afbaadea6df0a7f5fa693d3eff093731f4e4d9abedc1a352d12151487cc47a56

Analysis

max time kernel
148s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe
Size

89KB
MD5

2e9f95ad41ec4b62a9af9d4ae279e780
SHA1

3ae6b26f14931b4a73bd9d7a1db9d6fc4378148e
SHA256

afbaadea6df0a7f5fa693d3eff093731f4e4d9abedc1a352d12151487cc47a56
SHA512

b22b0f917bcae95ea626e0f9698c2ac76a6e54c0f21309f53a54a90ca194424ccc9c819dda9ec1a18fd60922501b515c0bdebd7d07a14b5bb2ee7fabda126e90
SSDEEP

1536:dhU8bv6y/V7sooou5CQTwTqRCw76rrcAlExkg8F:xv6O4nQTqRycAlakgw

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okolkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aldomc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecoangbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Occkojkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbgqohi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbmncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onjegled.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Behbag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qecppkdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe

Executes dropped EXE 64 IoCs

pid	Process
3224	Kdaldd32.exe
2316	Kkkdan32.exe
1616	Kmjqmi32.exe
2012	Kgbefoji.exe
2108	Kmlnbi32.exe
3656	Kpjjod32.exe
1048	Kcifkp32.exe
1600	Kibnhjgj.exe
3520	Kpmfddnf.exe
3624	Kkbkamnl.exe
1892	Lmqgnhmp.exe
4468	Lcmofolg.exe
2452	Lkdggmlj.exe
1100	Lmccchkn.exe
2436	Lpappc32.exe
976	Lkgdml32.exe
1864	Laalifad.exe
3952	Ldohebqh.exe
4428	Lkiqbl32.exe
4392	Lpfijcfl.exe
5080	Lcdegnep.exe
3832	Lklnhlfb.exe
1948	Lnjjdgee.exe
3248	Lddbqa32.exe
3180	Lgbnmm32.exe
544	Mjqjih32.exe
3776	Mahbje32.exe
808	Mpkbebbf.exe
2160	Mciobn32.exe
116	Mjcgohig.exe
3736	Majopeii.exe
4240	Mcklgm32.exe
3756	Mjeddggd.exe
4776	Mpolqa32.exe
4784	Mgidml32.exe
4472	Mjhqjg32.exe
2208	Mncmjfmk.exe
2132	Mdmegp32.exe
1856	Mcpebmkb.exe
2240	Mjjmog32.exe
2172	Mnfipekh.exe
4352	Mcbahlip.exe
852	Mgnnhk32.exe
2432	Njljefql.exe
3192	Nacbfdao.exe
1980	Ndbnboqb.exe
3928	Njogjfoj.exe
4372	Nddkgonp.exe
2824	Ngcgcjnc.exe
5084	Nnmopdep.exe
3964	Nqklmpdd.exe
4456	Ngedij32.exe
4892	Njcpee32.exe
3460	Nnolfdcn.exe
2292	Nqmhbpba.exe
5112	Ncldnkae.exe
4288	Njfmke32.exe
4504	Nqpego32.exe
2260	Ncnadk32.exe
3852	Okeieh32.exe
4844	Oboaabga.exe
3740	Odnnnnfe.exe
1492	Okhfjh32.exe
4820	Onfbfc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Aacckjaf.exe	Andgoobc.exe
File created	C:\Windows\SysWOW64\Adapgfqj.exe	Aacckjaf.exe
File created	C:\Windows\SysWOW64\Qdchadai.dll	Bopgjmhe.exe
File created	C:\Windows\SysWOW64\Ienanm32.dll	Cacmah32.exe
File created	C:\Windows\SysWOW64\Ajgblndm.dll	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Ageolo32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Ecandfpd.exe	Eofbch32.exe
File opened for modification	C:\Windows\SysWOW64\Jbjcolha.exe	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Chdkoa32.exe	Cefoce32.exe
File created	C:\Windows\SysWOW64\Pglcddpd.dll	Helfik32.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Ifllil32.exe
File opened for modification	C:\Windows\SysWOW64\Jefbfgig.exe	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Gfmccd32.dll	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Lgmliida.dll	Pnpemb32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkhdp32.exe	Ahmlgd32.exe
File created	C:\Windows\SysWOW64\Fhpili32.dll	Ecandfpd.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pncgmkmj.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Ghopckpi.exe	Gbdgfa32.exe
File opened for modification	C:\Windows\SysWOW64\Ibjjhn32.exe	Ikpaldog.exe
File created	C:\Windows\SysWOW64\Ifllil32.exe	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Bdjinlko.dll	Pmoahijl.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Aniajnnn.exe	Alkdnboj.exe
File opened for modification	C:\Windows\SysWOW64\Bhfonc32.exe	Behbag32.exe
File opened for modification	C:\Windows\SysWOW64\Dboigi32.exe	Docmgjhp.exe
File opened for modification	C:\Windows\SysWOW64\Migjoaaf.exe	Melnob32.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Flioncbc.dll	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Fohoigfh.exe	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Fckajehi.exe	Fkciihgg.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Cmafhe32.dll	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Ciglpe32.dll	Hkfoeega.exe
File opened for modification	C:\Windows\SysWOW64\Jcioiood.exe	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Jmbdbd32.exe	Jfhlejnh.exe
File created	C:\Windows\SysWOW64\Kikame32.exe	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Melnob32.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Kkkdan32.exe	Kdaldd32.exe
File opened for modification	C:\Windows\SysWOW64\Pcojkhap.exe	Pbmncp32.exe
File opened for modification	C:\Windows\SysWOW64\Iehfdi32.exe	Ibjjhn32.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Bhaebcen.exe	Bdfibe32.exe
File opened for modification	C:\Windows\SysWOW64\Ieolehop.exe	Ifllil32.exe
File created	C:\Windows\SysWOW64\Mchqfb32.dll	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Lgdalf32.dll	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Gcmdhh32.dll	Fdegandp.exe
File created	C:\Windows\SysWOW64\Naqcfnjk.dll	Faihkbci.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11732	11448	WerFault.exe	575

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ainpbi32.dll"	Gcfqfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bbgipldd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hekcnknf.dll"	Pcccfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqlbaq32.dll"	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjgop32.dll"	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbglkbhg.dll"	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnoof32.dll"	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelaijjp.dll"	Ncnadk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghpcp32.dll"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldjicq32.dll"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canidb32.dll"	Kedoge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjcpkfo.dll"	Occkojkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbgkimpf.dll"	Docmgjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaekmb32.dll"	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdfibe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3224	2684	2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe	83
PID 2684 wrote to memory of 3224	2684	2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe	83
PID 2684 wrote to memory of 3224	2684	2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe	83
PID 3224 wrote to memory of 2316	3224	Kdaldd32.exe	84
PID 3224 wrote to memory of 2316	3224	Kdaldd32.exe	84
PID 3224 wrote to memory of 2316	3224	Kdaldd32.exe	84
PID 2316 wrote to memory of 1616	2316	Kkkdan32.exe	85
PID 2316 wrote to memory of 1616	2316	Kkkdan32.exe	85
PID 2316 wrote to memory of 1616	2316	Kkkdan32.exe	85
PID 1616 wrote to memory of 2012	1616	Kmjqmi32.exe	86
PID 1616 wrote to memory of 2012	1616	Kmjqmi32.exe	86
PID 1616 wrote to memory of 2012	1616	Kmjqmi32.exe	86
PID 2012 wrote to memory of 2108	2012	Kgbefoji.exe	87
PID 2012 wrote to memory of 2108	2012	Kgbefoji.exe	87
PID 2012 wrote to memory of 2108	2012	Kgbefoji.exe	87
PID 2108 wrote to memory of 3656	2108	Kmlnbi32.exe	88
PID 2108 wrote to memory of 3656	2108	Kmlnbi32.exe	88
PID 2108 wrote to memory of 3656	2108	Kmlnbi32.exe	88
PID 3656 wrote to memory of 1048	3656	Kpjjod32.exe	89
PID 3656 wrote to memory of 1048	3656	Kpjjod32.exe	89
PID 3656 wrote to memory of 1048	3656	Kpjjod32.exe	89
PID 1048 wrote to memory of 1600	1048	Kcifkp32.exe	90
PID 1048 wrote to memory of 1600	1048	Kcifkp32.exe	90
PID 1048 wrote to memory of 1600	1048	Kcifkp32.exe	90
PID 1600 wrote to memory of 3520	1600	Kibnhjgj.exe	91
PID 1600 wrote to memory of 3520	1600	Kibnhjgj.exe	91
PID 1600 wrote to memory of 3520	1600	Kibnhjgj.exe	91
PID 3520 wrote to memory of 3624	3520	Kpmfddnf.exe	92
PID 3520 wrote to memory of 3624	3520	Kpmfddnf.exe	92
PID 3520 wrote to memory of 3624	3520	Kpmfddnf.exe	92
PID 3624 wrote to memory of 1892	3624	Kkbkamnl.exe	93
PID 3624 wrote to memory of 1892	3624	Kkbkamnl.exe	93
PID 3624 wrote to memory of 1892	3624	Kkbkamnl.exe	93
PID 1892 wrote to memory of 4468	1892	Lmqgnhmp.exe	94
PID 1892 wrote to memory of 4468	1892	Lmqgnhmp.exe	94
PID 1892 wrote to memory of 4468	1892	Lmqgnhmp.exe	94
PID 4468 wrote to memory of 2452	4468	Lcmofolg.exe	95
PID 4468 wrote to memory of 2452	4468	Lcmofolg.exe	95
PID 4468 wrote to memory of 2452	4468	Lcmofolg.exe	95
PID 2452 wrote to memory of 1100	2452	Lkdggmlj.exe	96
PID 2452 wrote to memory of 1100	2452	Lkdggmlj.exe	96
PID 2452 wrote to memory of 1100	2452	Lkdggmlj.exe	96
PID 1100 wrote to memory of 2436	1100	Lmccchkn.exe	97
PID 1100 wrote to memory of 2436	1100	Lmccchkn.exe	97
PID 1100 wrote to memory of 2436	1100	Lmccchkn.exe	97
PID 2436 wrote to memory of 976	2436	Lpappc32.exe	98
PID 2436 wrote to memory of 976	2436	Lpappc32.exe	98
PID 2436 wrote to memory of 976	2436	Lpappc32.exe	98
PID 976 wrote to memory of 1864	976	Lkgdml32.exe	100
PID 976 wrote to memory of 1864	976	Lkgdml32.exe	100
PID 976 wrote to memory of 1864	976	Lkgdml32.exe	100
PID 1864 wrote to memory of 3952	1864	Laalifad.exe	101
PID 1864 wrote to memory of 3952	1864	Laalifad.exe	101
PID 1864 wrote to memory of 3952	1864	Laalifad.exe	101
PID 3952 wrote to memory of 4428	3952	Ldohebqh.exe	102
PID 3952 wrote to memory of 4428	3952	Ldohebqh.exe	102
PID 3952 wrote to memory of 4428	3952	Ldohebqh.exe	102
PID 4428 wrote to memory of 4392	4428	Lkiqbl32.exe	103
PID 4428 wrote to memory of 4392	4428	Lkiqbl32.exe	103
PID 4428 wrote to memory of 4392	4428	Lkiqbl32.exe	103
PID 4392 wrote to memory of 5080	4392	Lpfijcfl.exe	104
PID 4392 wrote to memory of 5080	4392	Lpfijcfl.exe	104
PID 4392 wrote to memory of 5080	4392	Lpfijcfl.exe	104
PID 5080 wrote to memory of 3832	5080	Lcdegnep.exe	105

C:\Users\Admin\AppData\Local\Temp\2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e9f95ad41ec4b62a9af9d4ae279e780_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\Kdaldd32.exe
  C:\Windows\system32\Kdaldd32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\Kkkdan32.exe
    C:\Windows\system32\Kkkdan32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\Kmjqmi32.exe
      C:\Windows\system32\Kmjqmi32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
      - C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        23⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        24⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        26⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        27⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        28⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        29⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        30⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        31⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        32⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        33⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        34⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        35⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        36⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        37⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        38⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        39⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        40⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        43⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        45⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        46⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        47⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        48⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        49⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        52⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        53⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        55⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        57⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        58⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        59⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        61⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        62⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        63⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        65⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        66⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        68⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        69⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        70⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        71⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        72⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        73⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4960
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        75⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        76⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        77⤵
        Drops file in System32 directory
        
        PID:680
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2984
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        79⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        80⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        82⤵
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        83⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        84⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        85⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        87⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        88⤵
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        89⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        91⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        92⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        93⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        94⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        95⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        96⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        97⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        98⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        100⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        102⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        103⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        104⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        105⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        106⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        107⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        108⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        109⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        110⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        111⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        112⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        113⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        114⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        115⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        116⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        117⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        120⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        121⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        122⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        123⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        124⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        125⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        126⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        128⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        129⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        130⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        131⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        132⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        133⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        135⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        136⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        137⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        138⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        139⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        140⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        141⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        142⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        143⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        144⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        147⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        148⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        149⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        150⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        151⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        153⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        154⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        155⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        156⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        157⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        158⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        159⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        161⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        162⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        163⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        164⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        165⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        166⤵
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        167⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        169⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        170⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        171⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        172⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        173⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        174⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        175⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        176⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        177⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        178⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        179⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        180⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        181⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        182⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        184⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        185⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        186⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        187⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        189⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        191⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        192⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        194⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        195⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        196⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        197⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        198⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        199⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        200⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        201⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        202⤵
        Modifies registry class
        
        PID:7232
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        203⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        204⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        205⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        207⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7440
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        208⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        209⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        210⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        211⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        212⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        214⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        215⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        216⤵
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        217⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        218⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        219⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        221⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        222⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        223⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        225⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        226⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        228⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        229⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        231⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7792
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        233⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        234⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        235⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        236⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        237⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        238⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        239⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        241⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        242⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        243⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        244⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        245⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        246⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        247⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        249⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        250⤵
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        251⤵
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        253⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        254⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        255⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        256⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        257⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        258⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        259⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        260⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        261⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        262⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        263⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        264⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        265⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        266⤵
        Drops file in System32 directory
        
        PID:8500
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        267⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        268⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        269⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        270⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        271⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        272⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        273⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8844
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        275⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        276⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        277⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        278⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        279⤵
        Drops file in System32 directory
        
        PID:9048
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        280⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        281⤵
        Drops file in System32 directory
        
        PID:9144
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        282⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        283⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        284⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        285⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        288⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        289⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        290⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        291⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        292⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        293⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        295⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9084
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        297⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        298⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        299⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        300⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        301⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        302⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        303⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        304⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        305⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        306⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        307⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        308⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        309⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        310⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        311⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        312⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        313⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        314⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        315⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        318⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        319⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        320⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9496
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        322⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        323⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        324⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        325⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        326⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        328⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        329⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        330⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9920
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        332⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        333⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        334⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        335⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        336⤵
        Drops file in System32 directory
        
        PID:10172
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        337⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        338⤵
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        339⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        340⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        341⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        342⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        344⤵
        Modifies registry class
        
        PID:9560
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        345⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9692
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9768
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        348⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        349⤵
        Drops file in System32 directory
        
        PID:9888
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        350⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        351⤵
        Modifies registry class
        
        PID:10032
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        352⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        353⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        354⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        355⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        356⤵
        Modifies registry class
        
        PID:9352
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        357⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        358⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        359⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        360⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        361⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        362⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        363⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        364⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        365⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        366⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        367⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        368⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9840
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        370⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        371⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        372⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        373⤵
        Modifies registry class
        
        PID:9696
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        374⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        375⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        376⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        377⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        378⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        379⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        380⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        381⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        382⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        383⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10344
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        385⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        386⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10428
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        387⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        388⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        389⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        390⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        391⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        392⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        393⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        394⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        395⤵
        Modifies registry class
        
        PID:10800
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        396⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        397⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10928
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10968
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11008
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        401⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        402⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        403⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        404⤵
        Drops file in System32 directory
        
        PID:11180
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        405⤵
        Modifies registry class
        
        PID:11216
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        406⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        407⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        408⤵
        Drops file in System32 directory
        
        PID:10340
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        409⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        410⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        411⤵
        Drops file in System32 directory
        
        PID:10516
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        412⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        414⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        415⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10828
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        417⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        418⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        419⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        420⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10952
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        422⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        423⤵
        Drops file in System32 directory
        
        PID:11100
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        424⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        425⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        426⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        427⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        429⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        430⤵
        Modifies registry class
        
        PID:10652
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        431⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        432⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        435⤵
        Drops file in System32 directory
        
        PID:10872
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        436⤵
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        437⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        438⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        439⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        440⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        441⤵
        Drops file in System32 directory
        
        PID:10684
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10836
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        443⤵
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10916
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11168
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        446⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10736
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        448⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        449⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10624
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        451⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        452⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        453⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11308
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        455⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        456⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        457⤵
        Drops file in System32 directory
        
        PID:11420
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        458⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        459⤵
        Drops file in System32 directory
        
        PID:11504
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        460⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        461⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        462⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        463⤵
        Drops file in System32 directory
        
        PID:11744
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        464⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        465⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        466⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        467⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        468⤵
        Modifies registry class
        
        PID:11924
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        469⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        470⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        471⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        472⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12120
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        474⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        475⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12228
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        477⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        478⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        479⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        480⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        481⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11448 -s 416
        482⤵
        Program crash
        
        PID:11732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 11448 -ip 11448
1⤵
PID:11572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
89KB

MD5
196667075d9143aa06f031ff5cb8f4f3

SHA1
f3642382cbde5bcb71bb5731287a4a0f3339e664

SHA256
600a504ad8322a514633bf7342fc6690368e070da0ecf1c79045af6a7af8f227

SHA512
20e49a9349b967d556bb1b4a9d10444d40717e478516913f4ff48db5ac7f872d8bc55a9ba65f1917006090b34074ae59c191efa2b7be83ca49409e6c9a4c392c

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
89KB

MD5
060a895a7bf8295f1507e50dcae9fbd2

SHA1
a11d2f1c0d55f1b14889126f4be525472b02e2e8

SHA256
3efde589271c31b5f1bb9f08ac9dfd8fc25fb71246e31268703e97c064889a16

SHA512
0dc726722ff6af7429fdd37b3788a6326a310ae2b3a568ffa755e8601f530cd8278319f0184d540f13a3cae05298e758f0c2af896a5452c9610954eae072b921

Download Submit
C:\Windows\SysWOW64\Akanejnd.dll

Filesize
7KB

MD5
6817691359acb1c54507cc367b727476

SHA1
f039cbf87686929f32f4a063f896dcea08cfd69a

SHA256
763ef70106dc44b60b68e6559ab68fbc178d6d30ba016ad5b72ee0d0d1e87337

SHA512
906d539e151b5c0e50dcb5c21dc8457e128e367f5f42b14df9b06cee30076220e0b4fdf7189c2f1403b48d9cb63279482a0c4d61d86c9eb3b459bb980f43a954

Download Submit
C:\Windows\SysWOW64\Aldomc32.exe

Filesize
89KB

MD5
1bc2922c26d516b28dae09f3882a3ba3

SHA1
465ce78596f852f876cd354607115b31e237c9a3

SHA256
4071e1c4a4f8583741c6f89cb00b591244bb2e6fd928e7562396be8a121195bb

SHA512
485b4f6112ff5f0c9649adf77fdd937dd30f262c26ea29decc357335e998d7d7410bc399ec5053e8347c1876c16ede6629f31931321e6afaa1d6a364e5b927c8

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
89KB

MD5
963ebba173c2ac16aae9da499e8f3396

SHA1
ee7f3d3fe77acabc903216e4d9b1e45bcd088c22

SHA256
57e3a855e6c3e5af35ae753e475319e88cc3e3e0bb55394f8b08fd48b1d65b0e

SHA512
041ed7bb0c104129b10e5279d1267f5885cddcd69e5b276135ebf3c240a6b42ba3fcbf5965f9f066dfef6c12b93517d0a4261e08c777759f035be251af22d315

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
89KB

MD5
e2990bb87acf5a636517eaf550c983c3

SHA1
e05104d30d064c5afd3b9267259c7a607b804e63

SHA256
4095853b62f46ecb4aded820bece80ac27c6f8219ce8677558bd92f9cd1170e2

SHA512
93b9d239da7fef6bbbd3581f1cfde40397adf164446794cbd69e22624fd3d55e7c1d882a5a51be3cdfc96382155e6a30e004acb912053edb6668753cbb7d7289

Download Submit
C:\Windows\SysWOW64\Bblckl32.exe

Filesize
89KB

MD5
053db5a9e13cdf3447038f90525db439

SHA1
43d1567be7bed7a71c149ca9292808473df5ab51

SHA256
869e7fa9a21fdefdcee898f0a523c92b17cd6706d1208867d477d5ddd588f76c

SHA512
ee2d4fa93c8e12c588bb358ddb450c53f7e7db490a13920af7819429e314ae4676f30c814728b00bcd3b5c53f927e738ec7d2bc41a1f7cbd3f3ecdf25c4ce5cc

Download Submit
C:\Windows\SysWOW64\Bnnjen32.exe

Filesize
89KB

MD5
897c86c5507c73693a8909a1605a8ac7

SHA1
9f62bf85c9b7f3a97c2e91999decb4510f0b376d

SHA256
49230f72311120e47cad958bfe13863e85fdfac3bbca78288de81473814b5890

SHA512
ab749d90c090e915b9fea148391fc1cd16cfe7728d7626cc551a44ae2a1973d11fae7d92e691248ecc670ca905a772980b4f92524ec7e85eea00c9e2b35fb233

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
89KB

MD5
38d54a552e85f93f8a922121e02038b3

SHA1
317690d598911be6b99f7540b154c53ac6f101cf

SHA256
d377a0531170feff28928024130c33c54d4e8d6b3d6f607a0a1c784150d769b6

SHA512
f5be970b67b850e079d874f2963a485b0a34d6708e4e626298cd70b539794fe0afeaa2d354d37248ff8b40f4a2527515fb1b4fd1d846abf22b892f4a4bea9dd5

Download Submit
C:\Windows\SysWOW64\Ckpjfm32.exe

Filesize
89KB

MD5
9a601c5ad4dcda8ff30be7fbb6e36f5c

SHA1
1b9a557f0f6721a5d655d8cc21c3d2fe8fc985ae

SHA256
df427eff384c7920f5f395f711fbea7f0be6ffc7f344e44ba372d34117fd5ee6

SHA512
ac9f3605ab54d55666203af319fcddfc40d6d2f5f77b476314584f3a3712a6885fca6e22fa4cec6b8bdb364c9b04eb898796a6ef91c2cb20c2faf03769292a5f

Download Submit
C:\Windows\SysWOW64\Daolnf32.exe

Filesize
64KB

MD5
1cb3e769a907ca197941380fd1a8311d

SHA1
13fe06bee3a79b241fd9cb3c1032faa1ed522c3e

SHA256
ff5cb846b7f11b98b0bf9fefd45e7a4241fb01dc891461872f44c5c3019fc690

SHA512
fe87b28923a6c93bab007e5175fe173e3de78d38486f9014460023185eb507246edef272d32df5860e1df423207e8b29639f5c71b07506ff17ff9d7e648d6b5f

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
89KB

MD5
3587cd99ed7fb0eb79cd5716078aefed

SHA1
172e25f6ef63430389abbb05856c93214e54f06f

SHA256
f89f6ab854ab0eaf4e302f16add3b296c732ccfc3417026246a9f948422105a7

SHA512
a4be4c92bcb8feb210d12d2e4ca04353f694b7237744fea5ba24fcca716b4ac60b4ccb128c24a07607aa26360371b42e63a001fc9a41cbe602b0a2454a71f127

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
89KB

MD5
e5aef7c97c765307eb6ab69fee24e285

SHA1
10412e75864a54576002af448cba7e6c9acfa4d7

SHA256
1bc4eafd8b80e6a7d361851bb48df784f990cb82fe4d216f66cf8b17635cca94

SHA512
13c55008e2c9bc857bb50858dd2b85e1c429e42ae855f4c33014d5899b176fcb036ada71e24be1ce65faa9335c2b9515a4356d7eb3dc946d4dff613040f89e64

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
89KB

MD5
c79a3a505c29bd9573f3b50a7fea2ea8

SHA1
fcf315cabd2614e9ef4f1556fc83297a7da87a40

SHA256
b6684690dfbf848e710353b757a94e6eacd7a48421030a8567d06f7cc91738c4

SHA512
3df4d65d91f226c7eb522d02a51fff2c43c36fef7e47ac4442c85baa120cb798083e97bdfd433dcd64e29afd9d4a10d6f1ca880991f9bc86181d098430177c86

Download Submit
C:\Windows\SysWOW64\Gbdgfa32.exe

Filesize
89KB

MD5
7cb7dfe3b41ca8f779fa6aa8012982ba

SHA1
3ec68c87f5ccdcb5daffdfccaf8610e9ce7b50ba

SHA256
596e79f5fef505568bccfaa2c9f779428b8fb04689c91c89c94a12c2f26be7fd

SHA512
7db1e83f37c84328dee9c745bed123e5ad820c2bc2de3df615bf2a1033eff15f0edc66c3a29ecb498554f45a97747f4042ac4a13fb157ab947533222d7837ee7

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
89KB

MD5
1aef4f6283258e6587731e4cff890a6b

SHA1
d9072413344396bc3d7cd50bcfcc6e70ff4c8514

SHA256
0e5bbef9f3c57919086d312100c1e72c26e866254162d28e41533cce6ef48085

SHA512
ceea6bf2bd12aba17eb0903aa823837043adf1fae31fb9a01d70493bb242ad09b0bd0bb5bbe18097ac298a4969ad0b800802416f95e88d04f579ce756ef335d2

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
89KB

MD5
f055b1ccb7c16ca8c326a2d56a98d0c9

SHA1
0b777456d50ba54f1809d44975cbd4ac8320ae26

SHA256
d5cfbac5918ca27331ca3b61f878435214776ab1921efe166a9dbb24ecf8fbed

SHA512
c04189595343db98b9e7832e723a29f025fde2e30170a0f77a061f83b82b2d06541faa2a2f12191770e4e817a0fe348add57d3d749bdb6bdd664f78858faf240

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
89KB

MD5
2c6ad7097672ab30eb9ae337a57862cc

SHA1
5b3f2409a62fe09d9c1c8fcefa62d4773cd0d084

SHA256
df6039b00c2c52323e7fe0081ff4967afd09808266e0cfa289e64e9cb6245b6a

SHA512
ed70d21644093dca552027e8df5489a444a282cf19cc7d0bf2fa499c17e67e866068fd9a5fe709cf0d52261f3c8a2a7e4c56d68609eecd79caaa52216fa77d4d

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
89KB

MD5
a948255fdf1a79fb45573cfb1c0e178c

SHA1
1191e010024aa8609510f63cb8995e19864f5729

SHA256
e8f15bd5d1f39ac0458d04334202478a22648f3061cc215ac8e9ef9959fd6510

SHA512
650f461eea466bf4c26a933b13d27933008f9c30a731521cffa0b79f48cf47a283097cbeb448d118fbf547f1183f1551d56452113af2731274f5468bfb44d308

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
89KB

MD5
f9332aac0025d912740d853967f7ce33

SHA1
a44f2f92facda5c6d2e5e0c2538651fc97493564

SHA256
a0ce61ce863f958ca0f746f8f094b0a445bbae0bae83c4e65cd2b9aa09307e50

SHA512
9ae7866c03cb69e8215e8dcc2d26d64fa6a20777a20176544a6285957b46482fd80fa399d93c6b9c8b7adbf3adc6455a081847d1c22d358746f1d31d86f6d01d

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
89KB

MD5
096e320fcce0096a8328c629bc4ffa2d

SHA1
4a6610e73c2fc0a9327deae284718abf8f09d517

SHA256
0f59f9aa8ec3011c16062b3ad6ff3df7c79808b03ebb0128867a4637cbbafdf3

SHA512
3c84307df54b09bc0ad9435656cf45e4fdce98dddb1ad601fcba02bb5d4788e9c50fead544871ae1a40f8102c8989044000d3aaf6c27fd88701245b1bbd5db07

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
89KB

MD5
01a55830460f23a7a50effdc29e77721

SHA1
b2ec047a6dff9799258bb6796a5f47077de6df20

SHA256
8ec5102e5cbe8dabc4909add103f3b76177ac168cc98736af11ee078f3580878

SHA512
abc674590906f330dcdfd7d0da97bed3c22440082afc109d727819613886e41c078e3066be4229eb641965a71971ddbc739d598eb155b0acad556b93662b194d

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
89KB

MD5
f8ed28694a2b94acdf1db8222a320ee6

SHA1
af76a7433de326d13dab22a6a5c4cdb683d00010

SHA256
30aa118b2cd2d50dff405d144873bcd548c6bce5e20453a59e278469bd09257d

SHA512
5d0cece53d1b045354d38115153f0c5c9c2fcd725656d65cfa8f7da7517b6a27716e300b81bd7f96f892e9e5c8857546ff7cba8a401f0cd85cbf3ccf0556e8a4

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
89KB

MD5
71017e32d9d03c2bc9a81a41d01f4c1a

SHA1
27e3c064a06940408a3b96a2445fc86882ab2fa4

SHA256
cbe13ee847a2d4571b21abb10b3e95aa27b8f5ac8c494c0acb44b76311093479

SHA512
e340d186f8abe301f9ac51a7b5865986a8e48a53743393678f97acfe6a1a276e9ee1dae30718775140b9e58fd3ee3976afad143a5552670c1c86f3ce82227cef

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
89KB

MD5
8b4aed63b94138c339c7fc6a4f9cd503

SHA1
92c89d494d5c6d62baf5e47fd7524fdf53bb46e7

SHA256
c3485dfad1368b7bf9e4ed7209a8307390977b364f9446fa1844a4dc19f03add

SHA512
79bde9e7e357aaeaf8f2b45a9646cb6a82d871777811d15a3074728521ee8fbe7b480fadd078d5be4b41a214258c80b34de7139a3c7eda137f790378440cce91

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
89KB

MD5
dd035f11d77378822e5fa8743c9662bb

SHA1
c804c33331a2b42065a96ec7ba957f44f4170379

SHA256
6b524b5216548e70cd35e32a0ecfd16ea1e29c5ba8e0fd3e9f7be42c9d7f0694

SHA512
212b2c36482dc4437286e97fe805beb93e71790a0b682d9a7f2c2284b27a346ae430865595abfaa84aac29ff18c163a37e4839f036ecaf01ac6a7dd538b80874

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
89KB

MD5
07c7d4e7ae51a13383e1aba4cd42c5f8

SHA1
7279649410872a46955d7a51f18680c07f79eafd

SHA256
501aaff89e4e976edf92846609000fe0436102af5eac704a38e7da7dd762731d

SHA512
3024f87b9527534cad05db06430858d484f4123261a465d67236ce91748a672a05a187cc0b1ff9375cfc231e403b86ef8307c650c3373b4fa23d85e04f6dc193

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
89KB

MD5
563129b3208fd52ecd156a9ef6c0dc27

SHA1
0a85b2bfafeb53059401c43a4a53a28882993725

SHA256
abde1409db7e4ad176f6e9bc280bbc5590777904fb4a3ddd6dd77536817ad29f

SHA512
b5b7bd7884fac2f973a313e9964f1ddafc35d1d671cf4dafc7d2ae253c8dcc446d33b3bfe1a43ee150c55b8b6c6cd7005e3cbe1a88ba54d39504b70bb2b9438f

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
89KB

MD5
6a8077a3c8e789edc95cca9dd58669d6

SHA1
8e7afb335f792e7a7851e2e7376d6414b5f0b3dc

SHA256
df29df74b635b20b0dce53ae3edd49e3bd814073e267d7161080224700bed7e4

SHA512
a74099d5cd589f31ca5b06b587e7d5b3810d124166f776506331b24cc023e0718277b847704cb6a84d81976d6e70ba4ea2db80c7969f6ae70d9b7bc6c541a68f

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
89KB

MD5
561d7080e0fcbae198cd127d74590ae3

SHA1
0d1cbb41387c39157aac6ff18e42577a671662f3

SHA256
c3f69afa9a476e7789695523ff41d40d5c823c8d0049432b1706cb97cd3804e5

SHA512
903f2ab313a24573f9d3e5f0b83d6abfccea9320bcc7dc7eab9be8347ebd5fe97c39722d60558e3326ff33c433c2a2dbf2b41c51dfd1df07d05b9dd955c8d1ae

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
89KB

MD5
1911eb9c2a1e2ab4f88a58afee97c7c0

SHA1
e97624b3a3ca8af8a76d1a836117c8d212188e93

SHA256
155243a1624b157fc1a4f06f12dfa594dea275c89e5dbd52b164420d42d750ad

SHA512
016c2d946c3dc76afb76fa90cf4a74190193a75e10a4a67f077594d2fb54d1947e1e7844996aec1635725ed95b64e2f7c93222625890c50def71cb15ced42618

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
89KB

MD5
85b51ae77212ae534afb252456077da1

SHA1
0532fa44615e703d45244e0af6e6007cb3a60d56

SHA256
9b251145c90ee2ea2e73e815dda6109d75d5507e78cf98b08ef76d4335ee7dae

SHA512
079877ed53b59fc6f94892ceb49606c3677b21aaf5c565a5d025b96b882be7727349bd2490dd22e8bea4f5869845a9afcf4844e4b735d96459ea6410c5cd0246

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
89KB

MD5
090aeae5bc3a3388075de833e8bd23c6

SHA1
524aeee82087aff33c8afc7029d6643a9954e152

SHA256
1c9fe8764189f366d9ae05d24ab19b857a7bd58722145d4f1522892f6c543d8e

SHA512
02e0ba4bd12ebf513c178a0c78a3ed9ae90a1c49e4dfe47775d5fee3b1710642479784db5b8999d71140cbd09c065ad80244b0d62b6433a936de19d2a296fd3c

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
89KB

MD5
7f342dbbd902a71ac11dc2996ca62b6f

SHA1
cce52f103113fb28619f5525af5d326491a89b7c

SHA256
3bcd5ef89a2a5af5c0a0b8b6282706238dce256c75c06ceffb2eb95658488511

SHA512
186a25f48fd8d4005b591aa400fbb09bc129657917e0a254ed51274a80598905779f93905e7baa264b750697865c170ff8a1faf6003dfbd6a0397022da4a82f6

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
89KB

MD5
c37380f2ba2fb8a69a902cb79fbc3686

SHA1
93dcbab948e721f06f46ce932c2942189aa5938c

SHA256
b641380246a5d755af23fb4e736f5944cb18cdf8e9bb7aa664eba8a933cf75ea

SHA512
1b75ff156605d4b2d67ed7bc2472c5435f718692990318d63ffd7108845aeca1deace64b09bbea07cd2378a893c131c7463fbf100b60b4f191e0f9ef3d54a5bd

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
89KB

MD5
82cabe0c0a6464be74dc751665c27d5c

SHA1
a91e9ad8d4c90d7827b5faf5e3e58b3699d6ca9a

SHA256
61f8086265216281f5cdf2104cb00148ff4985f9ee56ef96cf987bc444b80b6c

SHA512
cc32ed4eef6d4b18a4edf0bbdaee9208201f788f46619e53f5122d70ba5954d3dde24ae1b026dd80fb877e44bd1fad8696228edc0bdc5898c50c6bb57c83e9d3

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
89KB

MD5
e379eeb1ef0ec08ceaaeb15545f9d6ba

SHA1
bb5414d6b0bb845165233b5d8a96343cfc5b3ef4

SHA256
73470417864643efa67671580338465f24035bb3df2ae7da08bd8d359e922447

SHA512
8c3630d9b500be803d2e6250b77a8ea5cc821f096091e7e136384c4399715e7c5e688ebfccb8a0a5a213a527b8e682456a1ec0696ff3d40b1bbf52cec5706f67

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
89KB

MD5
ea0a5f4433e4b196fa1e8484adb35a7c

SHA1
ea346694876abb72aea484b06019d6e9ede8302a

SHA256
0553ee607e4098f32327fa012af1cd6f2fc9ae2d978d22aa217e5e7d576b7c58

SHA512
494b9934ce679f12d1838789ce538d657d74f1469c021063de105ba5dd37aedcf4cfe5bfb13d48826bdb6cabd025d7432a798119b263f494aca3ac461273c9b2

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
89KB

MD5
1041f024335a3bf2eb8f1d31b922daf5

SHA1
ea8fc2f033b66ab0079ae541d9a7684979bc47fd

SHA256
cd631f3b57066b02ac9e31b0da649d2e22248227e566607efca56018053ffd5a

SHA512
8c44f6eec2a3c36bb91195a0a4afe35783935064ca6acb1e0c1bbe5abc60d0b1463bba887d44a6079a14b53d73b875b33df41ebf205aafbd8041c305a0ee5040

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
89KB

MD5
5aae6e886f26630732ae62582ae26410

SHA1
d6e1a00132c28b292c71834efb96a87a1c5c12af

SHA256
22cd06e6e08b4b46a06b0b7e9209e9932af443df64a03085442c726f69ec9cf8

SHA512
78bf22b8285d692cab2e0988d1a0ed8e01dce2c44404d0a03e4ea956dbc2a799eb0a73fa4d21d800c0795ad9917b80241442b9561fddac225893c881c730568d

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
89KB

MD5
9279eb84ab8b74477ec19d1a62a11391

SHA1
69a729a09e7ac4c2c448461b81b8e454f1611120

SHA256
e8ffd173f862b0dd6492d1b02ae951cba1880b21b25993b412277c2d8802beaf

SHA512
18fba4c382fcc418007a4766d5b23f1f49cefd67631ed3ef4681f72e4a93c58fddf07b217830a3fd4e4bb7dbb27b0e332246b6775d63f148e71ccb8c9d944c4b

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
89KB

MD5
419f8034e48de5d48b9f7082136aa3c6

SHA1
07d0eed731691ffe147ec312e8853898e9bb5afe

SHA256
c12a5acd8873aeec594fcbc7737506720094841f2c1c4f3067f20255fce67f45

SHA512
f5d5267b0774ab68382c2f6a8af981633e42ebaeaae908ee8fd7f6d3355c9344ca59335c2ec07ae5f078fda8ac2d0af0cfd36a7ecc93322970814af99ea248f4

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
89KB

MD5
261a84bade3c6c37343bbc41ba3741c4

SHA1
807d0a0c4e296af8323bb9bfc11c86514cca9a3c

SHA256
41634806c1f8bfc960492416fb2b40c9789847645a3141671c51442c35b65100

SHA512
6903d5185799b4b35f538a1b80f1249a3aaa9a7fccb6b5b9fa859661c7cfeacb8a417fe86f8914d93a18ca1659524071f7829678a92848e31dd42668e040c0a9

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
89KB

MD5
0ead388a1603c272a573dba8cea4844d

SHA1
5884ac48d2acaa86692f3140c9d3c9abc5e791e1

SHA256
2631a485006c8c695c102c11843a046a43b83ce4aa629fd27876a75420fe418b

SHA512
cc37f0b44b4ca35ea0bcd82bdbe5b4b7ffc79e571ecd669431309387a6a09965bc45770aef5fd01cb75f723fdd6c381cd63f0c23179d21d633467e06d390686f

Download Submit
C:\Windows\SysWOW64\Lklnhlfb.exe

Filesize
89KB

MD5
2eb59d6d45e69f306961fb13155bf715

SHA1
7ec90cfef0ebd520ce953dcb9bed089bd3f8ce9f

SHA256
35be00f759183d1d5d0916739effb40c5b69caf781f8d26f12fb230cd71e9a9d

SHA512
a2aa3b99d849584aa95f7b6ded1f74d4b65d0a0cad0a5af2cd45e96eb351c315949fab90b157e00bdfe2e191b0a2772df72ce7d69d2a8e219cf0d699838d034d

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
89KB

MD5
a45fe11bff7506df19015880fdd9dae9

SHA1
65da22f6bc9e3ace7970320f43f43ee80cfa7c6e

SHA256
1a435cd32816456b6625a447edaa5f6d92cee49417f730bae9fb30b15596e064

SHA512
83dbd3d0909c5d8a06f33973160e203492fc6a92c13f208ac4cb389f5ad1aeb3df11fd622b34e2b99432d80921886c70fb667a22d9aa0d4bf96fa31ed7702f13

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
89KB

MD5
acaa7648047916626fc68c45a72316a9

SHA1
be557221d47f056c62204d2dfa42b0240b1230c3

SHA256
ddda3ec5293ea116ae213b7ac69bd016a2aa87252597745d88f546e72d911e27

SHA512
3755653063a1f60f948fb23647b035680be70288caddee89f384d19be1b53da0e59995550574b1ee323d1e9a5f17b31abfc7429c09da541bd72bc908103e1a8e

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
89KB

MD5
c1904cbea3fbc2bf63bf7dfe51caab87

SHA1
479268eba7ca61d0d0838a8840fab5ba6f773e52

SHA256
be5ae190ee5217154758e97c4e746e85d461ba7a0ee9e61b9fd9cecc1eebf6dd

SHA512
66c34a505093692cf1fa5b61b1398cf71550297163d1267d6db6b7e2870ac4f32da5f8fd899338e69f8814cc34fdc4b9e6a0e9a16560f0cd8f7c82da5948821c

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
89KB

MD5
5ffda2ed3d3bc55dcbd4db66c8c994a0

SHA1
c9154f0ace2446687fc7f88d7c2de4d2675d42f6

SHA256
267f4edac2182f409e344629b5c8209728c813525e7c031b7a18b882e5f7cc9f

SHA512
4ea0c8219861ed126adb370bea986578ec50a016bcf333bc8626422f82aa0f66ccdde6c1e7178f3a7d3b2484aee9197b3fc8d59fd5d06a77f9b83c4a89ca3027

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
89KB

MD5
c6a9b8e3e63d08a7eb67768c2cb4ba69

SHA1
3fad018454a6ca23efacf3c7416cce6d58d89e93

SHA256
d6b2d2973d8ac95818aa8de12eee5070d6a90a3d00121dee6cd2e8f2f3e360fa

SHA512
a32ddc395302f2a2ffff5f9d3fe71e14117c4627ecdbeb723cf92d80a36fc8b105fff8c69dfd4277fc4e98f7cbd6c728ee836612f8016f541c4ec5e68fc0b820

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
89KB

MD5
ba9cced0c850e9739e550543a26ba488

SHA1
847a4bcd657052a2d01a69869c53fa0a105aab1f

SHA256
1b4ce49b37eb825697fa2b0fb6da23180c9ffd57a3ac6ca2a51b248542a05ee9

SHA512
419a7db17bbaa618e4c7702caa0ae7da6df931492c6bf687ccea4049dab03b2c42ba29a713ebe4f4dfaeabb3eb544f26917d6b21d8cad259afeaf6bb53f5c161

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
89KB

MD5
b04593912331e6cbdb348e31d46d9a8f

SHA1
d8175378c08d3cc1cc2407bcab342826d691bf94

SHA256
2d36f1cae9b5dc342e7e482112e014c6fd2cbcd753e7b64fe59d0d6064d1e4ab

SHA512
340b3cd594ccbee835b6d1e3eaef33f419fed6c55460e063ec5175ae45a75272ee67bd5935ada87438a32892ff1edaa27e73eccf86aa41f77e290c9da68b6831

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
89KB

MD5
05863947c61109dfb92ec8111608559e

SHA1
265cd7b42aa9f43ea862c1b91e8dd485ccb7c66d

SHA256
e0be0939a42c71485a03d2e02a3eba7a1caed6e66e7cd261cadbe47a5477852d

SHA512
22f1aad63729178f65d77f47d1569fc6d0cf5022ef7ba0d320c76e7086378e1461061093efc4c4572274540b4ed45a39290555b4497eab8c71441e21a00ca468

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
89KB

MD5
eca4e528abd2f8087b9b259a6b06e952

SHA1
5e29ef4fffd2bcbe7ccddc70afa185cef99f6f0b

SHA256
b066b8495a75c73adbf4c37ce900e4f600459c308597f07f402820492f3998e3

SHA512
c9866ad1f663acd773b1fc63c2266daeebeb0a609cefe1abe4a8355079b910a52a7215d69ed5d4a1ba1d9807ffd7841da829abc3d740c1198a7a3c482bdedf58

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
89KB

MD5
1e928bcadc05db3fe02bcd30bbd17350

SHA1
8b4eec01e597f8f2612d3a708250e376edbadbca

SHA256
8b18d6c3bfcfe2fcc9618884d0c3692998cece2f27a8f074ed6ed6004095fc63

SHA512
5bcca4c716bc35273c49f91ba99eddac5ecf2adff96915c6f3ab00e06503945e4bb2016d6d81fee3b65951b326c8539bdf72e6b027f0b54e7fac83964ee4dd35

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
89KB

MD5
155daf367993cd229a8bcca009134ae5

SHA1
e5ef4de79b6b9a4d6f2bc1e7ef11018a7abc4f9b

SHA256
07c0d235e7e1e27db3cfafbf7d210e1a4925252a24c4dbd5e8cf5e159b0156b3

SHA512
332b1f6c35d0035584e32c6eba7d4e80e382f689f73059c5e9be758b8ec0f887e9e01c6451fff7f9a4e8993e16eafd020b45f8c25e43dc2ed37a570cf0f9b889

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
89KB

MD5
8e65fe66b8ef7eb682329065cc1e156a

SHA1
e6a96ad8731d5d05b4e526db607e99eaba6ef9f4

SHA256
2377110d026ffac1177bc8f7cb5ff568a7943a13b501cfcc9f9fa51c79f57bf5

SHA512
fbc8c4f09c72c777dcc537cd1db348f02ecf2c79b732533a120171bcb784c4c1f6fff33d3ba7d0e54f4001c151399f189b9643020f235762ff74a34693f004e5

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
89KB

MD5
a4ed4fafb6e5253b359b8c653199bbd1

SHA1
a4ae618dc47a936528912ca16fac0df5935a07e3

SHA256
ba9b1c8355c851672c9deb6a71ab62e3bab049e8553f074ead3255f00e68c9d8

SHA512
834323e0e38c50957c3c03bdcfb7c745e26e964d4d4a5ebe463cb3787c3ed9311f3ea45fcc557197458bb87350cd119451382ae01d48a8eb2bc99be0127c1e1e

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
89KB

MD5
30229800909bca7a4b3bcd5bc7f1bd8b

SHA1
eaae6fd046f3dc1324bbcd945cdf08b69351a66b

SHA256
011092163ae7920be387e1dee9911995d14f2809807b4bf545cc8ca178ef0d1f

SHA512
01af40c84d23c504ce89ac5419dd16d6ed22be26dd2dcc346d9b75551c85c0ae36f100a04928271075080d14a573a2dbb760403ea92b1d93fbd2f23633583115

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
89KB

MD5
3dc12df3332a99905a7f6495d1a6d7c8

SHA1
97a49851f6aba3f8b6979491fc9a5d44ce655544

SHA256
3285f3d420c508bcb5f37f7fce9cc95f7c848ecb505ae6eeaceb0b7486f5a8f6

SHA512
b4437141f3efe5b6ad7e5e52024c853c68eb4f75139a1d383ea4e270aed858f6cdd2c29486fdb0296e43a0bd46192a86eb668bc739864b56f6d52aee47c36834

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
89KB

MD5
deac1944aec48d3526d5b2443bb0b632

SHA1
cbcd8ee61c3077c34fee1a35397d42b0a9481436

SHA256
cc8bb055ef2a3876b5207b93dbaeaeed916814ee46a79acdf1f902457c82059b

SHA512
5c2594ae155057f28a417853534dea147b60b8ccb2a8fea0307a7283ede8ec814a9f1b4a2e681b72ec33e5bdde0c49ff5a3fd9a6aa52d24cd5985f363adc0404

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
89KB

MD5
8ea7f154487133b43dc552ff76daf5ad

SHA1
3f016951dc85c8a0e21188c6ee5808ea3a1f0c1b

SHA256
374c9c21b8c8fe89d201df0f60dd35022dff5478058f7e698eec2f902d13ed77

SHA512
f6f9166c0e7db9ace9b998fa6918e00d38d1f4a3cb9f396e5b26c6e432b706808060a2e1344447fcb556e4ec001992fcaff982e8915e00850b4a087e1ca9f87b

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
89KB

MD5
224eee6241f0f549627dd0f423035bd0

SHA1
6393f6e3bc60ed56571de336f5d8fc32424a96d3

SHA256
7cd34bcefdd4367e5a46ea34d3f4cb84a3382968d87538ff5ea4699c2d6eb266

SHA512
69c181b46caf0d579d4f7d7b56373e7f2358f8f6e18616661568348d2cdcd5552622a04af0791796e7e08aeef38babf36409d151727ab9cf3b7b470e67678a10

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
89KB

MD5
e7b0143b1dc39db2e528d11b5ba385d3

SHA1
4bf361c3449322ca1e71267ba682d22832154387

SHA256
fac06211e61fe0bcae765ee559bb4a99a389b3e041450b035dc02763235966d7

SHA512
ac45a088e2a86a009e7973f589500dcc1d98010a064b5b5c8c16b6aa49cce5b70dfc3e101f16b28fa0f0dc4656834549403c4cd9bb94ea1f9cca20bb712571bf

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
89KB

MD5
4c6fcd7a1b298459a5eacdc888a81e23

SHA1
7206b74d6ed574510fd44770548191343ef3d200

SHA256
6ffaf3b96514e5f7fcca73872f3bc24a8bcbc450299db82e52fb76c7854eee20

SHA512
0a5e79742e54c95d0649c3c4e23b03b05ef6a54f72e0e8b3bca11ef13a982e22c63a6b70565d15603b06d05afd646f38e926fff3a236dacadcbd20c1f16242a7

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
89KB

MD5
ff2ef725d6b2eaa61e6e1dbe09c6c7b0

SHA1
d1077f800b45330c60e84459d13164459256ad37

SHA256
a53efcd673e706c1b8179a1ebe0933eaceb76061041b4107effeb0b884a01caa

SHA512
9d21f01ae51cf0c6799fc92a3a280b9a737b9a7c9f63c64e8402e70374b9a1a28dd8214d829601e9594edb4dea78cf8762233380e5db8ac8afb59b66a7d79b8c

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
89KB

MD5
ade5caf1acf0d857c10da1580f6f1737

SHA1
fdcfb2c26da984472ea84d64b2fac8b9ffbdd9c1

SHA256
a22e6a0c3957ce742bcf649200922d97de456db48565cfc5b1bf10009467abc2

SHA512
9afd3f4fa272b242f9f8df3b478b89d1973eb9b2f50cf25857555a877950dc7f9e44d95eca2ee6e018e43f2ab4ce7a6d38a1d9e18a4f7a9d14331188b6b5772e

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
89KB

MD5
f8e19b147b2c171eb459cc6e6bf3b062

SHA1
680ce93ed248d77facc683e685ebc223a737926e

SHA256
e5a7a5b58918face92509501849ceb085f2f0c8f79de2dc937daa4f12f409404

SHA512
9f12e21e11f9737785a2cba3be422cb90a965007f432738cd8971ac5d91c66a09d169968746e297f2d9dc76d1a3f7db628a3e0da05af489ca445fda54012944b

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
89KB

MD5
3ce53ce0267638f6deee38d06709b2c0

SHA1
2f3d03a42c89ee00c968b1a81602014680e772fb

SHA256
5b64dc12c192a037afeb80c75398abf0a7b300dd1549f9416cdb8a6a9dab017a

SHA512
5f4ebbd8de06370c14d5e3bc3ea7a1870c21b46dd3e2c1c550a1cc89590d866241a60a70695c051ffa1f01678b7336a9a09e82bf3488a7cb65fe688d65013ef5

Download Submit
memory/116-244-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/220-532-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/464-578-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/544-213-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/680-520-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/808-229-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/976-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1016-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1048-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1048-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1100-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1204-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1432-471-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1492-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1600-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1616-565-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1616-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1744-458-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1760-538-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1864-140-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1892-87-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1900-490-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1948-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-576-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2108-579-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2108-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2132-296-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2148-514-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2160-236-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2172-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2208-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2240-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2260-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2292-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2316-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2316-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2324-460-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-545-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2436-119-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2452-104-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2684-544-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2684-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2824-362-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2984-531-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-500-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3192-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3224-551-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3224-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3248-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3432-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3460-392-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3520-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3624-83-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-590-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-252-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3740-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3744-592-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3756-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3776-221-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3832-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3852-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3928-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3984-557-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4240-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4288-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4352-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4372-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4392-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-151-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-380-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4468-100-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4472-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4504-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-478-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4776-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4784-278-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4820-448-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4844-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4892-387-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-508-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4960-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-472-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5080-171-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5084-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5100-484-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads