3c2bd16d6271533e9c64430d55394560e6b662079543e6644ae4862b0e24c005

Analysis

max time kernel
149s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe
Size

347KB
MD5

81815a906d6fb410025df6f493c9f8f0
SHA1

bf9b12ef6213d7595d442d0e0c9d224f24f13a91
SHA256

3c2bd16d6271533e9c64430d55394560e6b662079543e6644ae4862b0e24c005
SHA512

3cedd67fe2990396e0b1271d4c27bc2064e9cc55073fca0cf0055912a4e05324a4d29dea544ce21449728711ea38d1561a7656660d81ce1b19d5c71fda675771
SSDEEP

6144:YAF+75Y7a5Mx4brq2Ah1FM6234lKm3mo8Yvi4KsLTFM6234lKm3qk9:YA87ox4brRGFB24lwR45FB24lEk

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmhja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkmlofol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldoaklml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehimanbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihepnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbklofb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deoaid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqncedbp.exe

Executes dropped EXE 64 IoCs

pid	Process
2972	Bhkhibmc.exe
1496	Cbqlfkmi.exe
2888	Cliaoq32.exe
1644	Cogmkl32.exe
1672	Cbcilkjg.exe
3340	Ceaehfjj.exe
3732	Cddecc32.exe
4988	Clkndpag.exe
1716	Cknnpm32.exe
4708	Cbefaj32.exe
3524	Cahfmgoo.exe
4296	Cecbmf32.exe
1752	Chbnia32.exe
1980	Clnjjpod.exe
4016	Colffknh.exe
2764	Cbgbgj32.exe
2492	Cajcbgml.exe
2988	Cefoce32.exe
3268	Chdkoa32.exe
3648	Clpgpp32.exe
4964	Ckcgkldl.exe
3668	Cbjoljdo.exe
4592	Camphf32.exe
1580	Cehkhecb.exe
4304	Chghdqbf.exe
1864	Ckedalaj.exe
4496	Doqpak32.exe
4616	Dbllbibl.exe
2732	Dekhneap.exe
4092	Ddmhja32.exe
3104	Dldpkoil.exe
2788	Dkgqfl32.exe
3688	Docmgjhp.exe
2336	Daaicfgd.exe
3248	Demecd32.exe
2620	Ddpeoafg.exe
648	Dlgmpogj.exe
4192	Dkjmlk32.exe
3012	Doeiljfn.exe
1696	Deoaid32.exe
1044	Ddbbeade.exe
3032	Dhnnep32.exe
2016	Dlijfneg.exe
1648	Dkljak32.exe
3692	Dccbbhld.exe
1988	Dafbne32.exe
3040	Deanodkh.exe
4380	Dhpjkojk.exe
1760	Dllfkn32.exe
4772	Dojcgi32.exe
4360	Dceohhja.exe
3260	Dahode32.exe
776	Ddgkpp32.exe
1720	Dhbgqohi.exe
2968	Ekacmjgl.exe
4924	Eolpmi32.exe
1312	Echknh32.exe
752	Eaklidoi.exe
3704	Edihepnm.exe
1132	Ehedfo32.exe
4516	Elppfmoo.exe
372	Eoolbinc.exe
1436	Eamhodmf.exe
4216	Ehgqln32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Eadopc32.exe	Ecandfpd.exe
File created	C:\Windows\SysWOW64\Jmmjgejj.exe	Jefbfgig.exe
File opened for modification	C:\Windows\SysWOW64\Kfoafi32.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Kefkme32.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Gilnhifk.dll	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lingibiq.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Clkndpag.exe	Cddecc32.exe
File created	C:\Windows\SysWOW64\Colffknh.exe	Clnjjpod.exe
File created	C:\Windows\SysWOW64\Dlijfneg.exe	Dhnnep32.exe
File created	C:\Windows\SysWOW64\Paihpaak.dll	Fdialn32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Jinpgcmg.dll	Dbllbibl.exe
File opened for modification	C:\Windows\SysWOW64\Hfcicmqp.exe	Hcdmga32.exe
File opened for modification	C:\Windows\SysWOW64\Ifllil32.exe	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Dekhneap.exe	Dbllbibl.exe
File created	C:\Windows\SysWOW64\Eoolbinc.exe	Elppfmoo.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Flqimk32.exe	Fhemmlhc.exe
File created	C:\Windows\SysWOW64\Jbhfjljd.exe	Jpijnqkp.exe
File created	C:\Windows\SysWOW64\Daaicfgd.exe	Docmgjhp.exe
File created	C:\Windows\SysWOW64\Bqhimici.dll	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Kepelfam.exe	Kfmepi32.exe
File opened for modification	C:\Windows\SysWOW64\Mgimcebb.exe	Mpoefk32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Cbgbgj32.exe	Colffknh.exe
File created	C:\Windows\SysWOW64\Nggjdc32.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Fbegho32.dll	81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Gkmlofol.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Oddmdf32.exe
File opened for modification	C:\Windows\SysWOW64\Edbklofb.exe	Eadopc32.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Aceghl32.dll	Kmfmmcbo.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Kiaefcan.dll	Dlijfneg.exe
File opened for modification	C:\Windows\SysWOW64\Febgea32.exe	Fcckif32.exe
File opened for modification	C:\Windows\SysWOW64\Ncdgcf32.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Echknh32.exe	Eolpmi32.exe
File opened for modification	C:\Windows\SysWOW64\Ghlcnk32.exe	Gfngap32.exe
File created	C:\Windows\SysWOW64\Enoogcin.dll	Hodgkc32.exe
File opened for modification	C:\Windows\SysWOW64\Hkmefd32.exe	Hkkhqd32.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Lfkaag32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdina32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Qnhahj32.exe	Pfaigm32.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Llemdo32.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Ddgkpp32.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Jjhijoaa.dll	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pflplnlg.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Ldoaklml.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mnebeogl.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10128	9980	WerFault.exe	458

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngndc32.dll"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcdak32.dll"	Hkdbpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpaqkn32.dll"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eocqqdjh.dll"	Demecd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnmqkjel.dll"	Fcckif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbnapki.dll"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnbinq32.dll"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaqfok32.dll"	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlgbon32.dll"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gicinj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akalojih.dll"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqlbaq32.dll"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdkpdef.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcgdgamg.dll"	Cefoce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eapedd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgbbfnk.dll"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjqaij32.dll"	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmcojh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhondp32.dll"	Gohhpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfifmnij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlefklpj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2972	3468	81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe	84
PID 3468 wrote to memory of 2972	3468	81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe	84
PID 3468 wrote to memory of 2972	3468	81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe	84
PID 2972 wrote to memory of 1496	2972	Bhkhibmc.exe	85
PID 2972 wrote to memory of 1496	2972	Bhkhibmc.exe	85
PID 2972 wrote to memory of 1496	2972	Bhkhibmc.exe	85
PID 1496 wrote to memory of 2888	1496	Cbqlfkmi.exe	86
PID 1496 wrote to memory of 2888	1496	Cbqlfkmi.exe	86
PID 1496 wrote to memory of 2888	1496	Cbqlfkmi.exe	86
PID 2888 wrote to memory of 1644	2888	Cliaoq32.exe	87
PID 2888 wrote to memory of 1644	2888	Cliaoq32.exe	87
PID 2888 wrote to memory of 1644	2888	Cliaoq32.exe	87
PID 1644 wrote to memory of 1672	1644	Cogmkl32.exe	88
PID 1644 wrote to memory of 1672	1644	Cogmkl32.exe	88
PID 1644 wrote to memory of 1672	1644	Cogmkl32.exe	88
PID 1672 wrote to memory of 3340	1672	Cbcilkjg.exe	89
PID 1672 wrote to memory of 3340	1672	Cbcilkjg.exe	89
PID 1672 wrote to memory of 3340	1672	Cbcilkjg.exe	89
PID 3340 wrote to memory of 3732	3340	Ceaehfjj.exe	90
PID 3340 wrote to memory of 3732	3340	Ceaehfjj.exe	90
PID 3340 wrote to memory of 3732	3340	Ceaehfjj.exe	90
PID 3732 wrote to memory of 4988	3732	Cddecc32.exe	91
PID 3732 wrote to memory of 4988	3732	Cddecc32.exe	91
PID 3732 wrote to memory of 4988	3732	Cddecc32.exe	91
PID 4988 wrote to memory of 1716	4988	Clkndpag.exe	92
PID 4988 wrote to memory of 1716	4988	Clkndpag.exe	92
PID 4988 wrote to memory of 1716	4988	Clkndpag.exe	92
PID 1716 wrote to memory of 4708	1716	Cknnpm32.exe	93
PID 1716 wrote to memory of 4708	1716	Cknnpm32.exe	93
PID 1716 wrote to memory of 4708	1716	Cknnpm32.exe	93
PID 4708 wrote to memory of 3524	4708	Cbefaj32.exe	94
PID 4708 wrote to memory of 3524	4708	Cbefaj32.exe	94
PID 4708 wrote to memory of 3524	4708	Cbefaj32.exe	94
PID 3524 wrote to memory of 4296	3524	Cahfmgoo.exe	95
PID 3524 wrote to memory of 4296	3524	Cahfmgoo.exe	95
PID 3524 wrote to memory of 4296	3524	Cahfmgoo.exe	95
PID 4296 wrote to memory of 1752	4296	Cecbmf32.exe	96
PID 4296 wrote to memory of 1752	4296	Cecbmf32.exe	96
PID 4296 wrote to memory of 1752	4296	Cecbmf32.exe	96
PID 1752 wrote to memory of 1980	1752	Chbnia32.exe	97
PID 1752 wrote to memory of 1980	1752	Chbnia32.exe	97
PID 1752 wrote to memory of 1980	1752	Chbnia32.exe	97
PID 1980 wrote to memory of 4016	1980	Clnjjpod.exe	98
PID 1980 wrote to memory of 4016	1980	Clnjjpod.exe	98
PID 1980 wrote to memory of 4016	1980	Clnjjpod.exe	98
PID 4016 wrote to memory of 2764	4016	Colffknh.exe	99
PID 4016 wrote to memory of 2764	4016	Colffknh.exe	99
PID 4016 wrote to memory of 2764	4016	Colffknh.exe	99
PID 2764 wrote to memory of 2492	2764	Cbgbgj32.exe	100
PID 2764 wrote to memory of 2492	2764	Cbgbgj32.exe	100
PID 2764 wrote to memory of 2492	2764	Cbgbgj32.exe	100
PID 2492 wrote to memory of 2988	2492	Cajcbgml.exe	101
PID 2492 wrote to memory of 2988	2492	Cajcbgml.exe	101
PID 2492 wrote to memory of 2988	2492	Cajcbgml.exe	101
PID 2988 wrote to memory of 3268	2988	Cefoce32.exe	102
PID 2988 wrote to memory of 3268	2988	Cefoce32.exe	102
PID 2988 wrote to memory of 3268	2988	Cefoce32.exe	102
PID 3268 wrote to memory of 3648	3268	Chdkoa32.exe	103
PID 3268 wrote to memory of 3648	3268	Chdkoa32.exe	103
PID 3268 wrote to memory of 3648	3268	Chdkoa32.exe	103
PID 3648 wrote to memory of 4964	3648	Clpgpp32.exe	104
PID 3648 wrote to memory of 4964	3648	Clpgpp32.exe	104
PID 3648 wrote to memory of 4964	3648	Clpgpp32.exe	104
PID 4964 wrote to memory of 3668	4964	Ckcgkldl.exe	105

C:\Users\Admin\AppData\Local\Temp\81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\81815a906d6fb410025df6f493c9f8f0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\Bhkhibmc.exe
  C:\Windows\system32\Bhkhibmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\Cbqlfkmi.exe
    C:\Windows\system32\Cbqlfkmi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\Cliaoq32.exe
      C:\Windows\system32\Cliaoq32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        24⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        25⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        26⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        27⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        28⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        32⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        33⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        35⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        37⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        38⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        39⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        40⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        41⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        43⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3032
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2016
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        46⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        47⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        48⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        49⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        50⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1760
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        52⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        53⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        55⤵
        Executes dropped EXE
        
        PID:776
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        56⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        57⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        59⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        60⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        62⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        64⤵
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        65⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        66⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        67⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        68⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        69⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        70⤵
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        71⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4724
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        73⤵
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        74⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        75⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        76⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        77⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2980
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        79⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        80⤵
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        85⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        87⤵
        Modifies registry class
        
        PID:1028
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        89⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        90⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        91⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        94⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        95⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        96⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        97⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        98⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        99⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        100⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        101⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        102⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        104⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        105⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        107⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        108⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        110⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        111⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        112⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        113⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        115⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        116⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        118⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        119⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        120⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        121⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        122⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        123⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        124⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        125⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        126⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        127⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        128⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        129⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        131⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        132⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        133⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        136⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        137⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        138⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        139⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        144⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        146⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        148⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        150⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        151⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        152⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        154⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        156⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        157⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        158⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        159⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        161⤵
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        162⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        163⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        164⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        165⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        166⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        167⤵
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        168⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        169⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        170⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        171⤵
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        174⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        175⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        177⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        178⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        179⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        181⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        182⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        183⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        184⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        185⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        186⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        187⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        188⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        190⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        191⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        192⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        193⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        194⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        195⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        200⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        202⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        205⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        206⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        207⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        208⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        209⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        210⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        211⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        212⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        214⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        215⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        216⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        217⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        218⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        219⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        220⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        221⤵
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        222⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        223⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        224⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        225⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        226⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        228⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        229⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        230⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        231⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        233⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        235⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        236⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        237⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        238⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        239⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        240⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        241⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        242⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        243⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        244⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        245⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        247⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        249⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        250⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        251⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        252⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        254⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        255⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        256⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        257⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        259⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        261⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        262⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        263⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        264⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        265⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        266⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        267⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        268⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        269⤵
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        270⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        271⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        272⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        273⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        276⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        277⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        278⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        279⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        280⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        283⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        284⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        285⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        286⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        287⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8740
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        290⤵
        Modifies registry class
        
        PID:8832
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        291⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        293⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        294⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        295⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        296⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        297⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        298⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        299⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        300⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        301⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        302⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        303⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        304⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        305⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8780
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        307⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        308⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        309⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        310⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        311⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        312⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        313⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        314⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        315⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        316⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        318⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        320⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        321⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        322⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        323⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8916
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        325⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        327⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        328⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8368
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        330⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        331⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        332⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        333⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        334⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        336⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        337⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        338⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        339⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        340⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        341⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        342⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9632
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        345⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        347⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        348⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        349⤵
        Drops file in System32 directory
        
        PID:9880
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        350⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        351⤵
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        352⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        353⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        354⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        355⤵
        Modifies registry class
        
        PID:10132
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        356⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        357⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        358⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        361⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9500
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9664
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        365⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        366⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        367⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        368⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9980 -s 408
        369⤵
        Program crash
        
        PID:10128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 9980 -ip 9980
1⤵
PID:10080

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:9824

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:9500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
347KB

MD5
4ae086f33ce5e61d59240af1ec7f78bb

SHA1
c6055217dc59880cf86cc31d08fbf22dad2249d5

SHA256
a37c5a4804145413bb331045c2d2eeafca789112419f36529ade9dc4ba10a595

SHA512
53b621c46e8f9ae4ba49638b8400f893654a195c132643ce9332c13ed4f665e094bac5a25cf7fa61dba71a38c25becddef7757c55f7587ed12fdbbb8ae681557

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
347KB

MD5
f33cab3a705e1d402bcb9ef8710d9aae

SHA1
32593176aacfc0616ad41614b3caf28718285599

SHA256
be55f2465b5ea52eba19d6c15abecee545f9b257a77bac9bf26742a366fde80d

SHA512
238a7704a7afe686c80d99c74169119f87b35f5faa04e81f72576c02dce9732d409a324a7e6a251572563e29931b27e7c08855a050164442f1514d9d9f126d61

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
347KB

MD5
aec67763d582c3c62f4989cd93a95e22

SHA1
0094aea80e14f415bc22e11485824065843bf0ff

SHA256
fcad35f9f4ab2c5ec91b4fead116ffaf2f634fc2ecf09febfa2c94c4ee0dc726

SHA512
87ad5902cdac01ad4a1076ee7f25b15d852bf0b447e1fcccac7b15b2c826be46ce2544e42d4146f31a1b866c91763787b395c8c64fb5c1d9d69a96c48ebd2179

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
347KB

MD5
f0f60d1595cc26c06a0d7775c017e9be

SHA1
6d96d19f1e126a94d89357092c24eccf3846fa0c

SHA256
4640fd0a65dd5453e2b4eb0a55c25a2263203d76211028cf8c74c87f419beb9c

SHA512
85b867eb9e570417b84f6aba480552755be2b52a43ae0892604b48f2b86fe7471f9d7283f84f6c7ae357a5dcf9d0384da4ddf3cc651673eabbab3ecfbf6ddcc0

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
347KB

MD5
e2f2a98ff31e7548652e5901e6e4d822

SHA1
7a927c370891cb83af04684033a112e661374d26

SHA256
f6538075d775e0ced14b2e8fe7b48045220c756ba99241f4581c2651c87a8f3e

SHA512
08ac9e2888d44039d86c43537adb03480c39c4ac02a26a287499ec0710217e353e8c42ffb28ab4b471f04e205cf81dcfd4e26df367d5b9314c959eee487f531f

Download Submit
C:\Windows\SysWOW64\Cahfmgoo.exe

Filesize
347KB

MD5
9f20c21a025e1604b3071776a06749e4

SHA1
d32da9e6ea2f0dc0850a550af58edbd7e86436f6

SHA256
b65649fb3bae49bb87310be5d6437edd953dbd5f6ad3898edf519af726e81c24

SHA512
51ca1410a2c122bbe13c9d41b95fb30b040e2cc28587395a80354d51e15bad382c46b63401c702ddc5523a47d5e952560ea9476b0b7f978dc759b07428bcea0c

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
347KB

MD5
65cd46c3064c77e54550fae5d4c58a19

SHA1
7b6fac669adafcffa5ffaf3451445fe11690c563

SHA256
d6ec5c4021ce561925dbcc4562f466bebf57a00c2f1bee034491b3314479c3d0

SHA512
01691ec3c1d5f1f908c80403436406b689b2c665cc261c46ffed552179fb0f2bbc185e6bc4a259c638a9a0b7213cef530b3884dc32c641f9e2eeca4bd2fc22fb

Download Submit
C:\Windows\SysWOW64\Camphf32.exe

Filesize
347KB

MD5
7dddf0487ebf621845745fabdf97056e

SHA1
186c32f568c29ad3bffbf47d869f8be85965821a

SHA256
36efca59b2e06d585a010b2e912c954162149d3768f733019f91f20b80a26c66

SHA512
87616e81df89e360c0e8873047dce372273e0d328d49107f354a3b3d852f9600582073e6df1739312916cdcbadb73afe52f9314850af55e2ddafa8f6b97db5e2

Download Submit
C:\Windows\SysWOW64\Cbcilkjg.exe

Filesize
347KB

MD5
26212e3d604d846376ca9a7a58816b98

SHA1
67d5d028c163663d1842ce615cceca8c30b98051

SHA256
df70691dd9a2eec4c3415e8e3d351f076af3ce74bba85594b1ee2434154adde6

SHA512
a83a6cef0663f18fac097453fbfb87e4ce02b54aaae2ea6a4b5ea398702492ff97e04ba43db916144e0d2718c7ac3ce490d555011f2edeec41c622d3ab3825a0

Download Submit
C:\Windows\SysWOW64\Cbefaj32.exe

Filesize
347KB

MD5
9485691f361a52b6ec1e37725a7a9e32

SHA1
3e029db8827ecf970cd5d0514e45e4e2db91a4fe

SHA256
55451f14b51bc8a4fcd9196cfa4f1bc2be1e6bec8e609acb461fc3a65c7b3cd4

SHA512
ee2cd7c2451b619389bbe465681341da1560885857914646d16cd7f735929f8b85bfd1babbdc1273f1ee32e32d17542a54c360b947f170f594c7ec7d93e1a659

Download Submit
C:\Windows\SysWOW64\Cbgbgj32.exe

Filesize
347KB

MD5
a5a55eee022cd86156e6f661e297f778

SHA1
1e16653674e94728057f80c12d45c39791917baa

SHA256
ae9065626a5532a203f8d55781a14ecfc5cde2be4e83ae8add759d8178191e3b

SHA512
1676360bd87c93d4faffffa6fb77a7f768715311dde6861ed845da1091c7c9c4d0f5a7d717c027ad1ed4282d55bd4d30b97f5792b1e2be2386a4b4b188a18185

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
347KB

MD5
8d4e3afa1e067e81b766d6551be29926

SHA1
f3a669de3f6e09b48a460af297a1cce5b87b76d8

SHA256
6548995423c7c5f3b2a3cd5b98f33a729a3c8b1671624af42b630dcab558090c

SHA512
669da3123efec013278c58ae8a03d7fff33f7af35e5381b282ed2a908b15a673d647eee2a0a14b4eea9559e72a23c59f3fe28e31170ea042ae41645d3b6c548b

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
347KB

MD5
d1b8ce6b5aa3e7cc4a7c5521ab3f35d8

SHA1
2862def0dfedeefaa02b976e2bb366104d43016f

SHA256
84a4e031ec69ee458cbcb87f0ed4f85071b0eaa10538dc8775463d941aa38c82

SHA512
ed6e88329849b3ea06a716e19b28c88fed7ff6e076dd41db3b1e017de59609542a9202c3426a27188f3cc1fec753a56e45603ad235bc193590cdc4f714fd3056

Download Submit
C:\Windows\SysWOW64\Cddecc32.exe

Filesize
347KB

MD5
9949c93ccb77858875577d3baa74af7c

SHA1
edcdb556c5a3a324a1244b317fc7c7db44c65096

SHA256
23b3efceac84e93c7be9b6d175847d393628ce311a614c6c5dffaf53c326a8d9

SHA512
f341df711f4ca741213317607c58178cfe880482a52eaca63d6c4cc129cc23a2906e4230074bdbdf046aea3067230bec6719fa1d765f4a817f4c0367dcac97eb

Download Submit
C:\Windows\SysWOW64\Ceaehfjj.exe

Filesize
347KB

MD5
c83300d38351c590de53dbefaee95f37

SHA1
70500a56ce31d4c5631714f8e3af4ee68cf40ade

SHA256
002f9c3a3b2614972b73d559cd6d9ee1e2b210a4190536f614938ad043820f68

SHA512
fca370694ee26b52e98923d3ac1a36dc3d3c97190a28ed24c46b2eba2560ddba6b547a56ba194ad198db6281f40cc66a55b5312d65aa9bcb8c3ced4d8df0c15e

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
347KB

MD5
2324d804f65647fb3e7c65af287cb007

SHA1
a049048114303a799608cb0c85d503aef3d8ed27

SHA256
a529f36ddc29b464c8495c082997ca78253a001262e690b997c41091b0cb71c5

SHA512
4e1fb494ee1f68f54d2de00650cf239a4dbf4833de3e78cdc20263f84c3940550cc8dee2bd800aa34e3cc464dc8d46918fa87e112750e2723e06426260dbd519

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
347KB

MD5
b4782d52d7451e5425b945547d7c7c9a

SHA1
0fc0f6e831ee68dbacd1baac0f708715ef44ffb3

SHA256
0e9acbc3da02261af97121f610b33e79092f6f01920e2bfe1d3e84e097b1cd7c

SHA512
7740a6faca9d9544c3613a218c97b90f2907711a4bd9bac9f7f32b1e1df58acdaf38b65b26fae80a2bd1cd2af8d7f022409caa2afd6df38ee2f8c056ec9b602f

Download Submit
C:\Windows\SysWOW64\Cefoce32.exe

Filesize
347KB

MD5
e05536bf4a56fbab7c863e60d879b146

SHA1
73f5d520291da2c2f7179b379b237f1ed7c7fb09

SHA256
48e0b818099d0854a3cea202a1af9b1277a6501706bcfc7f4996b79f72406337

SHA512
d96dc2b76973569e972ad6a55851aa5c73e7f1da80ac987fb3943c2ca7ebd8bfa56ed774674878453bf26ba5d7983c05c1e05f1a85ba1705cf074e8a368f162a

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
347KB

MD5
0a5f5f05c93ad8816f148a309837b9c5

SHA1
4aba5954fbaea172bdb475e12dee0454ccd67b5a

SHA256
715f1d8ca183e58d6dde558fc8a12ba4d04ab33f61be9e2a3d7f857f5375b5a4

SHA512
ab6eccc640f271c932303fd826a88e2b461afd98aa70320fb65c8a802204c103ef4dd7b01452dd20a036767b290d4e87992430fd6878bccea884c4b0a0850b8a

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
347KB

MD5
64dab98966be2206d28a98de541e7fdf

SHA1
019d86c39d8ab247f186880852e8be70a9a161fe

SHA256
740ec9c74043027e1f86ea9be789ee7c615e3f687dae450929c58ffd406fa445

SHA512
03d661a961b3412fc6abeb094992d7ebb1ab4b5d899faaca1168673d22df227ce7bee96b940696597aa7b5c45f74d7cf0c4da9f588511b7bb32cf0e1ccad034e

Download Submit
C:\Windows\SysWOW64\Chbnia32.exe

Filesize
347KB

MD5
8039697aa19e9e3f21037a9f8043cba5

SHA1
cfe728fb46b1bbb8a61cc8cbd45c4acf5de42bfb

SHA256
48dc439d8fb11bec575f60fd898e4c0ad9c084a5385bc5f0b87f130002f6f9ac

SHA512
5f3d4cb9c02303dfbea0894e6d1a79a178df7f5e3a71118ba405966c6c4d1dd39c959a58e4a4b6d9c24af233b23087a20621e9b906d2053a937b607c041e62fc

Download Submit
C:\Windows\SysWOW64\Chdkoa32.exe

Filesize
347KB

MD5
82da220fb490a27f85fcf1c39f3f501e

SHA1
7371cb1e547222eead2657d4aff90fe94aaa2dd5

SHA256
9045a08771d0518ab33b8a223c0cb09e6b6e651778d682aa678c0cfae1311247

SHA512
3ac90313c6143e8a5d77776ce1ab8e67a86f8942f3dd3b5497fbd9fb48f6491a4a2c806f483e0e40349f45134674750ec26ca7b0cbcc29fb66e39b62d8557a61

Download Submit
C:\Windows\SysWOW64\Chghdqbf.exe

Filesize
347KB

MD5
491ea86f8ceb8b23e151aaa79fcf9337

SHA1
7b3f639e412149171de07fbb99ff45b3e826bb67

SHA256
0fa77ed7b9aaf91f82c5d60b5496af57a6b62193b9d6c9eb9c5f176517868b0d

SHA512
5177d741320d021a97f208886eafa9c7178385d35178000d420a1135daa8d46ddf9a3d923cbe3b3d4d5acf15f10d5c02139514662998b37ac760fea041729386

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
347KB

MD5
738d27db46ab91e57fe8ba8295f44466

SHA1
642317667c3b3614b50a3b0f2de052ad7b318dc1

SHA256
a72258c1d15a5e12856f00acaf830ff1932f05cda91227cb601d3389c2551599

SHA512
6bc2cc22ccc14e563802b869557de684a50bd9547679710744cab93890d06cdae3ad408dea8b91f9bc076e01c128356bcfbe7974fa6068a8f40b3df553d87ac7

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
347KB

MD5
70b885a927e227aed12bcf77a52eeffb

SHA1
d6b7dfe988f4d4a81433d00a00dddfc52527f30d

SHA256
54521fccc96b5a26fd6362192427e6ff1d161abbfd7ceaa87ddf78c3149d65fa

SHA512
b084b6729d9bfd2a64fb02f5663f6e5428efd3af98f082160473e6c979899fb4770ff891b54798a9ba31a59c8f1b3958298fac5a361e8cfd45419ca753e7b35f

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
347KB

MD5
9bfe0324c2e169bb63982168d4ec1be3

SHA1
f58a39d8116ac86eb042b80be99ab09579a5542f

SHA256
200d5dc4bd9bc5afa7baee7a038a77e0514d66f3211fe69db18eb55f9bc6fa7d

SHA512
d455cf024dd4b1c7274614cdd903e94cb856fa684f6519d77cf8606829daa2971f5216fc18ecac20cb068e42669558bb032cbb20bc9d959ee861675b590c00c1

Download Submit
C:\Windows\SysWOW64\Cknnpm32.exe

Filesize
347KB

MD5
0c141ad2db8b823a6d9b4a6566e2028b

SHA1
be696551bfef26d572eab29107a8867985ba9ce5

SHA256
b2baf429a4691e8b4889555089eec33f3ac671f940659600adef6c43119698d0

SHA512
b10951e8fb1398a819a0ae35c56331390394714f47662c567923fb7579f166d2e55e700d515af4bcb3cf992fd9055a4f35e67559f00bdfe908617ddd04594289

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
347KB

MD5
91060f70322f15c75757c1cb21125ecf

SHA1
6121d3967ebed8a91e631081dd818d1e5dee132e

SHA256
3c675503a150fa1f5c90c10baa44b73be808efb414f363c2dc349f6964122dd9

SHA512
4147eeee9ad5b761c2471f1578ccd44fab52c73b60e84990dd2765491a5e31ef81e8cf9a131855bd0985cf24c430940f4e0ad5b43f4a3556f1dcbcad20595520

Download Submit
C:\Windows\SysWOW64\Clkndpag.exe

Filesize
347KB

MD5
ff4557b07ea318ccbe55fce363ddd4ce

SHA1
5fd955a812ae2ad10aa0631366f5e62d01d38d96

SHA256
8d530fbe657434861e3baa16339a81fed0b657ff338e5511d5a5668ef6d64cf1

SHA512
a23e7a63f758b0448aab8596b30241ac78f173c41f5c102537e7dc802ff9ec014ef5dc35e61572c2a5736fcefd7a72a1bdc6c2f98065d09ddee77805a6113eef

Download Submit
C:\Windows\SysWOW64\Clnjjpod.exe

Filesize
347KB

MD5
9bd8cdac1a28c0dbbbf41b1f6e35c344

SHA1
bba9b8b07276afb1bd5399b5de63b94037325421

SHA256
40acde00f02356c19b069679868d965cfc058ee09484576acccd7eefbcea0ec5

SHA512
2b6134fbbf91af05ea999f18460d3f1846add8c575b967e481ded96dd1c6a168a847c819fcac8975dea3c79a418e15c57a82df02e533b160917908687ec29c72

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
347KB

MD5
a2009ead7c6209434fbde34a10015e9d

SHA1
a2514d4209c7b7eb5688407f505d2c62c45eaad8

SHA256
395d4f034eae81ed62ff03aadaf1159a1a8ecd2074c9ea730dd23167ec8d03b5

SHA512
3306eac8bbffa995db9f961516bd5c291fe315e3196b46ab1906e236462e517218f3aa7e363fe0f45400b0363a6e57a41659d8b1327166e7de0c7af4b6c079c6

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
347KB

MD5
5f6ad3cdd57fe1997e60aa947cfaf319

SHA1
58c9adb300df33fc706e3140a0fb83153cf2196f

SHA256
47b66dd6ffb8295e40a5bcbac9fe39959754e09cc68350bef899c121f4ffcc54

SHA512
03333093b549b8e899a0c56a4431a7c12b3fa04c734c740b05fc6e0e272e1d9fcd0acef9b23b48a8938acd90eee2bc0a02b452bde7e851d078d70f8f1a8f5dec

Download Submit
C:\Windows\SysWOW64\Cogmkl32.exe

Filesize
347KB

MD5
26d00447132cb840c930f77a34271195

SHA1
1b705c79563ab41acb3fe7f89f7fd39211e8cbb9

SHA256
f15b39201e023d9312368131fc18276ed93e942d4e8cf78a9a7261e8aa45afbd

SHA512
49eebadaf221e2ae44fd18abe77ad4fdd6cd59e9ce444deac40b8ebc70751740a616a38acb0627857a0ea543beff796f9668cfa184e5202aaeb7a89cf22b45d1

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
347KB

MD5
d41809e6c4a6ddae9bc69d2da183990e

SHA1
f28a09f3fbaed3c711df46e9bfa520287299d595

SHA256
35b546cd23efb25c2aebf39505ff554bc100397d7bd5ad4c0fa577dcc5689c01

SHA512
3b0cfe43d44dbd982d39a79bbb4e16212975e95449ed2e7f336f33fea3044deee3efbd0b3c013a26539589ec772dfc6636dd1f4b774657c82326d91fa6f32bae

Download Submit
C:\Windows\SysWOW64\Dbllbibl.exe

Filesize
347KB

MD5
3b5b703952e5b574e6bf463d3c9b0de0

SHA1
78f378090818d98821080ce38660f14c381bbc05

SHA256
9b434d7f1a9e2550804156b066daed97c35b3642d29c3098e10dc4ff8e827fd6

SHA512
840d9592b6d62393cfdaff7a9ef9849564bf230f282c8ebedb71eea48c1f905371ce6d9dd5552737d32378b1bd9c587d042b9b9f42f56e06be31317cad35ec6f

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
347KB

MD5
e89a4682abb2ba3e41dfff18a0fb4dff

SHA1
ea09415bf9a9918d09bb3cf9e85f0403215f2f5f

SHA256
32b000ec6250d42681479df94b8c11441ee8963d7baa120415a0d73f74aff78e

SHA512
917bfc2faba18f52fe1c6f5024e9e246619bd5fa35cb12a3f30d19debffb9e497da571d2a757c1953c2f0552cc66b2f94bcf4bdb145a8a874afaa1fb3a996d99

Download Submit
C:\Windows\SysWOW64\Dekhneap.exe

Filesize
347KB

MD5
39944b513d6b05279b70113cac24ca96

SHA1
321968ff21ab937f3531c0ae4ecd2cbd7069755d

SHA256
d7ee527849de582ad1b14b1de81c622b7c71465d19deb8389a0b0c659bfeced8

SHA512
fd56bdf8394a16893b2ae4bdf73775c818c44ba2c2d15ecfc228fc78ebe336675135eff18c1902fc7a957a6b41987dade749dcd713c9f78c2273cea31758193d

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
347KB

MD5
366012b10acef424d84f331ac4dde6c4

SHA1
6eb0793eecd9ca234fe35a4c05429b6ae6c4cfed

SHA256
ae25ae19e5d45c1c185729c084c381d0856528b2ab361804f0c1f38105e918a8

SHA512
109317f3edaf5f874b6aad421a69780f00ecb378fffa827721db4991d983097a1cc816081a9f7e49f1739f777495f918fa35aafbd73bc48fe1af0780353db771

Download Submit
C:\Windows\SysWOW64\Dldpkoil.exe

Filesize
347KB

MD5
b355bb565ce6ec99439f1974b80ce2cb

SHA1
ffe930f5baef78d8799df7e9569cb9b8578313b7

SHA256
dc95a420b59cafcca05fe4234fbe1fadc0eab299e33b87b26eadcdb9bed5dcfd

SHA512
f777da4ecf1fc8f274d94655134592a0379f2989779f7a11547d0ad9ef3db4e57a8d298fb7a4a9655630cb9b05de59866971082063645a243d86df6dee1580a7

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
347KB

MD5
8a3bb191f245cf1788d697ec05b7cf00

SHA1
684745dca60479039d270d369fcd05baf3b8d64e

SHA256
079585b53e7c93bcf700535f1f8041bfc420e9049421392172c82b6af6605e50

SHA512
330259d6d2d14b21d7728e5530334b606f9b59d788c156e1521f210120d26b3c13cdf97983be65741aa9f641d3aa26ea0246a450f0a5218cc804e9c4893fa6be

Download Submit
C:\Windows\SysWOW64\Doqpak32.exe

Filesize
347KB

MD5
9c744e46ef6617c1d0ef8a0c2d1fdcba

SHA1
8aa589eb99b4edc2867c606937fe5acd10efac99

SHA256
f7bdc6f35933e97bd23048cf3f25d0ea01f268b633a45601954a5959faa8ebc8

SHA512
3b78c56b3b1615b13a1cb9a7b94ead7787f6eedf16035189e62c5ece2c5b26d8d79a7ad73a3fd50646ebed1fd37b0fee8f2a2fef14bfb478c01d0f2d05341741

Download Submit
C:\Windows\SysWOW64\Gohibf32.dll

Filesize
7KB

MD5
63b620c3bbdcfee312dd23f4529a5a83

SHA1
d61715c849fb8a64db8e0978bf4c6f0175f0acf9

SHA256
a2a92bff71d50ece958a455aaf329b43aeb1d5cdd9f371cfc80f12a392496500

SHA512
01da716eab5657b9baac648044d61c81371208fb5dc993b9a14ee2b86ec7e5f896e62136839851fc931924ce11846c80b180859a8cf010192b3eb8d40fc06da5

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
347KB

MD5
7a83a63aca7110a452fde5f0beacb011

SHA1
593d06bed8453676def0104eea7823c0dd55c8f9

SHA256
6ccb7a94e7fb649d76fb60d118baa1501e63bae1131a582ab8b93cb0c6567600

SHA512
ad52d965d0b0657dafeb2d35154d73e283e92ab251414dcff31b479bd94964c57e1d637474cb8365ed5877b3d88f1ca74c2f1ec0ce6a600feffad1f51c73fff1

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
347KB

MD5
131acab3e1ab9abaa482a6c513d1ce4c

SHA1
6383d6f7057005d605fcddb8d1ce17c90146524b

SHA256
a9f6b77475eef718ecf1969293f24837de51bb5cc051ac7712d007e8ebc2b9e2

SHA512
5413ec763c8c6c0703d9a5cbd5bb81b65b8bc3e340e80421863bf30ad123c5ba0c78207270ed0d50487bef854f700cab8922c4ac957c358b4149fd84470a2644

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
347KB

MD5
072743a28869c06244e3a6e6fa985ff0

SHA1
61cf3f345ae27bb0704e7c56cfc1433e91cd4211

SHA256
808f8d3e6098465c96ba7e8a2f0bff05c4ef19e12344ca343b43000eebde65d8

SHA512
9338ede670c5a3b8af462c3c3c26d1907571814ddb7918ad77a4ad81b389f3a94c2b9a9ec7f04c927550c96bfd8b3be9d74fed3586bc84c87077cf6d3d55309a

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
347KB

MD5
6da6a9ed2fa158e3c01525422e649c2e

SHA1
81354a6681989c48086002056d4315e31878818e

SHA256
551d4b13db3f2f6450b243c4bc0ff8a16b9c84f9c9bb4b7365efe81981902b9f

SHA512
b0368343185758ce44a9c3f30e7dc8c6973b9b49a70b36c377015bd81124ff7406a8b7037cc5b70b8e91f28319823d36d1f594f7d38188a023364716d51912ed

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
347KB

MD5
e793dc2b112361e9931a330dded3a92e

SHA1
d28e275dc777ba8ed769e106073fc9b192b74d4c

SHA256
99ac424f9dedc62358697a126f2d9e5a45a5c221084e6e4f3af46634e30365ee

SHA512
9e34a57dcff2fd32178337474c6ed855c0fee0dffb758ed4823c2309b6af7598fc95273f07d773ec5363468416aaeb674e7a1230179ecce776247f3e476e9b78

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
347KB

MD5
851961175f97866a2b81c1b94e98f185

SHA1
bc47cc10d80d12a431c034b9f03a66d508fe897a

SHA256
ef1ab53269881268356cc0235ebaeb6712a2cc4d6a52dc8f5396a64a4d904485

SHA512
d7739b2998e362af4d2ec45966ff6a84e99929a39ac1d41ecd5dd7fa30be06f00748e9413ecf639d5d92d2dccdf86f8c6c8637a42f4d7f683a94a49013433c99

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
347KB

MD5
c20e774c2ee72200f16c5446559b16d4

SHA1
12000c758e1bd3609002c46e32c4a997dae4fa0e

SHA256
c09723ca6070ef554383efaa7a64d54578bfec77a8701beaa7cb475b2ad69482

SHA512
d3033c228d38f655ced753e14bee11bf156ac140d239f8e64d5193ff6b496226209f3b298e8ef5cc6b925e5a9b70e170a55bf6f232387d9e0870e02ad790748f

Download Submit
memory/372-588-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/648-531-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/752-563-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/776-553-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1028-587-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1044-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-565-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1312-562-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1436-589-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1496-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1544-584-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1580-402-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1644-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1648-543-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1672-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1696-535-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1716-383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1720-554-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1736-569-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1752-387-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1760-549-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1860-585-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1864-405-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1980-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1988-546-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2016-542-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2336-528-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-579-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2356-583-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2492-391-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2620-530-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2732-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2760-574-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-390-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-526-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2792-592-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2804-576-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2844-570-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2888-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2920-568-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2968-559-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2972-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2980-578-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2988-392-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3012-533-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3032-541-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-547-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3052-573-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3104-525-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3248-529-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3260-552-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3268-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3340-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3368-586-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3468-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3524-385-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3648-398-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3664-582-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3668-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3688-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3692-545-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3704-564-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3732-381-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4016-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4092-409-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-567-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4192-532-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4216-590-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4296-386-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4304-403-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4332-534-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4336-580-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4360-551-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4380-548-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4460-591-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4496-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4516-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4552-581-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4592-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4616-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4688-575-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4700-577-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4708-384-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4724-572-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-550-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4924-560-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4940-571-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-399-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4988-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5036-593-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5164-849-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5204-850-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5236-851-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5276-852-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5308-853-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5348-854-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads