d21c069ff87e6460eab21905940c4df6b988df386f684de501d8b80312379b38

Analysis

max time kernel
140s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe
Size

96KB
MD5

02952680584b314c284eecd6afb06a70
SHA1

72c78b60fd0baf65e0ca8d99f2bff2eabbeb974a
SHA256

d21c069ff87e6460eab21905940c4df6b988df386f684de501d8b80312379b38
SHA512

947942ab7c3fbcd2c2e9465c5418ad63650a6e270157d883f5fc41dca6d9d351a45ee2985d4aa498a05fa5db9eefaae7be0835ae22f9f716d722cbaccd0374b1
SSDEEP

1536:CZJGtGMfstS4eaRKX2r92JokbEYRb+o42a/Nic6rcH0tsYRHwiduV9jojTIvjrH:mJ0hfstS40s8ikbEYRvmEc2FC6wid69J

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkljak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eepjpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Docmgjhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdgdgnbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickchq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehljfnpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffddka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebhjlg.exe

Executes dropped EXE 64 IoCs

pid	Process
4660	Ckedalaj.exe
3972	Dekhneap.exe
3092	Dldpkoil.exe
4148	Docmgjhp.exe
3632	Demecd32.exe
2340	Doeiljfn.exe
1860	Ddbbeade.exe
1940	Dkljak32.exe
824	Dafbne32.exe
4852	Dddojq32.exe
4928	Dkoggkjo.exe
5004	Dahode32.exe
3244	Dlncan32.exe
372	Eolpmi32.exe
4112	Eefhjc32.exe
2508	Ekcpbj32.exe
3736	Eeidoc32.exe
4380	Ekemhj32.exe
4468	Ecmeig32.exe
208	Ehimanbq.exe
4540	Eocenh32.exe
1428	Eabbjc32.exe
5020	Ehljfnpn.exe
4688	Ekjfcipa.exe
3996	Eepjpb32.exe
3560	Fkmchi32.exe
3336	Fcckif32.exe
2876	Fdegandp.exe
4932	Fkopnh32.exe
4888	Ffddka32.exe
4308	Fdgdgnbm.exe
3376	Fkalchij.exe
1448	Ffgqqaip.exe
2000	Flqimk32.exe
4772	Fckajehi.exe
4240	Fdlnbm32.exe
2036	Flceckoj.exe
2724	Fcmnpe32.exe
3052	Ffkjlp32.exe
448	Glebhjlg.exe
5024	Gododflk.exe
4196	Gfngap32.exe
2592	Glhonj32.exe
4116	Gofkje32.exe
1348	Gbdgfa32.exe
4476	Gmjlcj32.exe
4920	Gohhpe32.exe
1384	Gdeqhl32.exe
2820	Gkoiefmj.exe
4568	Gcfqfc32.exe
1972	Gdhmnlcj.exe
3108	Gmoeoidl.exe
4936	Gomakdcp.exe
4520	Gdjjckag.exe
3908	Hmabdibj.exe
860	Hckjacjg.exe
2416	Helfik32.exe
1208	Hkfoeega.exe
4192	Hcmgfbhd.exe
4064	Hflcbngh.exe
2224	Hkikkeeo.exe
1976	Hbbdholl.exe
3680	Heapdjlp.exe
228	Hofdacke.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Qgppolie.dll	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Laffdj32.dll	Heapdjlp.exe
File opened for modification	C:\Windows\SysWOW64\Klgqcqkl.exe	Kiidgeki.exe
File opened for modification	C:\Windows\SysWOW64\Kimnbd32.exe	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Nkbjac32.dll	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nnjlpo32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Eeidoc32.exe	Ekcpbj32.exe
File created	C:\Windows\SysWOW64\Aainof32.dll	Ehimanbq.exe
File opened for modification	C:\Windows\SysWOW64\Fdlnbm32.exe	Fckajehi.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mpablkhc.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Kepelfam.exe	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Ejnjpohk.dll	Klljnp32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Ddbbeade.exe	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Acqimo32.exe
File created	C:\Windows\SysWOW64\Gofkje32.exe	Glhonj32.exe
File opened for modification	C:\Windows\SysWOW64\Gdeqhl32.exe	Gohhpe32.exe
File opened for modification	C:\Windows\SysWOW64\Hofdacke.exe	Heapdjlp.exe
File created	C:\Windows\SysWOW64\Dndgjk32.dll	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Kpmmhi32.dll	Dkoggkjo.exe
File opened for modification	C:\Windows\SysWOW64\Iblfnn32.exe	Ipnjab32.exe
File created	C:\Windows\SysWOW64\Kdnidn32.exe	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Ilidbbgl.exe	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Hfligghk.dll	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Hgaoidec.dll	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Ekcpbj32.exe	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Pfhfan32.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Hofdacke.exe	Heapdjlp.exe
File opened for modification	C:\Windows\SysWOW64\Lljfpnjg.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Dkljak32.exe	Ddbbeade.exe
File created	C:\Windows\SysWOW64\Fdlnbm32.exe	Fckajehi.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Mlcifmbl.exe	Meiaib32.exe
File created	C:\Windows\SysWOW64\Mlhbal32.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Qdbiedpa.exe	Qmkadgpo.exe
File opened for modification	C:\Windows\SysWOW64\Gdhmnlcj.exe	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Helfik32.exe	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Dkljak32.exe	Ddbbeade.exe
File opened for modification	C:\Windows\SysWOW64\Fkmchi32.exe	Eepjpb32.exe
File created	C:\Windows\SysWOW64\Fdegandp.exe	Fcckif32.exe
File created	C:\Windows\SysWOW64\Glebhjlg.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Klgqcqkl.exe	Kiidgeki.exe
File opened for modification	C:\Windows\SysWOW64\Migjoaaf.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Ladjgikj.dll	Ogkcpbam.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8936	8844	WerFault.exe	368

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhkicbi.dll"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijfjal32.dll"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mifnjj32.dll"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnbinq32.dll"	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Heapdjlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdjjckag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agocgbni.dll"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chncif32.dll"	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jbeidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmhi32.dll"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codqon32.dll"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifefimom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gododflk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifllil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndgjk32.dll"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blleba32.dll"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qciaajej.dll"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eolpmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjegoh32.dll"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4660	3984	02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe	83
PID 3984 wrote to memory of 4660	3984	02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe	83
PID 3984 wrote to memory of 4660	3984	02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe	83
PID 4660 wrote to memory of 3972	4660	Ckedalaj.exe	84
PID 4660 wrote to memory of 3972	4660	Ckedalaj.exe	84
PID 4660 wrote to memory of 3972	4660	Ckedalaj.exe	84
PID 3972 wrote to memory of 3092	3972	Dekhneap.exe	85
PID 3972 wrote to memory of 3092	3972	Dekhneap.exe	85
PID 3972 wrote to memory of 3092	3972	Dekhneap.exe	85
PID 3092 wrote to memory of 4148	3092	Dldpkoil.exe	86
PID 3092 wrote to memory of 4148	3092	Dldpkoil.exe	86
PID 3092 wrote to memory of 4148	3092	Dldpkoil.exe	86
PID 4148 wrote to memory of 3632	4148	Docmgjhp.exe	87
PID 4148 wrote to memory of 3632	4148	Docmgjhp.exe	87
PID 4148 wrote to memory of 3632	4148	Docmgjhp.exe	87
PID 3632 wrote to memory of 2340	3632	Demecd32.exe	88
PID 3632 wrote to memory of 2340	3632	Demecd32.exe	88
PID 3632 wrote to memory of 2340	3632	Demecd32.exe	88
PID 2340 wrote to memory of 1860	2340	Doeiljfn.exe	89
PID 2340 wrote to memory of 1860	2340	Doeiljfn.exe	89
PID 2340 wrote to memory of 1860	2340	Doeiljfn.exe	89
PID 1860 wrote to memory of 1940	1860	Ddbbeade.exe	91
PID 1860 wrote to memory of 1940	1860	Ddbbeade.exe	91
PID 1860 wrote to memory of 1940	1860	Ddbbeade.exe	91
PID 1940 wrote to memory of 824	1940	Dkljak32.exe	92
PID 1940 wrote to memory of 824	1940	Dkljak32.exe	92
PID 1940 wrote to memory of 824	1940	Dkljak32.exe	92
PID 824 wrote to memory of 4852	824	Dafbne32.exe	93
PID 824 wrote to memory of 4852	824	Dafbne32.exe	93
PID 824 wrote to memory of 4852	824	Dafbne32.exe	93
PID 4852 wrote to memory of 4928	4852	Dddojq32.exe	94
PID 4852 wrote to memory of 4928	4852	Dddojq32.exe	94
PID 4852 wrote to memory of 4928	4852	Dddojq32.exe	94
PID 4928 wrote to memory of 5004	4928	Dkoggkjo.exe	95
PID 4928 wrote to memory of 5004	4928	Dkoggkjo.exe	95
PID 4928 wrote to memory of 5004	4928	Dkoggkjo.exe	95
PID 5004 wrote to memory of 3244	5004	Dahode32.exe	97
PID 5004 wrote to memory of 3244	5004	Dahode32.exe	97
PID 5004 wrote to memory of 3244	5004	Dahode32.exe	97
PID 3244 wrote to memory of 372	3244	Dlncan32.exe	98
PID 3244 wrote to memory of 372	3244	Dlncan32.exe	98
PID 3244 wrote to memory of 372	3244	Dlncan32.exe	98
PID 372 wrote to memory of 4112	372	Eolpmi32.exe	99
PID 372 wrote to memory of 4112	372	Eolpmi32.exe	99
PID 372 wrote to memory of 4112	372	Eolpmi32.exe	99
PID 4112 wrote to memory of 2508	4112	Eefhjc32.exe	100
PID 4112 wrote to memory of 2508	4112	Eefhjc32.exe	100
PID 4112 wrote to memory of 2508	4112	Eefhjc32.exe	100
PID 2508 wrote to memory of 3736	2508	Ekcpbj32.exe	102
PID 2508 wrote to memory of 3736	2508	Ekcpbj32.exe	102
PID 2508 wrote to memory of 3736	2508	Ekcpbj32.exe	102
PID 3736 wrote to memory of 4380	3736	Eeidoc32.exe	103
PID 3736 wrote to memory of 4380	3736	Eeidoc32.exe	103
PID 3736 wrote to memory of 4380	3736	Eeidoc32.exe	103
PID 4380 wrote to memory of 4468	4380	Ekemhj32.exe	104
PID 4380 wrote to memory of 4468	4380	Ekemhj32.exe	104
PID 4380 wrote to memory of 4468	4380	Ekemhj32.exe	104
PID 4468 wrote to memory of 208	4468	Ecmeig32.exe	105
PID 4468 wrote to memory of 208	4468	Ecmeig32.exe	105
PID 4468 wrote to memory of 208	4468	Ecmeig32.exe	105
PID 208 wrote to memory of 4540	208	Ehimanbq.exe	106
PID 208 wrote to memory of 4540	208	Ehimanbq.exe	106
PID 208 wrote to memory of 4540	208	Ehimanbq.exe	106
PID 4540 wrote to memory of 1428	4540	Eocenh32.exe	107

C:\Users\Admin\AppData\Local\Temp\02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\02952680584b314c284eecd6afb06a70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\Ckedalaj.exe
  C:\Windows\system32\Ckedalaj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\Dekhneap.exe
    C:\Windows\system32\Dekhneap.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\Dldpkoil.exe
      C:\Windows\system32\Dldpkoil.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4148
      - C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        23⤵
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        25⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        27⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3336
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        29⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        30⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        33⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        34⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        35⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4772
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        39⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        43⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        45⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        46⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        49⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        50⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        52⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        53⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        56⤵
        Executes dropped EXE
        
        PID:3908
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:860
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        58⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        60⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        61⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        62⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        63⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3680
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        65⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        66⤵
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        67⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        68⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        69⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        70⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        71⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        72⤵
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        73⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        75⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        76⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        77⤵
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3372
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        79⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        80⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        81⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        82⤵
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        84⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        85⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        87⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        89⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        90⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        91⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        92⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        93⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        94⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        97⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        98⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        99⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        101⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        104⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        105⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        106⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        107⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        108⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        109⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        110⤵
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        111⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        112⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        115⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        116⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        117⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        118⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        119⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        121⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        122⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        124⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        125⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        126⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        129⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        130⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        132⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        133⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        134⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        135⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        136⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        137⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        138⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        139⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        141⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        142⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        144⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        146⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        147⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        148⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        149⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        150⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        151⤵
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        152⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        153⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        154⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        156⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        157⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        158⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        159⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        161⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        162⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        164⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        165⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        166⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        167⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        168⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        169⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        170⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        171⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        172⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        176⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        178⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        179⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        180⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        182⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        183⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        185⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        186⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        187⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        188⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        189⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        192⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        193⤵
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        196⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        198⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        199⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        201⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        202⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        204⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        205⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7572
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        207⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        209⤵
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        212⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        213⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7920
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        215⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        216⤵
        Drops file in System32 directory
        
        PID:8008
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        217⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        218⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        219⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        220⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        222⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        223⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        224⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        227⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        228⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        229⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        230⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        231⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        232⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        233⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        234⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        236⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        237⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        238⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        239⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        240⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        241⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        242⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        243⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        244⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        245⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        247⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        248⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7812
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        250⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        251⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        253⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        254⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        256⤵
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        257⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        258⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        260⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        264⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        266⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        267⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        268⤵
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        269⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        270⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        271⤵
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        272⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        273⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        275⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8844 -s 408
        276⤵
        Program crash
        
        PID:8936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8844 -ip 8844
1⤵
PID:8912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
96KB

MD5
b6a75a8e799ad8cde467440b4d7774fa

SHA1
ff249e808ba1fd0c890811d98fa31d12e0193c8c

SHA256
2e39c84471a80d748ebfa040bbc33575d98139381307f9db027423c3cc55a576

SHA512
2844863f34c0494b14605735b24d98dd19ec0d83d804d895d93a5a4cde006a64da5b1b2dafa1ff76b72b166a9268713749b2f20ede19bca0fd473ee0250190c1

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
96KB

MD5
e218361c5773f744917060a14de676a0

SHA1
f61009400d8c8bc85513e6337b6fc588a9ae2ea5

SHA256
a49373c2135f248f37e4f064ada92983af0f3832a6874cecbcc73b2134d101de

SHA512
ceb6fc8c13dcb54b4d2d32f89c5d4f093108316601a3fe08b0ff5402469ae30d2870fb9578d9d385bf49368174408e27c94bc4119d583db715d005f65000cf9a

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
96KB

MD5
300316f0d30cd1302dd27283b70da3d9

SHA1
33bdd6b989151ff2090f60db8d2037550ef3f76e

SHA256
71a907f5eb7b2143ed7786d121ca3e2cc7e2c95a045c4f943e29b3ae05f34e46

SHA512
db4965de7088a774dbb9ce45197237758e57ad7f4c456c55b3771dc9e614253afcc7a470a8c40f6e7ecd14f54ab14d40a5255b5a321dd6a5b61f9c20689e5287

Download Submit
C:\Windows\SysWOW64\Cegjejoc.dll

Filesize
7KB

MD5
320e6cc2cb7bf1dd645adef1f5a2cc4f

SHA1
79915a52bc0a344afafed6798edd09d9980ba874

SHA256
00cfd06b97584ae3f454fc7f4a1b1273521e27cba88abae0edd7a648040f5953

SHA512
a00992d0bce427094c67690a235d277366d2adc419e5b79ef923bb8b50714dd7594743efa5aed6c70090d3306f6c66e2ac2dfae5572b96e80924ea04e2a13cb6

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
96KB

MD5
16e16d4b68f9c65d67f35f22d2f46c77

SHA1
ac36375519fc7f522322117f73444a9bde59dcb5

SHA256
3afd91b0b1c5064a2029755459132ebfbee1d7c7485b04af405b8cd82f47053c

SHA512
ff98100accd5c3b3ff346be92ac0af01d1935eeeba1767a0ba43452af1b2771afdb80d3ce0010e37a0521a070239f2c980c31b39dbef6e94648b1675c9f7fad8

Download Submit
C:\Windows\SysWOW64\Dafbne32.exe

Filesize
96KB

MD5
021f0bee38724b3d762405c895fb05c1

SHA1
9cd661c60464a9e732a903166e3011f301724b67

SHA256
43d4fe96cb8f43ec505f57f93e41f33ca2a1763c21de4fcabe3fb052c447f776

SHA512
94d3b55f4783a6662275bff947a8703de71f35973fca78e9c23eca6248f8d6e61db5512521b45a54e5382feff1d7abace5c80126625dffbb05e60e8bf1fe73cb

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
96KB

MD5
44c33d6711fb5fa73830b51329d0cacf

SHA1
4790ca6411e4ada887717396761288de02469e2c

SHA256
e51495b727f2b8c916fa030e2155877935e81c4e54b1e7f8801e9fe424be4f7d

SHA512
5ee61f047c3dcc6a59ea9c21e503b3f9a96a820c4c46c284462b68fe713ac65cdb65ebfcfbf450d554cf953d80cb07a7456e8412a06c82d65fa575dc60ce1958

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
96KB

MD5
0eec9dfb977864d6cec93bcbb7ca0c6c

SHA1
c227853521853c117e44e5fdec5bbf2a484a39ce

SHA256
c86f96b9709cbfe34a3ef61d674e92af1b26b0448b7d772febad28bf15d7fefb

SHA512
212f45926759723277c1db96a1c72aede50d1aff409c0dd355c0a1d5c003f9432376c0e3a17150826d2094f1a98cca07d8cca71f3e26b063fe984206b22058ed

Download Submit
C:\Windows\SysWOW64\Dddojq32.exe

Filesize
96KB

MD5
9719213450d81370e4b563127d9e0518

SHA1
ce66fd1cf8fd65981f3425259be4436e97f3cbd7

SHA256
591e65b142b8ce5a7713cac75ec249f09754f9a3e19092ec0ffc9a313d95fa58

SHA512
976f4d29fac2ea82d16d0eda3eb726d778fc609727d786dd94ed5de66861787653a488436ff11d141e3475b34d00d123f139727e41b172667bfc18de99177880

Download Submit
C:\Windows\SysWOW64\Dekhneap.exe

Filesize
96KB

MD5
ab0b4a861305bc6ec04fe89b79d49fd1

SHA1
645e6892012442df478010a99b43ef20af6f2910

SHA256
d6a4032db9b25a273548d6d5f2fc21001d10cc12df3625f2003a8a0140434320

SHA512
661abced5e146ffd77de7466b6bdd94f4867ccb4dcba9fe85020d4b4ef64ec049c43d44347c39b86d615303e14e798a58c5cb13619000a1a259550375e3a8ff2

Download Submit
C:\Windows\SysWOW64\Demecd32.exe

Filesize
96KB

MD5
337ee52937e5070460f132608339c56d

SHA1
47c7c40b03a1c37b12cb5b0a6dceeff216b69727

SHA256
9a216539b9fa15498391289aa44f00e4c429bbb21394c56df9e4bfaad1999454

SHA512
80b39b5cb86b9e609a745a26ab26769f7f6b06ffbac92dab895548adab8987829b87779cef8e7ff4b16ad13b7ba8db7a0ef4d46aafac966c7b00b3ee12c66adf

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
96KB

MD5
606671aba3bed8eb02e4a701a7fe2db1

SHA1
3e3ab056aab8b73a7a17ee02cb874fe557f67fcd

SHA256
1418c0a74f333a2a12fd6c495b69474e959d78008c3b990c72580c872a0a9aa2

SHA512
4098960cf4ede91397584224530a6ac98277eb12462e5b1cca8927d5e9748f7e2478fc0ed811d738a6e362faa8d12fececfef6bfb9b7abf283e561da6e81bebc

Download Submit
C:\Windows\SysWOW64\Dkljak32.exe

Filesize
96KB

MD5
c789b3d9a4aa53f86579f9c006157295

SHA1
c8c55b7f69870dc7dd6c3e19fdf1c5f40389adf2

SHA256
41a04e90be4743fc83a1e145570eb1e8867ac2f63896cd1fbb639e7f860831ae

SHA512
56f42199d11d14892da953b61322382b6a7e4179c29771ab1f4d9cf3a9c1661542536502d3d0e961d2f4e4726cefbd25e30f97de0bf0d027494573a36ae8643a

Download Submit
C:\Windows\SysWOW64\Dkoggkjo.exe

Filesize
96KB

MD5
2b5d73adc82d57da326a6d344b587a13

SHA1
cc7f7bbf69338b1a53c8513169e48475e0b9f6d1

SHA256
bde7f0236486db307e910460aa0d2fe8c34fa5d16e639e4bc312020585bfd40e

SHA512
84e8768d9d337650c42df771d0c9ce4e45e9df973d0d3d750301920d870091d401d673475d13c18b50a7e47498ad0f867368e392c6c494164e0971fc8f753cdd

Download Submit
C:\Windows\SysWOW64\Dldpkoil.exe

Filesize
96KB

MD5
1fde5b77f88dd48d7605e09a5169a967

SHA1
74033b19d5e60f3544d8673ff06c6bd684fbbc12

SHA256
ef16d55ecca4b9fadb5af0b5b2661d841bd271442389761c1da969425124f2ef

SHA512
07ba1811a95ef03b5b94f399b149ea05f0e09762e2b1b15181e68d6f2109b538c44777251d0dcbb9e5b7fd571a1bd3036ef80c5796b1d3962c1a2a3b52069cea

Download Submit
C:\Windows\SysWOW64\Dlncan32.exe

Filesize
96KB

MD5
01663bd251de716cbde6c08c2ba7434d

SHA1
26573dc4483048daa387efb895ce247224140f38

SHA256
ce7186dda7aeeaec87cc183c171dca53acf1e2f81de3f062abfd5046915a54da

SHA512
962610445fa02dd002d7b774a6a50ec6856a5973552a273fb5d09090fccb822d3fd6bcc084a637fb41b7b52b5df1c1ef5ef7ade6f86c3292973da033b432a0d1

Download Submit
C:\Windows\SysWOW64\Docmgjhp.exe

Filesize
96KB

MD5
cacb05438cd4da9991a7d3984326d1a7

SHA1
6e7534d0709672d111f4fbf33f06c193dee0f886

SHA256
abe78b201b516aa109e98299e93f348f3613403baa8a8df5514a0c72db10a442

SHA512
346a9617fefe818803f3b36918278923e6f81c4e342227dc8d7a30877311635c508e343aa02c7e934cef58593d075b50fa7dc7f70f70b8f81502b05494346ffe

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
96KB

MD5
1e498ac686a88ceb0fec9b4c2370ab00

SHA1
5dce8b06a123e59b149886c1067f334f540232b7

SHA256
b0dcde1ef43fb070a707db47c0ffc0a1e80b468a5e8b6881f2c04d9e49dc3d53

SHA512
47821b59774461cfaef6a8f4ef0acb3393d98ed08ee0ee15e790059b7beb8883d452645426b85c34cc951e39205ad8a0f33ef76b92e8ea95d1acc8cbd3e8eac1

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
96KB

MD5
73192992ef1b8cc4b1f0f32d4ce3772c

SHA1
a6778a1aaf9e73c75adf10765ceba1218f69d708

SHA256
23f03b311e1ba57e5a5fb754bd66268e5548c5aff7ada439b6e8f4ba6527c15e

SHA512
fce548ae8a7b530ad71280fb589621ca145acf5fdb336104b1fadfdd7fb06cce71046ad231e02715947a76578e6fcff572e1623c274f9482d6dde6924e70036e

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
96KB

MD5
8646d43816da1a665d51e243bc974ad8

SHA1
bf6257ade6bed8932ec95a0a193beb33e7309a5c

SHA256
8b140f51744c4552dd377a139d1c784b5f85f14dc69fe0e18340e7459eb10dfd

SHA512
18d482928ff7f1096431ac03f4806a36bf92cb0b9441861159ea2f61a933a11bb48b6e3ed1709c3391ee7b95e342809e0bd9e210cce91a8c062ef64ce7fb792a

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
96KB

MD5
16a060dd94db36df24e9315bc6697ace

SHA1
31bb6b0fb29a1ea194d1b332080f373f61b4b83f

SHA256
0cc0e0af444c1ff5e08512036eb4f1454cc0b0d0f773e6eb9b624340ddafa50b

SHA512
e1a305721b76ce7d2299b50a9d0866eb9a40a42ef0e91dee805d16322298a8261ffeda15a60da51ba3c552e6116de9a3629fe52904ffa0d7c61abee09556b722

Download Submit
C:\Windows\SysWOW64\Eefhjc32.exe

Filesize
96KB

MD5
df9cf507ee77d2674987b171fddc952c

SHA1
fe149e31780bab8cfc4531620997207532b9fc2f

SHA256
40304baa7526deee84fe40be8e39766fde86f609b6f0a114eb757a6eb697cced

SHA512
12bbb2cd7df5b5fb97651d07b0827e96cc9bc61d644be45f6a3b87f6c6cefb6757184d50daf6ad80aa2b2f1161d1fe4bad3c48257a00061b1c95a12ad469e5dd

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
96KB

MD5
317b80390559591bb5e6ccb16732d960

SHA1
9c8d30871446bd0714181f3548b2432b474282f6

SHA256
77c980321cb2c886c4eb374b17d23ee62a629c2cf00d2b64674abd3a07e16f30

SHA512
b4113bc92d21595ea5107fc02cceb13bc50987070c8025c669295adb8d1a5f1a354d2434c0625d4a3de8f9625b7533ea3c279c3bb69e1de8e5ed44b8cf361a61

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
96KB

MD5
521401c3f61ad64d599e668a99fad803

SHA1
50395abbcb6df7498bc3eaab441c9345480619cb

SHA256
7e75bd3c22b9a826464b7e67e9fc9f66394c0befc9c65f61f30cd838e9a0a106

SHA512
14ae84e9a9e596aef5b01b875e3ddd0c2cb2bd93d944fd21ae3aca4d70d0ff5cfbdd943cf18007fcf3e097ec87a29bf5ecbc1d9a6e8d007f8b3a5dcddd34dc2c

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
96KB

MD5
9ab401a31e2acc3dcb9a3712029e9470

SHA1
b28087fc61dde93396a4920f26a59d0cf2d9924d

SHA256
43d0c56d2f7b0dbfebb6c593ea246830adaa86067e2ee64aa249e5c6fff883cf

SHA512
6526550b172955cd9a07a5399ddf3e1d5c59fd53d02c96f8423ba6a1921de5ecab41ec714c1e68d983abf0e50b6e6feebc0e119a70f352efd47b487058c21403

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
96KB

MD5
bfe4c86c2658855ee1cca8d4781e4595

SHA1
2afcf6c2c9162e8a8036fd59002eec4efa3b622c

SHA256
d358b66b4ade371608ffa08d5e0a134b3ffa40ddb950103a9ce5d34b51fe4797

SHA512
e1320a4c2711a4e3005299268d8ef4a48c49ef1e39e7a6e4f07985142b1871afae5252d1270045e701e438e1af86eb1d950e602fce703362890e38bf7ba6e3b3

Download Submit
C:\Windows\SysWOW64\Ekcpbj32.exe

Filesize
96KB

MD5
eb18158432d0f946dc15887a2b8fc5a7

SHA1
1b839ac2936fa9153d5b5de46a0ffe4db6f6c722

SHA256
8fc29600fd518b84c53a5ddb3dfdace0774c988545841efdd1e408c25470ed1d

SHA512
bc18a21f3c42a35d817e264b4e9ee005f1e0e809977d93ae3cd915c1c8ea2b482c8aa041ebed22c3a4cd71ffd9875d2842a8dd87e56a16c01c2dd73c896e7a7c

Download Submit
C:\Windows\SysWOW64\Ekemhj32.exe

Filesize
96KB

MD5
dd685f61b924bfbda331a610a89e9dac

SHA1
30e62d354a958c195de50e8be9013baacb490e9a

SHA256
855730c011db0e16f626f56121116580daa4f41cd4aaa409e14a6ae34b80b37b

SHA512
4e970ff005e09ed0b20ff36dfe43998a95462923a43aa210595341c5f5205609217e197b359d8e781f724c17994fdc27ff3b650364a4602e5c3471b20dc5924a

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
96KB

MD5
0e0518fad61d9df121ecab3d38227244

SHA1
508715b95314729d59fccee54b5ecc6dd35e2148

SHA256
169d690d06a944127769e320f0c0b3951de32f7cbfabd4b71f6c67ffe7601b22

SHA512
03fae108e00d7bcd0b1e388a61e772db9315404d166802c6247333850aa171c63fb2a80f52adf88f892063ee365a8dc1be73d406df96820ff9d17b530f9d8ed1

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
96KB

MD5
44686ab597d9f1f0e59fd0d29f79e9c7

SHA1
136954d60e061b853d0397b78dbf70f3f2f0df37

SHA256
8ab8a2f3b437d201c45aeb0445b16bab7753ab6aafa6e0f4eb17f5e09468b1ee

SHA512
b1698ccb1d92e2a305818ff7f1e53d7c4bb5cf6a013d0289ca132b3726293a9890d110e456b50a8d08bc2d6396c7524ad4084bf6aafeba3b0a64ca4970243859

Download Submit
C:\Windows\SysWOW64\Eolpmi32.exe

Filesize
96KB

MD5
f3a4585cd28c7e6c855063710d0c2348

SHA1
f31f7cfe910fc9772a6ec62aa2dd9f8abefb13f9

SHA256
51242a902504dab9694bf0826eb19651588914b92f9bb1d06dc4b75517a39f84

SHA512
c7efccd331f5cba5f289e1f3995eeba3088c51894ac05580c770d3520278b65d3d52e683b1333f00cc84bd28cb20bf52afd76db61ff371c5b5f7f000885e1123

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
96KB

MD5
442be709bc219cfe764a7e0831239c24

SHA1
2569b6e1a05178b6212eba2dcd86732d221a89b6

SHA256
a3d06b55a5273f742ec6526b6be016c7398a0abdab710ad8b89d3bc33ffd9d0d

SHA512
a8d56b376858d9e6e082d9f6ff6a8248d4208f2725f3bc543a9d4e85672c86e1a96c25cf79c8ae12be52fb6d8d03ca4c608b2ed4a0a24a2e97804d37cef8bc1e

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
96KB

MD5
bd8cda2276cac81a60dfca14c1e4a388

SHA1
6eb3f4c027758b0df44f2304c33d8c885acddbb4

SHA256
ce2b2680b2899c2796e006c8124e4d0c33cb61ac9c5230831ce26d5d68a46b49

SHA512
8134de5114d98d75e8a50e29260d5b36de1d37e3b92d3686ffbb503e398d60f4571482532fce6b0996f72e262859736820d1063c98373351d150e743ef554094

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
96KB

MD5
5361c18c747451f35f3a6fcfe951fcaa

SHA1
4e293cba083f30c5406be2193fb8ea60a12de1c9

SHA256
7783e0faf10934c761ed26f29c373e557b2cdebd7c7cdc346495507cd24a5cd8

SHA512
8971d773530efb38084c09c130f4f5b33d6d33b79f2e90d82d75df224178175b4768c30e3ec7fcc56ccdd6c6fc7e854016ffaaaec8d86a73b70cdf4b9eefe231

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
96KB

MD5
59677b36da3fb02bfb052ca1988e17c7

SHA1
d1db6af0ea76bb259d9335ff83616318bf652f75

SHA256
45922b851bd2e7c1177305663c584270d60c4ab1653d223a08728e3bdb019fdf

SHA512
b0291ad755e8cdc25d92f7e27b1f372d39b6716c380d3c3520cf409b0eff245881cde777b1db1569ac66d9b41384d9baf1f56532d9aabb41f7fc10a8baed2764

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
96KB

MD5
b5d3d0d4f6f484b7255622c4891e0d11

SHA1
9b4ae136dd580696a3af97e9b46d51ec4b489063

SHA256
0fe5cc787c4de1521dff3c8ef3b0d6cbc0c7bbd9ee77a4b743085c280a3dbb95

SHA512
70ba2348c8e50765c0dcd2a9f94682686ba2cdff7123cef4d3e2778a68570b509d31aa4010869fa280d3b7d88ac97806c09283155d3ce44b04a025c41204b90a

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
96KB

MD5
93a684a9762960f774d8792be08e416e

SHA1
1eb5dabe55a9927de498fb774e3a84d80ee3092a

SHA256
abc0a141b5cc23e7cb931c4e52354f76c4d0a9dd14a591acaa1d20ec2301891a

SHA512
94a6b7625e09128b10bd649f17df41ad50bd4de9c5d19b9d10efdce85ccdb17d041fb407c66a3483e1014cf319c4f3fcb444c115c1fe3d1561eea5bd0404ebfc

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
96KB

MD5
1923069c50c275949a1189f4436a2769

SHA1
79ac0a81b7017d4a69d67a87b7738c9042c42e1e

SHA256
4c13e482571dd503d2bdd6abb2a3f57b9747fcff570bc5f2bfe7183f890455d2

SHA512
42031cfdba49de46a1dd2367070b2c2900288a403eec96dfb83dfd43ab92a0e09304316102834f9cf8be75bd90a5f6825970e4890118530e3168fe147ccb2503

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
96KB

MD5
d2c52765d1ce40cba6ea1484dc92883a

SHA1
059ce21a89a722e87405c0f5410d66e96c90a735

SHA256
43f00c94810cde59d81d4ee6e538672ebb88d7ea63382c49746b99ef39fddc7d

SHA512
66ecee46d87008f3fa9e08b49eb0cf08a9e3ad9e18cd8a06f0b0aa4feaee26292537b03c3da4b62e91d3d2883723363a2ec84425c9c812e48e715d0c89b9d403

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
96KB

MD5
ad64a46d7439d8bd025a8c39f809967a

SHA1
8ebdf6598de4f14b27836976480952f656c2b675

SHA256
89b92ccced0fc8b3346c580eef7ab8cbd0e589a25151d0f9dc38955c6c48a36c

SHA512
d1d379e247d7479b59f936082c93d4422106d2c1ab36b02de260960fd38f7b38e0fce33551a6389dda4a98e648674060c9ed0eda0d68a43c5225c386bf60aaa9

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
96KB

MD5
dd86c4b1a48f2455071c8b8b85a786ba

SHA1
ee67285a1a18fe2ff5346ac60cf9e5ce77d68030

SHA256
8d4e0dd79c302e9bd24a40490dff0f0563c43a2b1f480a45b0957a1f871130dc

SHA512
d79d9942422261a130becfa0d492ca3a12309d2b382848f93be76a4363daec13a5aef0edbf06e4615d46a47bc595a8a3cd849cfbd30d4823dd4dbb42ec052dc2

Download Submit
C:\Windows\SysWOW64\Gfngap32.exe

Filesize
96KB

MD5
4c47f4630000e6e5e84a3cc1b58dd068

SHA1
e88a927960a32269c654ef7e5a6e9eee30bf544b

SHA256
013d54c2f1ac0ceb034629c91dc31da58d80fe206d96d5f5c67b401fb539f471

SHA512
7c3902d5c64a24dbe1cf00b9ef501616f9c526e87291079f7238461de1a68df62c18e5e8653e5449aa9f6599721b6813d497fe69372bca1549bec22d66e4ce0d

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
96KB

MD5
51eb1b1662a036950e58e4ea5ed341f9

SHA1
26ff7de6e6f6c711075f86c72da5eb6cbfacc903

SHA256
112ad0b2d78822b6c824053ea640ec294cdb57ce5feadfa914cc57de1c9a91e7

SHA512
28d7d7c8719dca152096962d8dea016de2f15eaef5512547005e650934b1c799e92149b8ed44e1ffb1ad8bbcb227522e6c72d885dbc38885d825846dc92c40b9

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
96KB

MD5
9a5155610b2c8850cb896045fe69b1ff

SHA1
865eb003a282e8ddf89ab73d3d91d384d34ad914

SHA256
637ae6ec778e270dfb2d01b30c174ed31539392ff3befd7a3743559ab1012c05

SHA512
cadec38543d54bf7c50c559816bce7326542db1f1b5584ae18f6d8c00ab5e7f8464b25ac3618156c027f378d020b2ab6251f2e164a3394920a2874ee9939cc38

Download Submit
C:\Windows\SysWOW64\Icgjmapi.exe

Filesize
96KB

MD5
58e700c4a8b8229283dba1e51e46c723

SHA1
26eac8703e407c79aa3e61ac31e6b0654334f98d

SHA256
ae0fdbc808c2ebc5c2640ba2d46301b9680963b0ac2afbcb55860e634b9ae680

SHA512
fdc9e5c50a82b2201baccc18a7ea501e074f68cc03fa6aa648281e4c1737e7894c1b1c2c4eb768393c47f2dbacac14e922a91f1d3bc3157ce15811047ce3b4d4

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
96KB

MD5
c9a8cf9156996ad72dab3378e149daa0

SHA1
c46e1b0ad5466e8c3aaf35b1540b36dcb4f33838

SHA256
e006cd3309a386a283a7ba016b4c8e1610ff071b5791664e65ebec30d660fa5f

SHA512
4b4adceb1a1824bb27b76acb8f234d82813dcfb3d66965468a9a3e874916f31823777561ea7314625a5514c79cf2f2b62badbed78a6a16ec89d4dfeb6d4347bc

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
96KB

MD5
e1eeddc04bc383d8df4fa90aad3af9fe

SHA1
f4702cc547fc7915b627fbcb9037c2add7ca4a4b

SHA256
b2221bbef3c210a8cdb1fd371727cea76ef4af8e93f36fee1333dd1b26bcccf9

SHA512
182cf4831d3190316401eba5c8fcd77193c5942397b00e91a6f37fa7381fb8424b5dc8add7672ffa5b74b024f591281024cf79d4cb938500a734370aa2774dad

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
96KB

MD5
169f1a1f692a84ee5e55a30278b15493

SHA1
3f74e6de7a60c2924676278add0d62e8ac724aeb

SHA256
1c66a24cb331f82240e301d27ba4df7d33551b84d297668adeb00d2f78b0b9df

SHA512
5e6fc9c113a6f51dc06f9abe7d8033688c2c86394e974004cf9014c4b125309c6752771172a287ca41e5aeeb665e23e315e9cb561a160315c805d8fbb225df97

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
96KB

MD5
4fd1ed31da4d73e01e1402d86b4d91ca

SHA1
7e10ed195ab0711815d2b6f426bf1f70d59e181a

SHA256
4b89bcffe0ff9fc854115507dbdf18e0676d9ec68ddbddea50e446ab58b576dd

SHA512
8d6dc4c9050158f78d9a93fa9045de7790956aeecce2aea85f5f300df9577647bf70e3dd466c6350c2352ecd6e827d807c03e414a7d463b6c052dc4b5ce36731

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
96KB

MD5
e097f4a0ba70043f57ebca907830b328

SHA1
c07cbad0c1d5b8fb20f4f3001b86d935dc5e15c9

SHA256
d361d181aa0da79b0cb6c59a6527c4aa3aead508900fca8295495d3dd65d5451

SHA512
1567f85d194357b0b7114c0b13ca2a6440dbca929a4b3087589da63760492c73b569d28dd24b79c89f7535cb581f46ab9f32bc198b1f4ea5bfd0103a306a04d2

Download Submit
C:\Windows\SysWOW64\Mckemg32.exe

Filesize
96KB

MD5
e7ae15417af96ff6ebb7e5d5ff23d2ed

SHA1
88c9fcc1076f3914fd5cf5e8c6c77fbb1d5a012e

SHA256
4e7251cf80feb574fe30203ee8b5c723b003e3bda7d4d0e01e5e45bcaca069bd

SHA512
001d4b2eee8a9d630d0e5618e55eeb8544d6e1fc6be49ac5fd9b37d678e591eb02cbea5735fd7adc67fa4685c2b146a16707b6f06e7790430b9fea196b4a7f91

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
96KB

MD5
a4a0e23f82af337b417fbb481c5ee016

SHA1
66269856ba91b100ebda14c4817f845061bc4718

SHA256
dc4cdb18ff2c80e50f6fa9be2d045b6b50c8bc22609a09e85db0426ea552354f

SHA512
62b260d76a153a3bd730da12116d5fedc5f15a6a3a7787f78c511d3f34a2a0fba5b29802687c775f834c969a0f6ee9a485219d9331503e5cffc515fc7c80ec2b

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
96KB

MD5
cc4b80049b8e7a878e3594ea3fa857d8

SHA1
96a0b8e7f4f5117176ada707e681b4d9839042ad

SHA256
136337f53d73a2e2ee0b222f6475befbfe45abd3473f003f7975d34d73f31e66

SHA512
59c822ef0ae48399333f94030bb06a37da2bd794b9dbef72dbc33695ef44db6c3d55ea2f833753666c5573335052ef6687cb54fa1a7e7358947b4695f43a9a59

Download Submit
C:\Windows\SysWOW64\Ncfdie32.exe

Filesize
96KB

MD5
cb21f4e7ad4a7c473515226a51282510

SHA1
e76b3974625ae3f5134e02d1fbbb7d8eecab5251

SHA256
81b8aaac4ccf2b9a7a4c57914e4e17985bbacbd199974ba4a25a0f1f0c43df38

SHA512
fae965391c570f29ba97f282da9e8112f68dadf56b0a5f62baeb46fdde1b907c7f36306a689fd8fe745670baf7304b2c14df2f2b592d6e88c2b19fbb444ae16a

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
96KB

MD5
7bfe0ce9c735ac0fe7c3a8b2fb3456ce

SHA1
3be7d844561f73d3393ec583bafd2ecb818256d6

SHA256
b29622439f713f048a4645da16229347a9dd01a7b5e07d279d5c5bef33b58575

SHA512
d08647a25bfa59e25127d708fc18ba401591784426527f8d6aa8a1237cd94863ba79e21e34b07f0382c9407a184d6acd66ea087e210c8578e5f1581299acb545

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
96KB

MD5
49020b9c10823ad201081ebb20465064

SHA1
775a9037c0f7661ecab159d046580dcbbc378db5

SHA256
db1c29cb06e5afbb50a0e08a3f423cd082a98f1c6ca7cf9d473debd1be3079a6

SHA512
23b68461c2fec2679bb01672576b60734bd2f9bee695b09a40a12dfe92f3aa413ad47270e2dbc683a44a4548f9c7265b8207674c1e222daaeccbdf859acbcacf

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
64KB

MD5
ce728c86031dc8041f9e8d42b5c45e14

SHA1
4c2d850834ebb98ed58c94775fb03dec7669b6f5

SHA256
3c7b6b5b1a170dce651f6ca3f98fb8ef507c55f16ec69ff209c6d95d5839b290

SHA512
32750702dc1522ebf34919df85d35ebeaa50c88146105531061e31a29bff9587bc5503b7de46068026de1cd4b41546ff43bdd0dd36cfc7db9a0e9b579e8d0284

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
96KB

MD5
def7bfafbcb5ef1362bb7f6ae4504a87

SHA1
e7d22dcf2630374ae411d98f5c28b6df0451e5ab

SHA256
007037f67f1e1084a2bba2853617fcb58b1c4652a0c5677c922be168cc642fc8

SHA512
9bc907a0c0d9deab3a7cba88a77ff47fea0f54e42541a35d47b0b433bfa8548b6ffc04ac75714e94941ab23cd89997ed3bfb42a0ff51607f2cea99a0768238ef

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
96KB

MD5
8307078bf0a4b6aab1dc8f308800cd36

SHA1
b3f40d03019b6669afa4f788f655cc7a998d75ef

SHA256
7d6e6edabf68d5e87827540a0a3a55e004fbac13e8a5384eeff202c243b2545a

SHA512
0829607f75a0f30b4c52351769b350b785d890f90a534fd55180afc640f5e4783f1a1bf131ef1456246055cc0eed4fc1967fa4d876a72aa08b659f0fd7a7c9dc

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
96KB

MD5
a0615548c185cf6b6ffdf7880b4af96d

SHA1
8dfc34b89a5e7eaf9b006d93637b045e6067e40e

SHA256
724b433df7b1bc62c10fcce095777f0fdd665ff6e6fa85737c8ac95bf799d6e1

SHA512
6a2500b20e6bcbf7a8bbbac86c9e5381dd2bcf603d0025097a98c0d8a9c28531d07feb359f9f2e8dbeb369583a7db6fa9daea020e8d1bbcaa4666c953b975a31

Download Submit
memory/208-164-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/228-450-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/372-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/448-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/764-472-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/824-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1048-460-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1208-416-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1348-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1384-352-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1428-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1448-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1552-520-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1860-602-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1860-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1912-532-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1936-555-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1940-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1972-370-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1976-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2000-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2036-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2184-466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2224-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-591-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-406-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-127-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2592-326-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2724-296-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2820-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2876-228-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-565-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3060-592-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3092-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3108-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3128-603-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3180-508-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3244-104-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3336-215-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3372-526-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3376-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3560-212-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3632-584-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3632-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3636-490-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3676-562-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3680-442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3736-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3908-394-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3956-478-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3972-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3972-564-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3984-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3984-554-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3996-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4012-578-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4052-576-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4056-514-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4064-428-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4072-496-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4112-120-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4116-332-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4148-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4148-577-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4192-422-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4196-320-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4224-585-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-285-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4308-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4380-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4468-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4476-343-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4520-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4540-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4568-367-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4660-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4660-561-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4688-196-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4700-544-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4772-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4860-502-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4888-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4904-542-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4920-350-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4928-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4932-232-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4936-382-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4944-454-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5004-95-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-188-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5024-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5080-488-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads