87da85dc75b5bdd3bc50fea9c86866a65b1b14aba330b68eecad857a1d011471

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe
Size

80KB
MD5

2a94d801930ee93c9611f47e237d7e50
SHA1

cfe3812c9012d0d509224f2674269c6a184e6ebc
SHA256

87da85dc75b5bdd3bc50fea9c86866a65b1b14aba330b68eecad857a1d011471
SHA512

fb9611c6258e3dc36c4cff6c8a3785a5db10c845b10463dda9fe66bc80af9b70d73f60cdfac0ac74aa73d08ae140e6216c41b8041cc1495e97fd4804497327ec
SSDEEP

768:dz8yzsLrZyJIf8uUMpHVAJwCg2u0lNwsq/1H5MgeB8W44jzo1MkEJuUQW+21yGEN:dz8rZvJpHKg2uUij+D5YMkhohBE8VGh

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cecbmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eamhodmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnnjen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hioiji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecmeig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eleiam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elbmlmml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Helfik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alfkbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cafigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaepqjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cddecc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcmgfbhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe

Executes dropped EXE 64 IoCs

pid	Process
224	Qjbena32.exe
3672	Qalnjkgo.exe
1376	Agffge32.exe
2268	Anpncp32.exe
3124	Abkjdnoa.exe
4744	Ahhblemi.exe
1704	Ajfoiqll.exe
4748	Acocaf32.exe
4860	Alfkbc32.exe
2644	Abpcon32.exe
1800	Aacckjaf.exe
4520	Ahmlgd32.exe
2316	Ajkhdp32.exe
1708	Aaepqjpd.exe
4208	Adcmmeog.exe
5104	Alkdnboj.exe
4496	Ajneip32.exe
4764	Bahmfj32.exe
440	Becifhfj.exe
4068	Bdfibe32.exe
968	Bjpaooda.exe
5116	Bbgipldd.exe
3688	Bdhfhe32.exe
2372	Blpnib32.exe
2488	Bnnjen32.exe
3772	Balfaiil.exe
3500	Behbag32.exe
4508	Bjdkjo32.exe
1112	Bejogg32.exe
3524	Bhikcb32.exe
4512	Bjghpn32.exe
1536	Baaplhef.exe
4800	Bemlmgnp.exe
2492	Bhkhibmc.exe
4272	Bkidenlg.exe
2476	Cbqlfkmi.exe
3300	Cdainc32.exe
2232	Cliaoq32.exe
2088	Cklaknjd.exe
4232	Cafigg32.exe
1668	Cddecc32.exe
1816	Clkndpag.exe
4092	Cbefaj32.exe
4228	Cecbmf32.exe
5072	Ckpjfm32.exe
4796	Cajcbgml.exe
4960	Clpgpp32.exe
3312	Cbjoljdo.exe
2904	Cehkhecb.exe
3904	Ckedalaj.exe
4848	Dbllbibl.exe
1244	Ddmhja32.exe
884	Dldpkoil.exe
4560	Dboigi32.exe
4352	Dlgmpogj.exe
4640	Dadeieea.exe
1744	Dhnnep32.exe
1532	Dccbbhld.exe
692	Dddojq32.exe
2704	Dceohhja.exe
1680	Ddgkpp32.exe
5092	Ekacmjgl.exe
2328	Eaklidoi.exe
2212	Ehedfo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Oneklm32.exe
File opened for modification	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Ppelifin.dll	2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Lnaendmh.dll	Bjghpn32.exe
File created	C:\Windows\SysWOW64\Gnbinq32.dll	Kdeoemeg.exe
File opened for modification	C:\Windows\SysWOW64\Llcpoo32.exe	Leihbeib.exe
File opened for modification	C:\Windows\SysWOW64\Ngbpidjh.exe	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Hipfji32.dll	Bdfibe32.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpqo32.exe	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Jlednamo.exe	Jifhaenk.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Egdmkp32.dll	Clkndpag.exe
File created	C:\Windows\SysWOW64\Gcmdhh32.dll	Fcckif32.exe
File opened for modification	C:\Windows\SysWOW64\Hcbpab32.exe	Himldi32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Iedoeq32.dll	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Melnob32.exe
File created	C:\Windows\SysWOW64\Ahioknai.dll	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Kiljkifg.dll	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Adcmmeog.exe	Aaepqjpd.exe
File created	C:\Windows\SysWOW64\Ncnkogdb.dll	Bnnjen32.exe
File created	C:\Windows\SysWOW64\Iehfdi32.exe	Ikpaldog.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Nljofl32.exe
File created	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Aacckjaf.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Kbfbkj32.exe	Kpgfooop.exe
File created	C:\Windows\SysWOW64\Bfajji32.dll	Lpqiemge.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Gfpggnan.dll	Ekacmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Fooeif32.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Klohppck.dll	Cliaoq32.exe
File created	C:\Windows\SysWOW64\Dlgmpogj.exe	Dboigi32.exe
File opened for modification	C:\Windows\SysWOW64\Gfembo32.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Imhkcaln.dll	Hkdbpe32.exe
File opened for modification	C:\Windows\SysWOW64\Kbceejpf.exe	Kpeiioac.exe
File created	C:\Windows\SysWOW64\Gmjlcj32.exe	Gfpcgpae.exe
File created	C:\Windows\SysWOW64\Bjpaooda.exe	Bdfibe32.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Hbcaee32.dll	Cdainc32.exe
File created	C:\Windows\SysWOW64\Neiigifj.dll	Dceohhja.exe
File opened for modification	C:\Windows\SysWOW64\Kpeiioac.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Hcdmga32.exe	Hioiji32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Bdhfhe32.exe	Bbgipldd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7296	6820	WerFault.exe	347

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiglalpk.dll"	Aaepqjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Becbkfdh.dll"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfhbbpk.dll"	Ddmhja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgdphnlp.dll"	Himldi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojdamdma.dll"	Cafigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dccbbhld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckafhlkg.dll"	Dccbbhld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaqfok32.dll"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlineehd.dll"	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jimekgff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dadeieea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibbmq32.dll"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donfhp32.dll"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anpncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnqmalhn.dll"	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqgbjkm.dll"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjegoh32.dll"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmbcpkhj.dll"	Balfaiil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clkndpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abckpb32.dll"	Jimekgff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cafigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejfanad.dll"	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfembo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 224	1020	2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 224	1020	2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 224	1020	2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe	81
PID 224 wrote to memory of 3672	224	Qjbena32.exe	82
PID 224 wrote to memory of 3672	224	Qjbena32.exe	82
PID 224 wrote to memory of 3672	224	Qjbena32.exe	82
PID 3672 wrote to memory of 1376	3672	Qalnjkgo.exe	83
PID 3672 wrote to memory of 1376	3672	Qalnjkgo.exe	83
PID 3672 wrote to memory of 1376	3672	Qalnjkgo.exe	83
PID 1376 wrote to memory of 2268	1376	Agffge32.exe	84
PID 1376 wrote to memory of 2268	1376	Agffge32.exe	84
PID 1376 wrote to memory of 2268	1376	Agffge32.exe	84
PID 2268 wrote to memory of 3124	2268	Anpncp32.exe	85
PID 2268 wrote to memory of 3124	2268	Anpncp32.exe	85
PID 2268 wrote to memory of 3124	2268	Anpncp32.exe	85
PID 3124 wrote to memory of 4744	3124	Abkjdnoa.exe	86
PID 3124 wrote to memory of 4744	3124	Abkjdnoa.exe	86
PID 3124 wrote to memory of 4744	3124	Abkjdnoa.exe	86
PID 4744 wrote to memory of 1704	4744	Ahhblemi.exe	87
PID 4744 wrote to memory of 1704	4744	Ahhblemi.exe	87
PID 4744 wrote to memory of 1704	4744	Ahhblemi.exe	87
PID 1704 wrote to memory of 4748	1704	Ajfoiqll.exe	89
PID 1704 wrote to memory of 4748	1704	Ajfoiqll.exe	89
PID 1704 wrote to memory of 4748	1704	Ajfoiqll.exe	89
PID 4748 wrote to memory of 4860	4748	Acocaf32.exe	91
PID 4748 wrote to memory of 4860	4748	Acocaf32.exe	91
PID 4748 wrote to memory of 4860	4748	Acocaf32.exe	91
PID 4860 wrote to memory of 2644	4860	Alfkbc32.exe	92
PID 4860 wrote to memory of 2644	4860	Alfkbc32.exe	92
PID 4860 wrote to memory of 2644	4860	Alfkbc32.exe	92
PID 2644 wrote to memory of 1800	2644	Abpcon32.exe	93
PID 2644 wrote to memory of 1800	2644	Abpcon32.exe	93
PID 2644 wrote to memory of 1800	2644	Abpcon32.exe	93
PID 1800 wrote to memory of 4520	1800	Aacckjaf.exe	94
PID 1800 wrote to memory of 4520	1800	Aacckjaf.exe	94
PID 1800 wrote to memory of 4520	1800	Aacckjaf.exe	94
PID 4520 wrote to memory of 2316	4520	Ahmlgd32.exe	95
PID 4520 wrote to memory of 2316	4520	Ahmlgd32.exe	95
PID 4520 wrote to memory of 2316	4520	Ahmlgd32.exe	95
PID 2316 wrote to memory of 1708	2316	Ajkhdp32.exe	96
PID 2316 wrote to memory of 1708	2316	Ajkhdp32.exe	96
PID 2316 wrote to memory of 1708	2316	Ajkhdp32.exe	96
PID 1708 wrote to memory of 4208	1708	Aaepqjpd.exe	97
PID 1708 wrote to memory of 4208	1708	Aaepqjpd.exe	97
PID 1708 wrote to memory of 4208	1708	Aaepqjpd.exe	97
PID 4208 wrote to memory of 5104	4208	Adcmmeog.exe	98
PID 4208 wrote to memory of 5104	4208	Adcmmeog.exe	98
PID 4208 wrote to memory of 5104	4208	Adcmmeog.exe	98
PID 5104 wrote to memory of 4496	5104	Alkdnboj.exe	99
PID 5104 wrote to memory of 4496	5104	Alkdnboj.exe	99
PID 5104 wrote to memory of 4496	5104	Alkdnboj.exe	99
PID 4496 wrote to memory of 4764	4496	Ajneip32.exe	100
PID 4496 wrote to memory of 4764	4496	Ajneip32.exe	100
PID 4496 wrote to memory of 4764	4496	Ajneip32.exe	100
PID 4764 wrote to memory of 440	4764	Bahmfj32.exe	101
PID 4764 wrote to memory of 440	4764	Bahmfj32.exe	101
PID 4764 wrote to memory of 440	4764	Bahmfj32.exe	101
PID 440 wrote to memory of 4068	440	Becifhfj.exe	102
PID 440 wrote to memory of 4068	440	Becifhfj.exe	102
PID 440 wrote to memory of 4068	440	Becifhfj.exe	102
PID 4068 wrote to memory of 968	4068	Bdfibe32.exe	103
PID 4068 wrote to memory of 968	4068	Bdfibe32.exe	103
PID 4068 wrote to memory of 968	4068	Bdfibe32.exe	103
PID 968 wrote to memory of 5116	968	Bjpaooda.exe	104

C:\Users\Admin\AppData\Local\Temp\2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a94d801930ee93c9611f47e237d7e50_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\Qjbena32.exe
  C:\Windows\system32\Qjbena32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\Qalnjkgo.exe
    C:\Windows\system32\Qalnjkgo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\SysWOW64\Agffge32.exe
      C:\Windows\system32\Agffge32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        24⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        25⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        28⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        29⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        30⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        31⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        33⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        34⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        35⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        36⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        37⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3300
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        40⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        44⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        47⤵
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        48⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        50⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        51⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        54⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        56⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4640
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        58⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        60⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        62⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        65⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3236
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:228
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2624
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        70⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        71⤵
        Modifies registry class
        
        PID:3704
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        72⤵
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        73⤵
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1240
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        76⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        77⤵
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        78⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        79⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        80⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        81⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        82⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        83⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        84⤵
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        85⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        86⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        87⤵
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        88⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        89⤵
        Drops file in System32 directory
        
        PID:1332
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        90⤵
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        91⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        92⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        94⤵
        Drops file in System32 directory
        
        PID:2052
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4952
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        96⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3228
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        98⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4436
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        100⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        102⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        104⤵
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        105⤵
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2728
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        107⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        108⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        109⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        110⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        112⤵
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        113⤵
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        114⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2028
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        116⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        117⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        118⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        119⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        120⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        121⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        123⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        124⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        125⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        126⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        127⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        128⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        129⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        130⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        132⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        133⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        134⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        135⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        137⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        139⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        141⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        144⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        145⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        146⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        147⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        148⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        149⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        151⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        154⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        156⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        157⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        158⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        160⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        163⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        164⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        165⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        166⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        167⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        168⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        169⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        170⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        171⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        173⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        174⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        175⤵
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        176⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        177⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        179⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        180⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        181⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        182⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        183⤵
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        184⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        185⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        187⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        190⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        191⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        192⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        193⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        195⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        196⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        198⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        200⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        201⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        202⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        203⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        204⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        206⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        209⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        210⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        211⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        214⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        215⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        216⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        217⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        218⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        219⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        220⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        222⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        223⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        224⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        226⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        227⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        228⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        229⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        233⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        235⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        236⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        238⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        239⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        240⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        241⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7184
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        243⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        244⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        245⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        248⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7532
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        252⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        253⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        254⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        255⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        256⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        257⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        258⤵
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        259⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        260⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        263⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        264⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        265⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 396
        266⤵
        Program crash
        
        PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6820 -ip 6820
1⤵
PID:7264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aacckjaf.exe

Filesize
80KB

MD5
14db74964184a5c89a0075c220f745d5

SHA1
feb34a62881cce5a7471c42349b4e063e5ec8806

SHA256
624722e69c429ff689cfeebbb989d2bbc099ca9945c9d228d035a73df75ba6f5

SHA512
13b494f3519dd4a17d7c7bdade8f994df0283eab1ce0d5359cef6b09524a9742a8beb25f7f0a27bea67add9e430393d22d7d8609ffaf3153b2d963532762d137

Download Submit
C:\Windows\SysWOW64\Aaepqjpd.exe

Filesize
80KB

MD5
275f02e30433332ba582ae9eacec5912

SHA1
7b3309fbba7e81a71ed55e1d0e1220ecb4b2f89a

SHA256
811afac5ca3b00306c4d806c262e7631ad8cb692172d0756f93273b6125033a7

SHA512
d3a8cf26befcb81f77f80cc71fd1c32ab803c6d421fa791505db50ae3a7d0e51d344bd43c85cea29279c823a08973a6124827630e502b10b0cf57a6a542bfa7b

Download Submit
C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
80KB

MD5
d594d2b14856e8c9fb71e6ac88252a89

SHA1
162910f84e335dc277547293ec9361365a693edc

SHA256
da1eaa03b6f441ef5f93ce95153769e00a8bb68efed6a58eaf64d092cd9fedfd

SHA512
6d94ca3625f1090a1fb319b0939bc3032064123aaf6ada89cc07cdcb96407904bb9ce14a3f8f7a0d8cabbd8e3e8bf50198652c19e469757a4e24a6c5979efa46

Download Submit
C:\Windows\SysWOW64\Abpcon32.exe

Filesize
80KB

MD5
3c59f4991d9cf6b3b9d16826ff56f32d

SHA1
69f34e4fbd9c465809714088536bd7f513020498

SHA256
34832b1aa58eacc89c51d00b7e9f259433a6922d719e851f3548a1de1b9940a3

SHA512
8eb759c84a585252e74396ea3799b8ac4906eb973081148948551ffc55740cbde2d7cd9310c7c1447f1a202f90034267122fbb911c29b9538da4962aff01fd53

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
80KB

MD5
78424b5544a3d85b7f9b2a01e3b7ff36

SHA1
61622c7d2bf2dfbc1972b37d348269c0946ba2e6

SHA256
122d15d9050605ce165073040ec09116a30214b9d05cf576ee5b8c219a40c5f6

SHA512
31276a89259b35151211e57df188124b9ee0372e6cfee967941d18758694f3ecdf05e705589a056c713adfe82ad07d731c46e33ec183d34b0d0e15d1d3ddf4dc

Download Submit
C:\Windows\SysWOW64\Adcmmeog.exe

Filesize
80KB

MD5
27b3554f2e2dc1cf8016f204b136c28d

SHA1
efd0c368f64bb25dccd3e0e7f09336c7bc0f47fb

SHA256
66956794809ed1b7b11b5538d039326992be4e7d7cd0488ef936d2dd33f88760

SHA512
ba795977688696eb0bba1a4355cfe5fc9f53d616e64a3a9f1a180760af27bd680402484b0f358cf12bcabe2b72e06e05a8bf9b5955481bb57ad337229423ce1f

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
80KB

MD5
664e012cfd94a8a2584c083bfde240df

SHA1
d94bb6b9c964713b9bbd3907646e343727eda8eb

SHA256
5b086518f32858d23f4e85928fbdc41c6a235db0e2418104afa2eba67b053f86

SHA512
6ed4f2f08aa0169404b68ddb02a9c853fb360db7f23a800919a86fd353d6de5f29ec6ec16e6b0c24e254bd8ff1797e71d16f19f467ebbc1daea8cff6af6da10e

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
80KB

MD5
da3cb8d68eb68456bf3b21bdf7040d43

SHA1
9202c45c34ab2c5393f0dcb1869ba5ef2635df9e

SHA256
61d286ee7db24c50714f4087040c6940f19819c49c2aa57bf77345db2239831a

SHA512
262d70f22a47858b4158078b3198d67e80419c35432074ab0eae29d31fdfa75048c562de7f6c61e518d137c0d98039d65efefa433aa1440d1a512efd05ce4238

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
80KB

MD5
fcdd2399c5d5ece344c047ce709e33e5

SHA1
b9af5f515b0b651b529a42cb61d54578246bce6a

SHA256
a0ca2fea19ea16f34bece7dfbb7756cecf66ac349dd6d41f7410f2af6b295fb0

SHA512
71670f273627b7afc55685379e6fb9380eebaa535cac1f3c1152f897fee366f407d7950d3033e75cc5a713ac188ec79b942125b587efc6d9a550bea35b7da8ba

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
80KB

MD5
335dee0ee0e627b4529eb18c261c9b15

SHA1
1a9180670b67551080e13ff6083231532670d899

SHA256
816f21e23b8cdd5bd43ac932c110dc4ddc973aae361d82eec30eb5b23143468c

SHA512
e42a72a1720f36ebbb8e4456be07191789833041cc1c824f07812c342d82c29cecff5a56deb1b75c11912451b806ead1f0ebb6188d4e3b4808320e6ff495be45

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
80KB

MD5
0825c9f2d6f13a4d0c316cdaf06eae44

SHA1
2b6a7050cf91c37ee35119e7898230ed8916bc02

SHA256
2e532329c97f9f186e0fe871aa42d7efa4f2f3cc7390c2c14915c83984b5bb7d

SHA512
3f8002d84a2802b07a56f19becdff1ee9880ec7231023557cbf258d335db7e9d4d872beaf8a943d485958018dd23bd6d360f6b9d1bf31122fa7e2a9f65b70be4

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
80KB

MD5
c0def7dae0e418c897a7a6f94bcc755b

SHA1
ef2434ac2db0482c085704ab99423509937b5695

SHA256
b4a6802eb8a3ebf8afabd51ab848a52b03d0c968ab8abd76955cb7b7d33b9aad

SHA512
fba89e07184142bb196012684dcb50be8151adc2a4437f7e6491b2f16695ea33646c58064c979b88f6280c3c7a70b29175d49199a82625752477e53702b0d5b5

Download Submit
C:\Windows\SysWOW64\Ajneip32.exe

Filesize
80KB

MD5
74522cdbcef5c18a92290cc87b1c89d1

SHA1
95b5c982e8222d94ebdce4d2a4275c7dc531fb8b

SHA256
5d93bd2b63276a6b49b996e4df1cedfdb9de42463c09420f1ddb9d6b58086744

SHA512
c6d0ab8e0184c4b641f1dac3aec05c2653371883da112df5a341b5d2169bd0bcab35d356616a4ab22847ee2673c8684db666f897a52643fad48ebede5f66ef11

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
80KB

MD5
5058a0a748863c4e25ee19fc7fd37136

SHA1
154374227d95af58d9e6b55aa0fcf09e27ecb6ba

SHA256
cd3961e9d9931e18154c6d7278c7582bdc4349ff7e886b8d24bf7d76eae91b9c

SHA512
1575f22bd283f77226bfdcefc7d072a3f7808fd26100733ad54f7ec66ddf276762f45ffebdca3cc37fa17f3bdf0b6933411c4ec6814a7b1e864ef001a02adeb0

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
80KB

MD5
8d350aa36cb99ba1bb42a7eeb1f5c28a

SHA1
7d8117b69abf5fea97cc81ba804da1fccab86dce

SHA256
d0f06820e459d113d8bae11bf727391f58f2d66a9cd1d26b177babb8a051af23

SHA512
aabd58110d93a1aab516ba9aed80df649da733e6c98777572538b1100a915a8ffb78746c77fd7623612a0c91676e71c67724b400240c42bac2f6a6f4e6086523

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
80KB

MD5
13cdf950107abb6579f4f8b1fe79fe35

SHA1
8d32d077f4bf3e13fe196e9de949de7c711f9f25

SHA256
a2f786212463c64255c9d4fed77b6688f78069c821842ed24e0aba1fd200a155

SHA512
ed389e3c9651a05675a03759b4880451f80a37a8b3050c92355199805c2321a81a480c2f443a5439c61b1758ecb103e9cd5b84eeb20204a8b44a42c25b01881c

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
80KB

MD5
1ea9a43dc48cdbae123de5ccb6ca0d6f

SHA1
f1bc93a3d0c3568fc4aa5ab802252d73feea59e2

SHA256
355372ae00b10e4cb1632cf527e0522f5315b5c09cd320c5fd69460457c161dc

SHA512
32c4f3b6c8a004fcb1579a71ecccb325531d2238540d626f29a03e4a51aef9a69e6a49f0a35e647842450598478caf76ae7628d369b0d743b8f1cdb1eac26de9

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
80KB

MD5
c125f9ce72c32876c8a341cb1ce9641e

SHA1
b550ea291882b47c318a04c0bb7cbbcdb8eebbe4

SHA256
ae3527abb3a5531354a5e59aaa8f213b9b0d6c78e58e587e2ffa8eb6bd2639de

SHA512
e53fa88ab2508cbf940f618accb53618c69479df657e2488ded25774aac40e7450fc8f3d0f47cc5026c92d3957bf0e39f2532b6505450bdea2e3c25162929375

Download Submit
C:\Windows\SysWOW64\Baaplhef.exe

Filesize
80KB

MD5
9e32803098a0ca3494d089b004547d8b

SHA1
8d4ec4285158245c3d56a57d04fb896e88f81406

SHA256
35ea745bc8bc62e22c871da9506e3649454b22c18094c8a0d4713c229fa3c548

SHA512
82c26182f7a53d3da2b003740f6216f5f2725bf9b05bd004d11cf2c010ddd0d7ee47172c6480a3732eaa546834112a39bc3b5e57c26ab209b185e40f5dd33a03

Download Submit
C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
80KB

MD5
f4fc8a68d13e35b856373112f2d89ac6

SHA1
aec9d53b6d56b33403e9b4a44fc8089384ac1f50

SHA256
70c007c5d2ece7542b68a8f43759ab1bf363025d3fb5486a1a0334ee1c7f1dac

SHA512
d5ba750e824a5c2f3ac2c6dd0893d358a00e515b97cb481a671ac27ad9a8c7c37d1e877e7fb6e9e0a5fffc7cd2a85dcaf4d0017951d63d208e04a537a1b25797

Download Submit
C:\Windows\SysWOW64\Balfaiil.exe

Filesize
80KB

MD5
2c6c617528738e18aef687357a96943d

SHA1
84889c017c1b40ef2090cc04d92b182b6ec76c9c

SHA256
e4e3f758aed1561d81fac02024c5145ef497320bb46c0118af3438b152c0af3f

SHA512
3d4b346669780d5b392cac39dc862369e53f33b837960d80d8c01fb88e161a0b37a9d0a4ec6542a0c9c3751e8567dace5d2a57be75bd7e8595c7ece647d66a09

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
80KB

MD5
aa132bfcdf6b1239c40cf2c70af90ba9

SHA1
772b884ee458eef58b018f8e620d9bea5a1c973e

SHA256
e390ef8d872dc49497ec0286e16ad364b193f0c0c1f344f734edfed4bff6722c

SHA512
e423ec6b4c05b2e1ab79085458eb8e3bd358bb05ab2d64da3173a5e603148c56feb10feda7feccbff09af9332a726c95bcc3a1f377000cbef2b2f5ba78c73ca3

Download Submit
C:\Windows\SysWOW64\Bdfibe32.exe

Filesize
80KB

MD5
3aac6a296d0b1602b9e76f3a3a50d589

SHA1
6d56a67d179fd00c433a10bc6c1c06a8c177119c

SHA256
315e2d9d215b8c80b39e4e269ad424666919402c660ccd7016787e2f7067eb37

SHA512
dcc1e2b624450d3a508f2d260935ea30d7b43564d9caf34de148b65c135de7b00722c8f8b376e3a74f49ec7855651991b98ea0dde88786c5124a545a0f2e1820

Download Submit
C:\Windows\SysWOW64\Bdhfhe32.exe

Filesize
80KB

MD5
71691141fde9fa671d64c9e00ae746ef

SHA1
e4427c315228faaaf037c45503cc4d71cf2bfd48

SHA256
59f34de333d6fb8a2d0b7cb3b474a9cd2905d9822402d174e5f7431c3aa1c36b

SHA512
5a79c9482b0a3801c4ad1070a33f369f7329e2f1a3ed658ff5c19a486434eaee69d622aa0499fb689311cf27b174efb9d137adf6d6bbee1b16328758ac26b729

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
80KB

MD5
9a559db9faa206e22ee2937252eba928

SHA1
b487b0231614894e14572209a1d8fb142d722d7a

SHA256
73cf3ab163086cbbe2260c2e2d0797aa38418ef0c3fa31dd906448f285f708e4

SHA512
275b2400d2dadebd0cc4407f70154fa83e9d18068b332f6b190d064a60da94c7ae44e654ccc2dfdeb899ba2660a086da0eeb44839684a0f1ce3960348685c6f8

Download Submit
C:\Windows\SysWOW64\Behbag32.exe

Filesize
80KB

MD5
bf8c03d8176632d0ede0394577cdfe5a

SHA1
8252590674ad48f3989f8cf271c0b7b59d7e07a8

SHA256
737cbae7dcb70093a9cca7fe069a9dddf0f308aaf355093e0aad5d2902538b42

SHA512
58139d753bec2a491194563bf63ef569bffa2f45b8ff967d7f7a4f8a00ee946bb630ea07095db299a37b134c97302d56905156a309f07bb94c4d509069f669e3

Download Submit
C:\Windows\SysWOW64\Bejogg32.exe

Filesize
80KB

MD5
89c9dc212417e17491b38a71998dd050

SHA1
3301ce10eb4d851a186692c206f299a577c793d3

SHA256
d95492ec4b06d276a140090e531755162c14c4067b6bda6102f64e96badf6cd1

SHA512
b3feeb2bc5731a6c81f862e610349b9f61937775968355a56f8ce21bbb3fb85c2460b421f5bdfd7f4dc50b17885402dcb7c0d6285346c8aadeab3a8f9bf9c50d

Download Submit
C:\Windows\SysWOW64\Bhikcb32.exe

Filesize
80KB

MD5
a4bcb54bd476c753903a05436a8685ae

SHA1
dfaef9950d055a3f41bc95b9ebe80ed9afde472e

SHA256
7af4aa260dd0f7f627d6951a2ae93ce070e9038b89d385a45223232929b4f3ec

SHA512
284d2edd221ba70cd2a82c396fe3457022482da7d7bef09b2cf33fcc6222fa6bdf3d089c04f0b424ac90d8b55b1c257321fb7a3f2195e9ff5e9ba5340e76244a

Download Submit
C:\Windows\SysWOW64\Bjdkjo32.exe

Filesize
80KB

MD5
6ebb0ea7daa361ebaa7bb215b2ae1a9f

SHA1
cbd0db5b6144aa11528274dbec6ec564b614ac67

SHA256
32a1e8cc8e0610142e389b6c79afc11bc062f5c4f3dab04bbefd8986f7040411

SHA512
091d1a3a6d9aeef358170dde0a84a29a6b602e3199cbaa80414d2acdfc882fdd420aa8799df81e6a7d6fbc03b540957e6ea8a893067f8d9f75821b4fc7bfbcbb

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
80KB

MD5
55372d150cf95f356c0afa5044f00b89

SHA1
3113c0d91bf0d2a8d7c8c7a20bbb51fea83f55f5

SHA256
28413de58cfad333b8b89cfa37d8c87782f9364b7eeec56fb1afc3dd68c0050a

SHA512
78a34c910049f47cbdcfbd6e57ced14dc6c2efcd295ad8751ec3f3d2d0b8bdc41f125b43b204268d18d341e3516e1fa7d3a9300d100ec2e376c831b7f6155453

Download Submit
C:\Windows\SysWOW64\Bjpaooda.exe

Filesize
80KB

MD5
c2481f6c621321534f45055d99de0cdc

SHA1
d259052288a013ffedcf6fb6ace87cf59bed8ddd

SHA256
4c0ff754b57fff6754aacb41a6ed1b086d7b9e3e513b5a8682b114cbef59c524

SHA512
552d3115147ef59d5c940a16c15020db6f5a8fef095858570977e1e3a8f300454eb65ba6e50771616425761d3182344e599ab51de810c364aebef53a93c39ac2

Download Submit
C:\Windows\SysWOW64\Blpnib32.exe

Filesize
80KB

MD5
e0814162982e8a8a833428afb84a0187

SHA1
bb4403c3df1e6efe1d894f303949aa41c3e071fc

SHA256
cb2064fb4d77641fc6f1d884464a7870cdeabb3def21096a62425b2d6e397147

SHA512
6604b1db117ae2f18b086f120a20fa8f9704cd20a399d85320346ea08961b4adf8ea34e8b3440164027d9d8588b8e60e127591a26175beeed784f74ed562a8e1

Download Submit
C:\Windows\SysWOW64\Bnnjen32.exe

Filesize
80KB

MD5
c60569aeed25078dd21b58e6bd2bcefd

SHA1
01709d621093ca041538f19cf0d54e66a485e40c

SHA256
0c8868b33ae642f3aafe448c5e3f58ec56ebac17f6c56eaa54320121a185cb20

SHA512
bd80dc8f49753e12d2669a2363b220f6b028417257dbdd2d79d2063c84f6f75b09090c5a8577754533e204f56909b6e55ff994dc00724a1539415db97b7275b6

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
80KB

MD5
845385c497f9cc8fc746c3f0c07dca8e

SHA1
8c3c9d9adcfa1751ba8ac5f97a04aa2b5c9f5147

SHA256
465be2a6836ffa0d06fb2ca07e819b98cfafefbaeb10151705c77f922fa4ce4f

SHA512
0cef3d8fb6e17feeebf37c7757a3cdbb2bdd25085b1de083faf83faa65848b3aaaa43cf9a711c5e9abc170572f615510d9d872a95c8605ac6e733def6f2a7808

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
80KB

MD5
4ca593d6cb2ba98c399ffd55a1ef1fc5

SHA1
f3493306812fcebd99a261997c0d211ecad76ba9

SHA256
81b021064338696417c122215122c919584d66c17fce49be09df84fa4eeea048

SHA512
43e5f1c005a86af83daf03ee6b32c9975ba65ea30b5ebc7705dc5d1f5f41146cc87fba920ff0da508f87b2d9a7ee25bf362dd3e8bdec891db1fbc1bd7d2e6268

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
80KB

MD5
3e5a2ed3ebdd66a86ec468bf227b6d25

SHA1
df1d518a870a015564207977a86f175ca96709b9

SHA256
beba84151296422909458f84e335ab9b84dc118f73820cec8fa24ea1ae689dc1

SHA512
68da094e93207b658c462f2d6a723da90bade488929e1d1c81ad439aa3bf9af90c40da9c790e800db16823799aa6151ff6e88fbd34f744e5d53b46d7fd4d4486

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
80KB

MD5
dfbd08f85442ea20a4b78c56a4798559

SHA1
3cd6c0767520a7f79731b83908a2660ddfa0ebc6

SHA256
cb0c7da5dab3378778c8d7e14fd032f9d5930d978944da9fb40db74abdbe5e92

SHA512
3d308b31f5ceb853ab17d25ac1a3773b828f54e6b4da8a6549ad87df2c5e9fff9b0939be4597493405d4b687f5015781ef2eac13a538d3b9f48c873efd80abc7

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
80KB

MD5
cfe54cbc71f45cecd98e3eb5e9001448

SHA1
09c54ff33c7c181449960cfb24075f7f8c38dc1e

SHA256
29287c2194a3cb7d2ce501498091f296ec3eec1eb065766061d374661db8c0b8

SHA512
2997d5a1ab2587c370137db3329488ffd159a0e87b18af1317ff5388f7a81bdf65a8bdb4d07ce6fe7bc2e6704a268d978afd9f0ce69221835bc9325c46fdb664

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
80KB

MD5
399b5348ef27b9eab6fb7d00c71ae8ef

SHA1
d69444f3a2fafc265689f7e7d0fd5a5fe7b4a2ce

SHA256
c91093d6de3e03c50bb37788d15a7284cb66e29e420931d66390adc12a497edd

SHA512
b52ce9adb64ae253a0eca885038a78df500f57271588df4e0cd1512f69a8be313c2296e0ce5715d772c35acacb7153b71054daebc9d186bd5259e9b5d226ced2

Download Submit
C:\Windows\SysWOW64\Clkndpag.exe

Filesize
80KB

MD5
ab0549f1daa5d17e8a17a4358d9dd013

SHA1
31e0deca353b643f247d5d24a822a542401ed9c3

SHA256
068a2f8803231333794fbedcdb8eb061ed2504dadcb4d0b0cdfe7be2cc26f8a4

SHA512
85f37fcbec75681099fdc8a61c0d8fe7fbce56eebfb05ea3b73d216203a5b39740b674e28084da879b814c795d744e774f7224cfcb1f9a85bde40af1a65adf2a

Download Submit
C:\Windows\SysWOW64\Dadeieea.exe

Filesize
80KB

MD5
a7f6b11ca75992e4d63c414bc122ad0f

SHA1
9d9471917951ad0a3381d5a105c8a530a896e78b

SHA256
858e0eb88c1bc4304e8d8483031f4e44ca8c1bd6bec2bff4d0f73e908bf220d1

SHA512
1ac5b356974d4e5c70b99f98f6863d2a3ad50a9495933e1a7353cbe036a6683d058444a4c1b30391d0c6e2c52d85d03d9093ce7d78c0f9d34af356fae5d3c248

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
80KB

MD5
aa60813fafea1f8f87098d585f6e9a27

SHA1
2331d18ca7b173547de325808d379f2102be3f92

SHA256
a65b37365c57bda39befbf6516da1fd94c43fd108fb3721d69ce370665a7d9dd

SHA512
465502a0dcc919a12ba2bfbeca804615ed26655c4bbc5e5ea6c11869742381b4e9b2e2e192a7a0cf3c809ec901c54519d5ac31be8d14f6e98cf70a128bf5dbfb

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
80KB

MD5
69ddd9d1b9e5cab52eb910fc98c23c3a

SHA1
5c5d817f47fd35c9f89d550cdde298ccb0ae6894

SHA256
aef2c768c56cffedfe0cdd7b7b44f70c83db4bdc8fd1e28c684bf78ce5a3a4aa

SHA512
6f36e75c171fdb32232f963dd694676e0ddae4a1c8ceaf72a10871002b589af39476182c3116d7523c2cdc729cc5ccc50276a848b347d7bf3fb8b37493ab38d3

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
80KB

MD5
f2ff2e4c73eef6732b3e3b4ad83cd6f5

SHA1
e0b22ebf83372234de575cb6d4009dbf1c61cbe8

SHA256
d5989a0aa7a0593273e6e1fafeacfebfaf9ae18138ae786004259e281773ce70

SHA512
a4a9f08dbb01db8f2da5455d52a2dbfdf223b2610baca74af925d8e6dd58fba6da0dd89072bfa2934ed5c7526b1a9950c61c589c64ad3fd4dfd79720abe9f773

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
80KB

MD5
854b120c02065ef87fdf726825c27e2b

SHA1
759d511248f593b45ecc108a61c2733a2e515b3d

SHA256
5711ff6eb7d8d99b1103cb2d3099d34ddab1022110f56138b8288736a6862623

SHA512
2b496c005988c5171ae6a52d2e63e658d17e198e71b7c2ebc17183c2d896b55ef5c5d797f9c0de1e503d0c335fdfca2ab3be22bd930499897cfadb97bf856473

Download Submit
C:\Windows\SysWOW64\Elbmlmml.exe

Filesize
80KB

MD5
1d6bf52b85063673d1161134587f2b4a

SHA1
a0303486696d5a8e0c9e9139b1a0c7a0b634d596

SHA256
5ae7f1d4d14f887e2c66ed9648942a8ab64042ebf0c3aec5ceb05c93a74c9582

SHA512
7dea899c9a9e1e01d382f930ea35fd870d7d5097c8d0c2fcffa15add374cfdff22b1dc6dc63b5b5c3bbf2b84e42dac4ea726b31925e6d1b0216e2fc2cc0e6512

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
80KB

MD5
298f5e3728c802d9ba57dbecfc618d0a

SHA1
353adc1f1e520b6cc49fcee8a94c0e52cb16e1d9

SHA256
953ab003d103adee0e7bd35af1dbdb5e8c3a7876fa52dd28863cda5d03f07bc3

SHA512
730b2e59ac432eb310086248acfc8132fdeda9bf9b82809d895ebf4c82ab0b5968be0c5fd526620ff550f300c37fe5e7f4e7c09c25d70c57fbd5cdd1655e4703

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
80KB

MD5
cb91cad1f4effbb228bab7c65a2d4c9d

SHA1
b4237e90adfaadf743e0f677319702034591efda

SHA256
cd2897d12a8dedd0aa64e4e68b84526aefe8ea1a02a52dd062a3b6337db91e3c

SHA512
e5a86c7df0c27e056dddffc8c64727d63fd186781c028b2f41a4b38a6fa7cfb9f0560af67955a0032fd5a45e9b2e50257e4fe8e75c841f23ad149f48937ceed9

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
80KB

MD5
7120ab883435999c66b715cbf17256ec

SHA1
51f565ffa1c24a8a697cf2230584b232340fe4fa

SHA256
366e5b1afa87abced7ab75c244434dd6043e5acc49c9c849d0c9501ff6d9cc4b

SHA512
a4d2717216787f736439ee2f7278f70c5ae6e24b026642691e1b25515189e69f53fa6bd1fa3205ea9c881f89dc7f4d1ab8276d7d5c1847a26199ec32f08f0b99

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
80KB

MD5
1384504c11a7152121219d5794ee91aa

SHA1
5df82dd120e86a2cd1649a6c4fd755087111eab0

SHA256
7d495cd3efde29cc1d406af5df0cbc1248922e8a4ea2e741720dbf08a5ae5e29

SHA512
97b823af0a703a243d450e1816221bd812b4ea18c0e32c2821c5349405862e09f4726cd0b333e9ea620cd738e3b222c06b07918c31f1349aa5ded53df8295f65

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
80KB

MD5
14f85351be111cd0ae9194e46cb503d4

SHA1
ba2b1dd504dddcb82c9ac38134416a8536f51cb5

SHA256
2f2b733d048522fc8f807bb24ae1420043a7d72a58c9a03f7d1776f65c3f7831

SHA512
4b00bdb609c5217100e30d9e14f7174f6d922843f4384d1f63786808cd4ad5ed2c50f5577675e3eca7d318aae6ed68c0aff7ab45f140d42e6c38188630b9b545

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
80KB

MD5
b0d06b3d65220e63d90e8efa69470baa

SHA1
358c3453e12070833f9949bb3a0992598498dfa4

SHA256
cf48611154f8fccfe0f4c758999da8c24579e52bc29d6e3fc158c22e96e603f9

SHA512
446bcf27280262b4652ed0cdb061aa498b9a334886db7ba9cfaec40b861761f55f5b6e3b8e2a15285dec378242f57dc98ceda976eb8f07c2eafff5d0b94e6838

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
80KB

MD5
f7d67d2b0454e5ed091a6fe815fb0a92

SHA1
ca4492d602b0d4c55790a40d5828d10a16382491

SHA256
054de9432616d3c8d56a67dced70b832caff9c77972dbd696175ce665331d072

SHA512
1cd08e2ef5e016cf8dfde8e6494c85779c63b7b7a0d66895bfc6a391968fc2defea23876c100d8e8839ca141cc921aaede90d30e9bf307295ba7c951008d352b

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
80KB

MD5
ce7d2909369fd3b92fe577f7a99df2ab

SHA1
538479119a69629cc7edaf6433954c1d4ec4d151

SHA256
1b5e37db4405454504dc4dfe2212e41ccff439b8bdf759911edbcdc09ed038c7

SHA512
201c9b7a947026a5b81a676a0115c7b752a782c2cf61c37bb1632ff92f6aae4875be5b6132c11afe7d3aadeb8632601bfb8490076d765679446478945e63d4e4

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
80KB

MD5
ceaff366fa4d61faeae37bf270baab61

SHA1
0b1a9c77496bfcdaff6c8c2737245f744ea2f418

SHA256
c385d4e27f27afe8275d7087cac5f6fa66c4bdfb4f302cddb0d48f39136ab58e

SHA512
8f271dc6ca49f73c0b2c1e70565b5bcad76a68be15cbfd5725f9a9a42f24af23a05d3c3d949666d3bfd5156463fb0f87a426eccad33d80cf334eb949ec9b1651

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
80KB

MD5
341f5edcb144d8bccc241212091ee8c0

SHA1
28e77e3c43ebaa5ef4843b2ce9982f5c3575c32c

SHA256
5c6178502f6c977e2d137fb8877f49f6e13c067d3257b3b6ecce8224da4ad29c

SHA512
ba5d6a1f0be9b296533e92db02ea288829a582d57960ec8a02781688c7dc142579518cab03097c11cd55f8c4d0171b34f84cb89bc9a7526f320a0399e98e645e

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
80KB

MD5
f079342585119381e968b2306f654dc7

SHA1
5bc39e05cd49eef29b9b6fb2fdc7ff4b03326248

SHA256
a5fd36869f88716ecb512b66fc5a0d9e61d964821f782a451ad5d08a86ff906a

SHA512
ed74e4cbe85bcc6774d5be6113adcded46ca9930587f4e9d75ba3add8705694341848f3d1777e480caa2ba3249a7769b06473eb6de474ed6cdd51194b91a1bd7

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
80KB

MD5
40479666c762dfb9983a179b0f022c21

SHA1
c178a7e5c338085568476d6e4aa25cec73a77669

SHA256
5922cfd14756bead49896fc9ccd8ed6e088441e7be8ab9a01e7b38edc0a32eef

SHA512
3e5616a7605c19d887fb4b22ed4093fccef5ec21e0efd9a7691d75780522e4b41a6c236ce5f2c8fbf52e0954611a247a8d911d3bed4603ba5980e7f821d0a78f

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
80KB

MD5
edb53d53ef47eaced0e2040ad9267889

SHA1
56839a8abf3d99f1c1ee8ab69df71e888e1870d4

SHA256
264ceab93b590b7bf94a01d10973ab1345d705bf760d0323a07b66ee268cc369

SHA512
46ab0d77acd671149ab9ebe9bc7450a6a03ba1586c63e8631ffa9a04d40dd68e5b1a857c9d87eb4d0d5fe6776fe1b631042f0037cfb212ea79ecc4d9328c1ea8

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
80KB

MD5
b8b71fa5a12f51b036e717fe0dc50e66

SHA1
1cd0613b3d1971108f8c12976831c64009ca186e

SHA256
584f033ad2cec1922508cf74d662860c3ae8ed848681f289ec3e903323513358

SHA512
6c63b06554e0cde4b62110c291239ce2da3ccbfaf3ae761899c4619085843b755715d161ad64fef800f651a1877014def45539c066c52b9e3a2e3444a49b6ebe

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
80KB

MD5
18e51b3e04aa1ee06c304d8751db318b

SHA1
27bd58cd09d3dea59aaab132025f015934530008

SHA256
cd1869695f71416917aeb44bde7024af57d8d78998f60d7ebe4811e1116e33d4

SHA512
5aa16d2dc9f73bcc7db9493480b1bab23bba756b4f044e9868a8b4a6cb863558c1c4344e1662df8fe378df26f8fcdde4d5781efa1e8f48b0df3c2434cb6829b1

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
80KB

MD5
0773b3457f2ea1f6fa2ffaee12ba7ddd

SHA1
673cb68929cafef2c18b1afccc0c151463866dce

SHA256
f6a670cfc5d34be5636947768a90bf353c171afeeda43cb80bcb52c708b5d774

SHA512
77e5ead3c8539b9f176694fd7d23f8b0908d09f90791765f3f5f9371c05df1c3e56ee18b28cc0354b7b4c96ad06610c8e17aa93cb32955b048ff3d70b02584be

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
80KB

MD5
42742f20d0323bb989361f222e20911f

SHA1
2566aa69252c37214b416b9351f322801769816c

SHA256
2cc4ae74201383ce73684eea09780a5c942bff3445022e970ff1eecc0e83d9c1

SHA512
39b6e439d64b549731f6abc0be8dc974cd6ac1ef9f04c2e57f2260209447ea2be9ba8b2abfc457885c38007070d8af6e3d5ed5715c1d50b5674545a0121fd42b

Download Submit
C:\Windows\SysWOW64\Lpqiemge.exe

Filesize
80KB

MD5
a7a6d0061b96f205cfe2896d43ed1184

SHA1
f7d780cf47893981b84c466ef00864244e08c900

SHA256
f25a06ac32760f63e8994aa228276e216b0be41cbfeb4364941caa7649f912b1

SHA512
84a970ed336c078188a840bc212896afdf20b8cdf4a1c9651200d0f87e758d10fe01a63ed7280109d31088a0500e968bb5fec3628e28eef5a7b72a4f634f577f

Download Submit
C:\Windows\SysWOW64\Mdjagjco.exe

Filesize
80KB

MD5
cfc595e11a368d1332c721e2d0fe6ed1

SHA1
f24fa0b10ce408912f8146775d01e50cc80ae80f

SHA256
2fcad939af812370f3765ae0d16702fbbe0664c763d43e96fa690e3ef3025f47

SHA512
ae00a9a568d2257bc245570a3c380ff551d78c67fc00695245b0735dfa3c201d2d7a7349b8f99931142a2cdfeed668e693307fac8221a0af652164e79205f75a

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
80KB

MD5
88aa8fde471d736fae847949a5fbb418

SHA1
5cb81f9b1a3d352183c9296d420f8e43c78f488f

SHA256
06c1f85e61c6dc6b106705942bcd46b67ffe650556d8d47f2bcd375e7e4b6e73

SHA512
090fa13622bedf43b7add2d313b9a75b32fb9c4136dd350b248e678f9456d8e17a39c98e5df1438ae71ada8f17c9f573e51d205b6ded11db19dbec3c8c2d90c7

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
80KB

MD5
80f9f6f0e97d6586cc0fa9f271e9a738

SHA1
4fd42e8f57f79c2b9446c913b80b1230130d3276

SHA256
0f0e2a6685494f8b61df3d2d514a88bcd667cd0c194eef7f25b3c9d7f27a7066

SHA512
9bbded020ee8b7d4df75fd69c154dbdcc1a80b824e51b1452726adaf81d17279dcbbf5d6662cf09f7f9ca0cdd655ca0502e95446dae1681515df31e456bf6bf0

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
80KB

MD5
d5dde272b4a4e7bcf37f9bcb938307b6

SHA1
230cb602f70e934362298c6335b4cc15806a72bc

SHA256
45d3fa3d94230e35393fefe067c7c8d8ca2ae64bb282ead387ebfb74d8df45bc

SHA512
49f421000b1029a40c33764a3567141c5d3387eb559729b41274c77a13f71a3cbcaa6148833fb6086dd2f48cb1d9c3da3d88be34c86bd550a154b4ddc5650151

Download Submit
C:\Windows\SysWOW64\Nljofl32.exe

Filesize
80KB

MD5
d7ddd7eaee5eb14bb996e0e0ae7f5fc4

SHA1
cfeb839e2fa99fcc171355f0c142c70f8883bfc4

SHA256
8c592f7a74d545ca92c2c17551fbe16d5a30e5afec0b931daa2cac50ef4dc602

SHA512
3fb3a9636b3bcceb9fbf9df19bc2d62f1f291c91758ea3425f5fd369ccf029371c377c2fcf15cbdbd3ac0f10d58e5ac5089611b4ab2aabaff25d29c5babd7fc0

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
80KB

MD5
8a4cc7e620c7f885b9477b8d16dacaad

SHA1
76b1ba7a27e598e9aefd0dc23b93b7bad773d252

SHA256
646e2ea14ccd7402c4583e3405822c6523870956d7f4ca07bdd2536c5db3a306

SHA512
a98eac8578c184d4582e8169188c2c97059026cf90b85455b8a1b9b4386f947125ab46811f6b9ead1d7d9c73f39009a35fd81703cedb554af09d014c323104ce

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
80KB

MD5
7219760e2c2a1f380dc24679417e42f0

SHA1
5130f3a14d9dced01a2076de9456c9dbd3e1bd20

SHA256
df9a5c0457a60c8db990a2d493c3e4774b7790921a64d231235e74e62859d015

SHA512
99ad7c23a16fcbd1f11e3553be0c8674af7d0bd9588841a092d06f856a2da5b9c0a32774667f40267df157850993c204748ce35e7346cf4d51de09d2fdbccfb9

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
80KB

MD5
5b3893f27409099f1589cd25f7193bb6

SHA1
debde44da389f4dc0506bb3258867fbcabce7317

SHA256
6a45c68c2a4d1896c10be36d98f63a0e62bba5f06476a9c7518fb64e655405ff

SHA512
7334b0552fb3a500e47b58b6fb93178c189ab10d8dfb044646d5130ad34db7de125d63ef8ea5d118830134a745e95b0ef39a06455c3b32beee0d8fbe2808386b

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
80KB

MD5
70667e881df27ebd1fa6ac6c8d7bb6dc

SHA1
8d9e789f4f2efca12d02d574a9a6d71b941a6bdf

SHA256
c48949019392aed2e9a8d764faa28958ab4ca2a4c3f9ee7f28547b3ea33571ba

SHA512
454732057dc3ec4fd729a884dcb2b3508b7c8685cff537aa58f535eb46675b59a5bd354ac36caff68472d221a63f63e22282caf3971b0ddbaa37dca1492870c3

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
80KB

MD5
2d4d3ae77eeab8838cff92758b90feb7

SHA1
fd6b2496609febb21fbc5b0843241cfde947c851

SHA256
61a490a06aed703f0f2777294496b457cbf3400ae1f834744bda8aa6c7fcb78c

SHA512
fbc19e97889e81547d0fb48ac1f72cb7aa6db955da0bae74971541d7c0e75b5a555350d9cbd1c7d1ffacda12b4ee7b01290c36eb65ce2355ef0f6a9ecfdbb827

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
80KB

MD5
20183aa3ceecab67ac4d9c199ba3dd9e

SHA1
90fd0a2dbac0305da30fc2bfc4566155e00735b7

SHA256
3d1aec22e8d5669966d2c2a2bf19893a8677bf11d7756ecef4e6c083d1e77a50

SHA512
2dec93c587bae1bdc861496e9be67ee762a03e2ca372ca666ce3311d48a81ec7175de4841d61c67b158746ddb6d7d6a1c96d940a637c53aae0457d45f76c89d4

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
80KB

MD5
c692f90beb74bc7ee80dc6d7353bbc79

SHA1
cbec9de21d50d9747c566aa5d23f515a96ad2796

SHA256
e5c05ec39ef50826493d1269eed98bc3dd8b5bf3c7795a88e7ce9d7080109674

SHA512
28852d241117aa9f6d3800b0a455bf076291c2de88377398f593c247a240f8e16dd21803b3b7dc1383d11e25b5f01c54636005dc97272ffcd3160b619080928d

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
80KB

MD5
473ff9ab19c64f66ddb2cde95bd9837b

SHA1
ee0a7acbe29848ad75b4feaa098a82f65e1ee9d7

SHA256
c385b46bf9396e87ca02aafa532e0d1db6d1a6eb3449bcce064c4c48bf108894

SHA512
afd9735240432dd39e24613b51b385abc465bc74c23d719eeeb2b0ae25c2ad6d1f17571cb400a966aedb4fc1fcefde542c927fcef4c950c488af5b48ac6abcfd

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
80KB

MD5
d81ef0e523efe3975a1f369797e40040

SHA1
d4f8c0f68f4e6575c8701317a18302d6f6b655a6

SHA256
3a3fd00d533b5c103ac4ee540ffee89c10b6225fd0045d86cc60b28983677964

SHA512
3b12fc30555bec019f6dbf0ee8f6ac05b78adbd5c50ab78f0f45932e97276ba88effb5ba2fa92eacfe291ba3a08f6793c54a817d380f7ec650a9713ce1a40835

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
80KB

MD5
9c14fe47f6e3ea0e462dd766edcb09dc

SHA1
833cfa8c1e82543bb641b1d3cfb5bcb9664c2930

SHA256
e93786d2af0469208babfc4f34ef64a12d3fd96bb458a781ee8119471b54f307

SHA512
de96563b786558aa0e0733853814286670a3b004e48f5ff33222537144d50ad9a6de94d7f308e65d4e7d41d59797709041aae6c1ded71120e41a73bcdb1f2d9b

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
80KB

MD5
24b844ac0909499b67da5ab8e94cc89c

SHA1
818e19892ee3c1992b5978fb94b42ad71d8ee6df

SHA256
827c787b49941718213b4d7f92cc4d8d4e2796ecf845db7ffb854eca724c01a0

SHA512
079c8170180c2e2a4ad8a9435652d12e86363996f12585b011e14482a3dce44a23735fe47eea4785b20b48e7259dac8af77300693b3ab0ab6f75ddaf0724ed42

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
80KB

MD5
45ac141a77006c3eb918d42e9cc05d6f

SHA1
e7914aa38c173c5cf05671ba57c6c18941561ac5

SHA256
1ce199636fd810fa70861823c430fcb0fe3559f9f2f1017219d291f4e8a2832d

SHA512
6b9f8b9436b468845e93f53f20277f8068a512257f2751ae847f915c119752f3e71c764b570dc7af9b7cfdc74bb14feeb0f4007c9acf5e0c2207bd5a25e532c5

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
80KB

MD5
ff4edd0fc79ddca4a3c14ea395e916d2

SHA1
f677d57879ece4ced3deb5d72a58e02159ebc76d

SHA256
831003cfc1ff1abc4fafa81f026ead0f7834c08a968fdfa99aa25fd3c665caf9

SHA512
6ff849af877dbda3eb9ac3aaad178daa1789cc025ba873465123751bee308f4e68497be545b0876ea8f490f69bf365bddd1194d848a8257bac068301f0f63ccf

Download Submit
C:\Windows\SysWOW64\Qjbena32.exe

Filesize
80KB

MD5
96f138d817ca8944484449b198d337a4

SHA1
030f118ec82fb1e3f7bd524e3cd61365aaf52591

SHA256
57b7409e39bd7882f959b653ebf7205303c03458f77819e1a38479faaa32074c

SHA512
0df6a3fc5510c3f233495769738b8609c51ad64ec9e84a23307d6676bfe2a32ca7bf4feae4902210eed69e86db4605df4f38578d7b22db3100ff66d53ffdab90

Download Submit
memory/224-551-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/224-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/228-460-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/440-156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/692-418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/884-382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/960-572-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/968-168-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1020-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1020-544-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1240-502-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1284-478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-599-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1376-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1376-565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1420-518-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1532-412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1536-261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-532-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1592-496-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1668-314-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1680-430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-591-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1708-112-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1744-406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1800-92-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1816-320-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1840-472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-490-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2212-448-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2268-36-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2316-104-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2328-442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-196-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2476-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2488-203-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2492-268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2596-520-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2624-466-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2644-85-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2704-424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2904-358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3124-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3124-578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3212-538-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3236-454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3300-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3312-352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3384-592-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3500-216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3672-558-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3672-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3704-488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3772-213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-579-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3968-530-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4068-160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4092-323-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4208-120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4228-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4232-304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4352-394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4468-508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4496-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-224-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4520-96-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4640-400-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4728-585-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4744-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4764-149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4796-340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-266-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4944-559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4960-346-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-545-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5072-334-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-440-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5104-132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads