed1719ae725e269d9787a06a6c5cab0688b5235d3a45bcfd1462bb0cb4e3

SHA512
03548284851db5ef4e2587365b9205c61380907fc913276bd099404466f04ea9a1d0e9ffee37ddb1ab98eaebc0a3fd3f69dcfefab45ca3920dbf78883934b2d4

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
390KB

MD5
0b13a987f9eebf20ff2799b721a8b6ab

SHA1
bceb998a960a1df395746854cff05fda52e20e61

SHA256
f4d1315da9f19d979f5c2062df13590215fec19f74068b27885d47f4a5db6945

SHA512
4cb80876f2c41d99234be87bf3bb61b86ece3fdb3ab64773636faf731fa535a799ae6778ecaa6df42001b1bec368b932753e851be9e3653e0e9940ed05bb15f9

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
390KB

MD5
dfe9f395bbafeac04e7cc58d325ddaa6

SHA1
437b9e65a22b818d1de18577070534dd1e900730

SHA256
10e383646ddefd01bbdb80a8b74f2f46965bc299f10ebb816eaef25e3a83d142

SHA512
f5c60d675737b53178e7ee49d84a13248cc45026bc5084afbab784300a5fe2dd43990b3e89bb214d62c6254627fb6faeec6c730c5e88ff3ee5a012a4ce2ec881

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
390KB

MD5
ac8fbbbefa42e248441555fc5166ebb1

SHA1
d7551b2cd24bf2da0c164e9aad2e672c162488c5

SHA256
4e734d587102bcc08085e87b927eee20781a5b73c6960d28ef78466ac7921f13

SHA512
8081defe631f67f945f526be33e61ac75de02889c8c3b49c8ffb8704d702957278ab61cc1d234e0e6e0bc127523ef4f64f8e5fe2bae160ff53a1b86d589be1d8

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
390KB

MD5
0166a295d3d24067e970826f190d766f

SHA1
2eeede50eb3d490d2b8be4171049b79c0317670f

SHA256
99aff4647d67d4dcc412abaf47e13ee654abdf057d66282e969a4b1f06c9d9b2

SHA512
1076034bf70ae7a93952e4f1f2e4d3771a983286efe4c7e5df1e9af09b0cc3dfab2b9a007bd119dc744a3ac9cb7cbf25edfef3dcea3ee174a352ab2df476c721

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
390KB

MD5
ed40b6affc4e6ee931ac31e433342aec

SHA1
6c493c438d5ba16d0132c2da01ba6b6271b79bb8

SHA256
1c78903af109b4cbd25a8d9e9ee333871814b073335a8dfc3165749ba60b5da9

SHA512
d1b739c0305f351bbd47046a3d7ba554bc4eb93b5961aa8fdb2582f05d933761b5fe307f3e438cca70d1d8d8cc0c3049a1fc91f872e302aca2f9344ce67baa66

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
390KB

MD5
d9303fb23976a03dfeb2dcc696bec5ef

SHA1
a9798b9b5fe6e1212c4b7e28d16148bfc33f643e

SHA256
bc8e0c4867dbfb2737d27a0d4ece6840e8a90c58012e39f90b8c7a46beaf36a5

SHA512
5fd87117312e72be3ef2a9a0e0e0f79fcfcc28d5741d36b7e8fdd51383ca43b5388c7ccc0e8d4830c13c9799107edfe6bc9c0b6737db5254c3002a7073088f18

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
390KB

MD5
7832af55b9a9e8ac679127e5b444acc3

SHA1
9879b3ee4b5700cf20f6f0d16b436a691533d424

SHA256
f4ccddae43fe3f65f31477a0f15d69d158b0e4607ee828030a60f048aef4a627

SHA512
68bf50d27617e21bda9a6de9b9cc53f69f44acf590035d76fa06c2a47e1b4b34c26d07b44f7563818da7dd66802f1e6fdde9b70e2763fe614ef2726c2e06d620

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
390KB

MD5
7c2481af4c1b0bcde58b78cc73ce57ee

SHA1
cc951d13113ed447114bfa9f7c04ae3e1904f550

SHA256
adf6ba0de16dc031d01c8ca2ab7e1b6bd1d3d7c946349baea885cd7cdc1d4804

SHA512
e1aebfb028e86bc63f91601cd9e6abea4dc5e37688192d339ea162a90d8bc3ec2eed15569008315ad1a80e7d6c708c47449eaa8c90374cca1ec9476ac9c322b4

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
390KB

MD5
7566f58122accceb08547ffbe533ab03

SHA1
4778f56bc8965655220adabd0c0158e76643341a

SHA256
0a26a0c47876f9e017ee584f7ac8bdc8023a6392927a81c0e802983210a65ea5

SHA512
3ffb60c540d5f23b73f4224eec36237331e9bcf6c305db1da5cd9b17e9e4e81e6e839a20c2a297fee946d72087f2edfae68b25d5cb0c42d0899fd7f2d82b2fbc

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
390KB

MD5
c71653a903f056c742e40cda402e089e

SHA1
b2666a2aed67aecc5040055037b1a94767fe510d

SHA256
7d0b535b712e11611121c53b82abf774041929047919cad781e4608654e718a2

SHA512
8356c5cdaff5566e75a0d15a14548eddc81187544a0b66065d9ec912b0d25ac4de2c60c27fff7e82fb58278a693844e8b4321a38c414da6bdef96eb4b5a9f19d

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
390KB

MD5
a9a0a4859928a4aec6d168bd335349a5

SHA1
ccb53a0b9bc15063154ffa093b90ad197ed5084e

SHA256
42465901b24ff89bb2633de42e7683af6350eb08d179a743c1a6652c1db44804

SHA512
b85c08836a2b44a87e29f0e81926ff5bfa34d065897561a08d3f28ff55961a18a3a67345aad618780d888760de2e0a992bc5ecfbd197d18b7f38aae9121b5dcc

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
390KB

MD5
c7cd54acc7839f3099a4e820a3521c6e

SHA1
efb5c23521ad414c33475804e6f6b84b543d7ab3

SHA256
67ad44385338a1e76558d173d2f810d15d8a48853bde139159ca38652c8331e9

SHA512
88f36e70d9c479184c3aa634f1ceff604d6cd0a787d04d12337c3ed349368c9339b427d1aa1cae99e196b53bc24fdbb4116ccf0015cafc192e8b236b4be1cb52

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
390KB

MD5
8ba23105d1844dd513a70ae88be626dd

SHA1
646070a3680d8b77891b4deaec6c7d0c54dc41dd

SHA256
a3706ba02bae94bc5e60501c744f510f4766bf64b88038f42bc49cc226aecc8b

SHA512
e568a6e336a560a08c9e6d318bb52dd39aa73102095cdff676b89a20b8d6d50a826d2179edc137b55271d966d9c8ef86b4b01b873a5bdcf8670dd0cf85ac1fbe

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
390KB

MD5
c9c58e8bec9808b783c62e3304d518ee

SHA1
82f390b8463333c3bd42cea5e62a4518f8ef12dd

SHA256
877c492d2b1e4dbe637467153eae1823413cf9f88ca001498168e18ff71c6173

SHA512
7f863213fbee78f39cfb9e681c277ec274f8d24ce2c9f32f32a2f4f3fbf29c6e3ea1be0987c2cbffe3c73357a33ec77d9f0447b80cdda37a75218a1154f309b4

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
390KB

MD5
44d64e9733db7acffc14cfd40f586e8d

SHA1
313dcbf1f948710bafdd67c398014a3664b68859

SHA256
3d44726a8a450dc7b62e75eb90bdb68b902d509d32a838c641cf2722ef79f77d

SHA512
7f4fe871301ffb43269b5a2214cdae618cca0306bee2a6fa5570d033e4d0aedc54b9e75cb25cfb91bd9dbe9f7c0a7eea2567cd84272abc4909ac954f282fa645

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
390KB

MD5
e561eb8ee610e24c15d5ec69e7e7c06e

SHA1
c4b970fa6f327dda10e028a273ece23bd91e397f

SHA256
53f5f41675f0df41cdfd0df4eda733f06bc684bd1cf6c745aacccf3817e0b097

SHA512
718c818e75ab75e4b4484e990567b23d9efae7b71f1032c9c7d3ec7a8aded69580b41d5410c717a4c983e98b22f439a502e644ad9ef46721cca8070d329998d5

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
390KB

MD5
3150aef77dd7117ef0f79e842493f8fe

SHA1
9e839f9fc0294a996b8a48b4b865db8789692002

SHA256
cd26a4ae0c9500f04a9fd2b66780738c284b3c72cba8f3674913092b433acc64

SHA512
3dae1cc4c2d24d75a91aab06f7d14ee7585a4aef157a8aebbbaf172ffdd1ee2be96a50e7e13419aeaf935e22f9a63f898d73a340cedfd2d8038da6588d318558

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
390KB

MD5
a39be25bbee005a236c434e72af4abc7

SHA1
6ec6bcecbef753e3218f8e5ec6b3b4afb2aea89b

SHA256
d348949ee860383289ad4a74caed6846b6b37719ee1ae928ad846a1de2a1a458

SHA512
82e6c5cf32677378262d27c27080a58f889e95946a850d97a83fd8ff322a44846c1420ae1a6aadfd62f7e825decc03bd1c0f7006721275dccf3dd4e4f9949e34

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
390KB

MD5
f3b2eea44a37ccacad8dbbcae4198e7b

SHA1
5a786835539e9392ae008d5f156589f3d75898ce

SHA256
f55367426f018f4238181d861dac1a101672e33b40bbeff39585ca9ae89b05fe

SHA512
ba99c8cf8ad39fb57a2fd1ffaeb82e008164eeda044fbd6a64fc5e80885c078b2179b9dae9925967c16341010274df2e064f0153fd72cd6979ec04efe0c96ac5

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
390KB

MD5
81b393bb58cecdade8680f4f1719117b

SHA1
acdfa697bda8adc03869d0fd8fbab41383169b15

SHA256
77627ce7b9d49ff57e1d2e16d573b47f30c11f9fd531b4a182aff4ffd911c2cb

SHA512
2a41f710de19f839aaa7df2e761ec83a29ecae4a6611afd8bdfb8eb1a004963e42ad32f3dc145f2d71714fff2558b4e9c428b9f11c66b4452978273f80138775

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
390KB

MD5
066879e0cbc1b2f417104584b9b9b11d

SHA1
95f8c6118fa4e4cb55dfdaada598ab8c9143d4ec

SHA256
9f4fe0524f849adef4ecf14b5de305583511617f1663196619dc9f344a3a644f

SHA512
d29c5e295a40ccb37d62bd085046a513e41533cb3b99ddf6aba90948689e34432d94e25db6ce12e1de68ef7c94c64353530f67e02e673886232d49cbe41aa71c

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
390KB

MD5
422b761518c58279685d2d4e45ffe473

SHA1
3985cb455015c98d4db4ec6e41be62addfb61dc9

SHA256
9581c6785c35c511164fb568fc9f32d006ff01190b29fb6581c8ade181a17932

SHA512
90c7adf1367dbdd461d4d75b32f087d3aa49f016df4259b52ce679ca6166151ab2df112581d7c6549ad18a182e39ed2ef2b947d3a0aba48c712311dcfcbd9c6d

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
390KB

MD5
911bf1487d24f4d502f0d5099ae27ec8

SHA1
6d0466d6395f21b09c806fe841989d95a6c9a9ed

SHA256
142043f53a1c1e870ea89615794b2f3ed6c35e69c131f0be61f5bca71d230849

SHA512
2b5c1ac4e7afd53f9fda4d5beb904b605bfa6514fcf7c9d6c4878d4120c9379fabc3a09cf42c4f4edd6e5cf95934aa1393e850979f5a7d9ba5c5a3ee3fed909a

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
390KB

MD5
b8f29eed9794def2c45d9ebf7033a999

SHA1
5154f189b3b7e7d7d92da93ef1f1b37d770b4d99

SHA256
6fe7ded2f63fd5752824cf7c5e4a071347759222f5b0b8ca81e3d6dac5794384

SHA512
cd6129cc77a17a359504981af923436d58322a38fb6e5477c102405cf0441ef21dba1066e4031b9210d2974ad446e9aab71bfa322e490beff0e373fbbb0bd6f0

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
390KB

MD5
e533c5d061a864d7c2bace3f741622e6

SHA1
1f2ab4be133b5e9623ff3c90cb4b08dca7a50aaf

SHA256
cc597e6ddcd763fb36f31c95912fe6d4d92e846202ec1195f32f19a540a8ff15

SHA512
becf897caf165bd3b74b2e30faffaaca6a0e951afa716402d9c6fdd0fdf0501e6233350f1eb3c8dd8f09030198ac497b3528b9db12c4deac90773a3067136051

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
390KB

MD5
d86c4781b9c718991fcfac56555387aa

SHA1
5c05d9560ec2a81c5162017b7f57f0ebeb88c248

SHA256
454bb4bb6cf1a6c8990f8776fc0f6b9bc72f705e8b3b922464571330ab5a5535

SHA512
530d06e702d01e77085f4b3a7a771f471c7fdb34af4b8d7789ebcd94f3de079100dd5731aa10dd9ea3f7dc607ec601ef225b76f60a451ad20972b7cf3f5a9673

Download Submit
C:\Windows\SysWOW64\Nnaikd32.exe

Filesize
390KB

MD5
9a37cf0835b03a2b9c569bad609bf1a6

SHA1
0eee3aa04a90ad02909020b9d5adb2c0a516772d

SHA256
55af296fb98a636316ccf10aced7dcca24ef2525344dfa71b28a7c370bce0c36

SHA512
1b7113ae746ad864551b3ab68770af379835144c4456d2bae68e6dfade9153f6ff9351c50b458084cf5d9e6f34b7fd27f2ee5ed5335d38e3b037de8f02230754

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
390KB

MD5
b471d58c91d35731a1041913c8a7353f

SHA1
49ddb2f54c5014709d7a99020b619c60b26516b9

SHA256
a33876d9c5f2aa3d8511ec2e00b088d126172dd309ffeeec5bedc780d88e1db4

SHA512
9be5c093006c7e5beba56cbe2219d8b43ebfbed04e9232dcf9d9a86ef7d1214f3a05ba5077f92b684142f55389cd0d3d6e15be18deb3783117ef70cbc956342d

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
390KB

MD5
e0863ec64b367f40809914bbd1201fab

SHA1
d8fc3098b5999833c5d6a75dedd5813f863235d4

SHA256
adf2a6e5406eb36da28988eaad382d6b2bf81fbf3ac40b8be38db51a6cd9d260

SHA512
0f31b6faac6ed782a4e040b11232478ed1d32037c826538758667ee03b325d18a00c8c67741ec5f8cc2e0b8d78f975205f68a7c106331331e03af1ed41113f59

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
390KB

MD5
e6e2db1e6aec8188b5635dc5698c54f6

SHA1
e84ea229b8a2aca5536a346914de7eefc5bffac8

SHA256
ccb09fdb09074cf31b8b69572bf844425788af66cdf413518d5cd7fe8cf3b1d6

SHA512
453c37c5ce1d34580e08e486dd547f777ba54d044ff7fe8f2d5e41eb15f1d7e7033d7665d387335f3ecb2ac86dd3dec6de5a9f9d6dbbb3f15d8c26851290d1a6

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
390KB

MD5
e57c6e8ed86a7cb3f9bd01797410663e

SHA1
011f3e4e20018ab4472b4c06645e1ca453ace3e6

SHA256
e317b2282eb277467a9d832ab43ec775e461462cc9ae5b8e2f175f517a2f6340

SHA512
80fda6c976a946659cad9d87a09da2183c556b24f914020c6de707984d4281925d2fa46b7cad370cbbb62d9ef0317df5cc2911c3eda75ecd171a8a88d9129d7b

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
390KB

MD5
573fce5c8e92d9d554efc3ecdf28c226

SHA1
bfc0dbbf5089f61f4a27a223fe0472a6a97037ba

SHA256
a1c620305a98cff93cb809d86845ef73d8c6f9e8c6fe19b822a779e4b4ae09f3

SHA512
40e761c03067da973a95645db628d5f86458c3f55e6f3a9ff1465a10a997f1904aa3a0adffc1e12056dca517adfa133419b7c37e8d50ea6d12e8f8386f2742c4

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
390KB

MD5
8eb751cb4f294df037092080be52a5c1

SHA1
a05d1a757398779684e524505f407a8903eb8658

SHA256
26f0f3c01e8693a78073162e5017ba818aadc13683cb3ddd3d7dc764a09cec20

SHA512
5901ccc74bc24b161e7a86c1a44d2e99e5f8f38c28dd29ee6e0688eea80d89a54d9f15f5420f19625bcc8e4cf6af349bafb9c68607bba4aaa4efedace4754e0e

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
390KB

MD5
d90390094baedddb747f56ed7249da6d

SHA1
687ac980ee35dbce6731c055a15de9c3e3dc0a96

SHA256
eff5040ef2683805d7ba5521ca6ca325a2ec04de5ddeff447e13e9d540663b8c

SHA512
1472be2c1fe5ce0f255046f2c234b6eeb33d0acce161649685c0e844a696f75484593d2cc519fbf2e6d9707d269477133d6921dddf6c94e7ef91bdc2fd2eab30

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
390KB

MD5
f1dee0ff8b03469aae32abad61c7844e

SHA1
dbedfcd95927ad168f0bcb867b8e35459e97225b

SHA256
1673a4563ceabb587889aba8a0f2a4d9da4b512bcea06c471dd53775fcb43787

SHA512
e79ac87b94ea7c70b8d9c1fbbc5845dbb8dd9e1b15861528b443527a0a8f9fb1d521ada42660489d07f513c1a02fbbfa5df008d47f7d2b2954e27dbe51d3c304

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
390KB

MD5
16535d31bb8838d1dc2a40d5f7678798

SHA1
0788d52f6a8eabd354afabdfcf08ee39c06ed95d

SHA256
5d49dd8014556ea59bbe8c9b1fc183620e972dd1a90ce150a717fc5a8861c550

SHA512
cb2fe0ddc0899a8005fbe7c2477658308941cdfcdc5684506dbd68f2937c9342f5560b2cd291ff43b09ec42aa25ed497debb900594d23e12ef37c93e06f249d6

Download Submit
C:\Windows\SysWOW64\Ogljjiei.exe

Filesize
390KB

MD5
4956af14bdbe60940911f61dab191197

SHA1
e588797cae532ad287c21275924abb2b30b68a8d

SHA256
19ac04185a33d13a4c5cf951e69a3c6238e124ade8b93e9532c4c80ab2334218

SHA512
2ff1acb4636dad7cae9163681008193906c05c032396971428a5077a15d48dc97a0a4a905837e681a93ae42e48d234bdab19a43d7753a3ab457ffcad7ba0bc62

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
390KB

MD5
389680aa35781e8e690d10db26d1e906

SHA1
fcd22539354a0a7fd26fc4ba8d4c6a8f7558fd6d

SHA256
99e7e3b3482cad8d8b1a26e1e4bdb44d94519f9d96f645a493ddec62a33ade5b

SHA512
1af8b86c00d5e64a17075c300e14b61a435026d8581266699350d69327f839156d93bbb82cbbe03dcdf4fefd1764ac96332a4e8944f1745fd63409dbe9676f45

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
390KB

MD5
6ca2fe0e39cf18ddf11421e148437029

SHA1
daa816da619d3b053d09df21c627ab1616501b81

SHA256
a6d09c7fed30dfa822d382fd9e5c5c994365ad4bc72a6366092f42d3f648df1a

SHA512
68b58388b3abc04eb418f28c4e0d78e4cb1007b4ca38047b7a04f6e5d4f72d1967893a260729bfaf73f2691ca5702a8aa51c44ac28e20cdb3a7f705b79ab1a08

Download Submit
C:\Windows\SysWOW64\Pipagf32.dll

Filesize
7KB

MD5
0798aad109cfa3ae7d88314d80725c19

SHA1
9e8ca37a600c7c7a4d4a78965f32860c8b5e88a1

SHA256
e49241d82c46d9fe24ecad44579ced490d1081f166ed914f5ca0e5c9a55813b0

SHA512
4dbda133566cc30a868154662391a8b57d90709b945056fbc6e8e4a7b27b5aeba7b313d2f9c3dda4b65b1a15c16f4108c7f6ba2133eaa1be13e302bd1c008cb6

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
390KB

MD5
a7e671c93b0fa3a909aafcda6e604ed9

SHA1
e07afa6f52f156b7dc72ecb57ab6a05c95c388af

SHA256
7bc749db9e50a7e85dfaca4e328e548dce4244de8e3befcb099dae8c83d6db82

SHA512
fef651e750d320179aafc083cc036eec9abd196919bad32ab6df77f3323eb550d2d229fc773f1b0239fb85e2d42420129428afd6be671d56a5f199017f5a1d46

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
390KB

MD5
567ba21ba61abad106fdb5a8477c02d2

SHA1
068d3566f2e8ebe8d70de1931e47f69de252979f

SHA256
444ec068f245b96bade0a9102410c0e917b4558e4a53d52f759b938e2f21bd8f

SHA512
7624aae0950cd84cb5b8c41192923118563e2fc1d7fcc5e47a2b1ebeb884a796531f7a7d0031863be098c93e9e291fb4cd77da0defc79df360a1171cbb3af6bf

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
390KB

MD5
3e7b5b7dc91ff902accc3d5e0cf784dd

SHA1
69521680732f85c1571ddae05ae0365250e77354

SHA256
ba632c6f177dc58003fb0d314a963e6b8bc8b0780976b01f9dfe9377c961d3c1

SHA512
96c8bcc952dcc1ae3e0f677321323968859b0498b6b891567af05ac8fbac93aa3d29a3aed18284cc7af6f93f8dbbe103911b9b4885f2c60374ce93e80b5a7276

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
390KB

MD5
a703dc28cfa454042c29cef5f7ad8c9d

SHA1
387bffb5e4da748439ad15b38c8df4c17a288837

SHA256
8d0e0d348f9378f64033797d039533f4e3798cda28784a420b992cd0e5b68cbe

SHA512
68a1cb8967d2364b4e2521c8d34123962704b94254c6dd385ad33e262edad34e166b8accdc419e1cd0314e9bc0a669e4baff97241d5867216aa5612e7c03c9ce

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
390KB

MD5
fc0fe1a66e80d7aa037397557efef1c2

SHA1
6c04e75e97d4801ddd8b337970c882f6b96c8991

SHA256
d796479f212cfa61dee319344735402fce655504990b11ff9124f1bcc963dbc0

SHA512
0142225fd1c95afd97dc17147cdc973f5185382889baf54a270b2e3b7b08362f1adcd34fc19e3274aa985d610908198b2b883b38c48c5e88a39a5ae4d5b51ac6

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
390KB

MD5
90be563fb905f122bcba6c115920494a

SHA1
f3c92d9db04f47e6a5b344386746135df22f5164

SHA256
7c74223ad93ae4b46fed9ff597bf699808347a6a4da0a77ffe3728431f8d8865

SHA512
1dec5a9f78ca967f000ab926525ae977c048e27df1746a625cf13b7eb764487724a5c61fdd2d6d61650c1e12d988c4ef21e3864631291313e9ab7ea14ed4347e

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
390KB

MD5
730f02d7c74b9b5f2cc6e2f7df4becd8

SHA1
53c7bca88a0753235e31af5961d0b3260405e809

SHA256
aa835cbd3d9c928b1dafcbdaa3769449f62fdab1f96713888bc1f32a56c503f0

SHA512
5386f541db4db69e1d935b2c3d7045d12c3e17d6a43846b185f0c0c308910d6ffa401ff0f67698e5de02bc0e4fee2dfcc1c55bc01c27de026c7561e4928594d3

Download Submit
memory/8-275-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/812-388-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/884-320-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/932-265-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1020-617-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1200-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1200-532-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1228-28-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1228-553-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1264-32-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1264-560-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1340-472-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1500-259-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1528-509-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1536-205-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1564-474-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1640-434-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1892-636-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1892-126-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1892-2434-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1920-626-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1920-110-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1932-450-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1940-165-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1964-189-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2020-359-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2064-20-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2064-546-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2084-591-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2084-70-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2088-491-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2088-2320-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2244-421-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2304-330-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2424-354-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2432-173-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2452-288-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2456-253-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2524-589-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2572-440-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2592-2024-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2624-48-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2624-572-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2652-300-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2672-237-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2800-422-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2888-347-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2888-2371-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3060-515-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3200-312-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3432-503-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3472-40-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3472-566-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3636-2365-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3652-409-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3696-399-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3740-579-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3740-60-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3808-233-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3936-221-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3940-647-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3940-134-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3956-251-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4068-213-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4188-605-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4188-87-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4196-451-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4224-501-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4364-2360-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4364-384-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4396-306-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4436-286-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4440-376-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4440-2359-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4468-462-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4548-485-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4568-150-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4572-78-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4572-602-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4576-181-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4584-336-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4596-370-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4608-8-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4608-539-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4684-324-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4752-99-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4752-611-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4848-2436-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4848-630-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4848-118-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4868-299-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4952-197-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4964-649-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4964-147-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5128-2311-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5128-521-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5204-2305-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5204-533-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5248-2306-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5248-540-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5292-547-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5336-554-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5460-573-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5500-2201-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5588-2205-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-592-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-2289-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5632-2250-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5644-604-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5768-618-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5856-2276-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5896-637-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6064-2202-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6444-2091-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6616-2173-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6660-2040-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6888-2160-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7032-1994-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7128-2148-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7164-2042-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7224-2017-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7280-1995-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7292-2016-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7828-2027-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8044-2021-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8348-1937-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8632-1927-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8788-1935-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8920-1956-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9048-1973-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads